Avatar billede yorktuba Nybegynder
29. oktober 2004 - 23:01 Der er 17 kommentarer og
4 løsninger

Ad-aware - hjælp!!

Kære Eksperter!
Ad-aware melder: Win32.TrojanDownloader.Swizzor.br. men mit antivirus-program kan ikke finde noget (Antivir)
Hvad gør man så?! Please hjælp!
Jeg sender også lige en "hijackthis" logfil for jeg synes at min pc er blevet MEGET langsom på det sidste.

Kærligst Kristina

logfilen:
Logfile of HijackThis v1.97.7
Scan saved at 22:33:18, on 29-10-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\Programmer\HPQ\One-Touch\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\HPConfig.exe
C:\Programmer\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
c:\progra~1\intern~1\iexplore.exe
C:\DOCUME~1\KRISTI~1\LOKALE~1\Temp\Midlertidig mappe 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pzsyepbfjmucpyqablyxwtkv.com/ovF7p4qE_8hEhb6/tc7jev8fJR8OZgBORo4nOg_O458y8ZRi1Cnx3RPwXXJnx7eW.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {070A6B7E-2ADC-5578-2769-0AF961CA7C4A} - (no file)
O2 - BHO: (no name) - {5CC99ED8-B702-5120-7150-111FA51FE486} - C:\DOCUME~1\KRISTI~1\APPLIC~1\WAVETW~1\locks else.exe
O2 - BHO: (no name) - {A114D52B-870C-4F15-8021-B6D7F91A054B} - c:\Programmer\SIKKERHEDSKOPI\iFinger\plugins\IE.ifp
O2 - BHO: (no name) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Programmer\TEXTware\QUICKfind\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Display Settings] C:\Programmer\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Programmer\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Bore save for fast] C:\Documents and Settings\All Users\Application Data\findshimboresave\Sizescr.exe
O4 - HKLM\..\Run: [Zone Labs Client] "c:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Spyware Stormer] C:\Programmer\Spyware Stormer\SpywareStormer.Exe
O4 - HKLM\..\Run: [dent ball hole type] C:\Documents and Settings\All Users\Application Data\rect vga dent ball\style wait.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [About skip] C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\BoreBlueFirst.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Startup: Rainlendar.lnk = C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: iFinger (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38062.0007986111
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Avatar billede resist Nybegynder
29. oktober 2004 - 23:28 #1
Nu skal jeg kigge loggen igennem.
Avatar billede resist Nybegynder
29. oktober 2004 - 23:41 #2
Afinstaller Spyware Stormer via tilføj/fjern programmer.

Opret en mappe kun til HijackThis. Placer HijackThis i denne mappe og kør programmet derfra.

Herunder er der nogle filer, som du skal fixe. Sæt en vinge ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned.

Fix disse med HijackThis:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pzsyepbfjmucpyqablyxwtkv.com/ovF7p4qE_8hEhb6/tc7jev8fJR8OZgBORo4nOg_O458y8ZRi1Cnx3RPwXXJnx7eW.jsp

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {070A6B7E-2ADC-5578-2769-0AF961CA7C4A} - (no file)

O2 - BHO: (no name) - {5CC99ED8-B702-5120-7150-111FA51FE486} - C:\DOCUME~1\KRISTI~1\APPLIC~1\WAVETW~1\locks else.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Bore save for fast] C:\Documents and Settings\All Users\Application Data\findshimboresave\Sizescr.exe
O4 - HKLM\..\Run: [Spyware Stormer] C:\Programmer\Spyware Stormer\SpywareStormer.Exe
O4 - HKLM\..\Run: [dent ball hole type] C:\Documents and Settings\All Users\Application Data\rect vga dent ball\style wait.exe
O4 - HKCU\..\Run: [About skip] C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\BoreBlueFirst.exe

----
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
----

Genstart i fejlsikret tilstand (F8 i opstart).  Find og slet:

C:\DOCUME~1\KRISTI~1\APPLIC~1\WAVETW~1\ >>>> mappen WAVETW~1
C:\Documents and Settings\All Users\Application Data\findshimboresave\ >>>> mappen findshimboresave
C:\Documents and Settings\All Users\Application Data\rect vga dent ball\ >>>> mappen rect vga dent ball
C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\ >>>> mappen EGGSFR~1


Genstart almindeligt og send en ny log herind til tjek – tak.
Avatar billede resist Nybegynder
29. oktober 2004 - 23:43 #3
Når du har fulgt min vejledning, så lav venligst den nye log med denne version af HijackThis: http://danborg.org/spy/HJT/hijackthis.exe
Avatar billede yorktuba Nybegynder
02. november 2004 - 20:39 #4
Mange tak for hjælpen indtil videre! Undskyld det har taget lidt tid inden jeg har reageret på dine anvisninger , men jeg har ikke været hjemme!

Kærligst Kristina

Her er så min nye "hijackthis" :

Logfile of HijackThis v1.98.2
Scan saved at 20:28:14, on 02-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\Programmer\HPQ\One-Touch\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\HPConfig.exe
C:\Programmer\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kristina Heil\Dokumenter\Modtagne filer\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.kqszgvruvt.com/ovF7p4qE_8hEhb6/tc7jev8fJR8OZgBORo4nOg_O45_OGxxvM/yktxPwXXJnx7eW.jpg
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - c:\Programmer\SIKKERHEDSKOPI\iFinger\plugins\IE.ifp
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Programmer\TEXTware\QUICKfind\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Display Settings] C:\Programmer\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Programmer\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "c:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [SpySweeper] "C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [About skip] C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\BoreBlueFirst.exe
O4 - Startup: Rainlendar.lnk = C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\System32\SHDOCVW.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
Avatar billede resist Nybegynder
02. november 2004 - 22:05 #5
Fix disse med HijackThis:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.kqszgvruvt.com/ovF7p4qE_8hEhb6/tc7jev8fJR8OZgBORo4nOg_O45_OGxxvM/yktxPwXXJnx7eW.jpg

O4 - HKCU\..\Run: [About skip] C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\BoreBlueFirst.exe

Genstart i fejlsikret tilstand. Find og slet:

C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\ >>>> mappen EGGSFR~1 (mappen hvor BoreBlueFirst.exe er i)

Genstart normalt og kopier en ny log herind til tjek – tak.
Avatar billede yorktuba Nybegynder
03. november 2004 - 19:35 #6
Hej igen.
Jeg har gjort som du har skrevet - her er den nye log:

Logfile of HijackThis v1.98.2
Scan saved at 19:33:02, on 03-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\Programmer\HPQ\One-Touch\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\HPConfig.exe
C:\Programmer\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kristina Heil\Dokumenter\Modtagne filer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - c:\Programmer\SIKKERHEDSKOPI\iFinger\plugins\IE.ifp
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Programmer\TEXTware\QUICKfind\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Display Settings] C:\Programmer\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Programmer\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "c:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - Startup: Rainlendar.lnk = C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\System32\SHDOCVW.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
Avatar billede resist Nybegynder
03. november 2004 - 20:29 #7
Fix denne:
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
Genstart.

Herefter ser din log ren ud

Du skal lige slå systemgendannelse fra. Hvis du ikke ved, hvordan du gør, så kig her: http://www.spywarefri.dk/virusscannere.htm#alle
Herefter genstarter du og slår systemgendannelse til igen. Du må også sætte mappeindstillinger tilbage til oprindelige indstillinger.

Hvis du ikke allerede har Ad-Aware, så hent og installer programmet. Opdater det straks efter installationen - inden du kører en scanning. Fjern alt hvad programmet finder. Programmet samt brugervejledning på dansk finder du her: http://www.spywarefri.dk/vaerktoj.htm#adaware

Her er et link til sikker surfing: http://www.spywarefri.dk/pakken.htm

Hjalp ”kuren”?
Avatar billede yorktuba Nybegynder
03. november 2004 - 21:18 #8
Jeg vil gerne sige tusind tak for hjælpen!! Det var jo bare fantastisk!

Lige en sidste ting; "http://searchweb2.com/" er begyndt at være startsiden når jeg går på nettet (det har den også gjort før, for et stykke tid siden) selvom jeg har sat google.dk til at være startsiden. Hvorfor gør den det - og hvad kan jeg gøre for at den ikke dukker op med alle sine reklamer?

Kærligst Kristina
Avatar billede resist Nybegynder
03. november 2004 - 21:48 #9
Det skal også væk!

Prøv lige at komme med en ny log fra HijackThis - gerne hvor startsiden lige har skiftet til searchweb2.com.
Avatar billede resist Nybegynder
03. november 2004 - 21:48 #10
Og velbekomme, jeg hjælper gerne ;-)
Avatar billede yorktuba Nybegynder
03. november 2004 - 21:56 #11
Jeg er virkelig taknemmelig! :-) Ændrede nu med det samme startsiden igen - og den har også accepteret det nu, MEN hver evig eneste gang jeg går på nettet, kommer der en blå bjælke frem nederst på skærmen. Jeg kan under "egenskaber" se, at det er fra det der "searchweb" (http://searchweb2.com/passthrough/newpass2.html)
Men her er den nye log:

Logfile of HijackThis v1.98.2
Scan saved at 21:51:17, on 03-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\Programmer\HPQ\One-Touch\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\HPConfig.exe
C:\Programmer\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\SIKKERHEDSKOPI\FirstClass\fcc32.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kristina Heil\Dokumenter\Modtagne filer\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fjeonvvxsgefgukqinnjlrs.com/ovF7p4qE_8hEhb6/tc7jev8fJR8OZgBORo4nOg_O45_i/60Lk2EJdRPwXXJnx7eW.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5CC99ED8-B702-5120-7150-111FA51FE486} - C:\DOCUME~1\KRISTI~1\APPLIC~1\WAVETW~1\locks else.exe
O2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - c:\Programmer\SIKKERHEDSKOPI\iFinger\plugins\IE.ifp
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Programmer\TEXTware\QUICKfind\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Display Settings] C:\Programmer\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Programmer\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "c:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [dent ball hole type] C:\Documents and Settings\All Users\Application Data\rect vga dent ball\dead link.exe
O4 - HKCU\..\Run: [About skip] C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\BoreBlueFirst.exe
O4 - Startup: Rainlendar.lnk = C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\System32\SHDOCVW.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
Avatar billede resist Nybegynder
03. november 2004 - 22:21 #12
Får du slettet mapperne fra fejlsikret tilstand som beskrevet?

Fix disse med HijackThis (alle vinduer undtagen HijackThis skal være lukket):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fjeonvvxsgefgukqinnjlrs.com/ovF7p4qE_8hEhb6/tc7jev8fJR8OZgBORo4nOg_O45_i/60Lk2EJdRPwXXJnx7eW.php

O2 - BHO: (no name) - {5CC99ED8-B702-5120-7150-111FA51FE486} - C:\DOCUME~1\KRISTI~1\APPLIC~1\WAVETW~1\locks else.exe

O4 - HKLM\..\Run: [dent ball hole type] C:\Documents and Settings\All Users\Application Data\rect vga dent ball\dead link.exe
O4 - HKCU\..\Run: [About skip] C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\BoreBlueFirst.exe

Genstart i fejlsikret tilstand (F8 i opstart). Find og slet:

C:\DOCUME~1\KRISTI~1\APPLIC~1\WAVETW~1\ >>>> mappen WAVETW~1 (mappen hvor ”locks else.exe” er i)
C:\Documents and Settings\All Users\Application Data\rect vga dent ball\ >>>> mappen rect vga dent ball (mappen hvor “dead link.exe” er i)
C:\DOCUME~1\KRISTI~1\APPLIC~1\EGGSFR~1\ >>>> mappen EGGSFR~1 (mappen hvor “BoreBlueFirst.exe” er i)

Genstart normalt og kopier en ny log herind – tak.
Avatar billede yorktuba Nybegynder
03. november 2004 - 22:45 #13
Jeg tror, at jeg ikke fik slettet alle mapperne fra fejlsikret tilstand i starten, men nu har jeg gjort alt sådan som du har beskrevet det!!


Logfile of HijackThis v1.98.2
Scan saved at 22:44:07, on 03-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\Programmer\HPQ\One-Touch\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\HPConfig.exe
C:\Programmer\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kristina Heil\Dokumenter\Modtagne filer\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cakuehqgtqlsoafltgobl.net/ovF7p4qE_8hEhb6/tc7jev8fJR8OZgBORo4nOg_O459DxCgq/REEDRPwXXJnx7eW.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - c:\Programmer\SIKKERHEDSKOPI\iFinger\plugins\IE.ifp
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Programmer\TEXTware\QUICKfind\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Display Settings] C:\Programmer\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Programmer\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "c:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - Startup: Rainlendar.lnk = C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\System32\SHDOCVW.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
Avatar billede resist Nybegynder
03. november 2004 - 23:05 #14
Det er vigtigt at få slettet mapperne som beskrevet ;-)

Fix denne:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cakuehqgtqlsoafltgobl.net/ovF7p4qE_8hEhb6/tc7jev8fJR8OZgBORo4nOg_O459DxCgq/REEDRPwXXJnx7eW.html

Genstart. Hvis den igen optræder i en HijackThis-log, så fix den igen og genstart.

Kopier en ny log herind – tak.
Avatar billede yorktuba Nybegynder
04. november 2004 - 08:05 #15
værsgo - her er den nye log:

Logfile of HijackThis v1.98.2
Scan saved at 08:03:23, on 04-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\Programmer\HPQ\One-Touch\OneTouch.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\AVPersonal\AVGNT.EXE
C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
C:\Programmer\AVPersonal\AVGUARD.EXE
C:\Programmer\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\HPConfig.exe
C:\Programmer\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kristina Heil\Dokumenter\Modtagne filer\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - c:\Programmer\SIKKERHEDSKOPI\iFinger\plugins\IE.ifp
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Programmer\TEXTware\QUICKfind\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Display Settings] C:\Programmer\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Programmer\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmer\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "c:\Programmer\SIKKERHEDSKOPI\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programmer\AVPersonal\AVGNT.EXE /min
O4 - Startup: Rainlendar.lnk = C:\Programmer\SIKKERHEDSKOPI\Rainlendar\Rainlendar.exe
O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programmer\SIKKERHEDSKOPI\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\System32\SHDOCVW.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
Avatar billede resist Nybegynder
04. november 2004 - 11:34 #16
Den nye log ser ren ud.

Du skal lige slå systemgendannelse fra: http://www.spywarefri.dk/virusscannere.htm#alle genstarte og slå systemgendannelse til igen. Herefter må du også sætte mappeindstillinger tilbage til oprindelige indstillinger.

Hjalp ”kuren”?
Avatar billede resist Nybegynder
06. november 2004 - 22:21 #17
Lukketid?
Avatar billede yorktuba Nybegynder
08. november 2004 - 21:47 #18
tusind tak for hjælpen!!
Det er vidst nu du skal have 200 point, men hvordan tildeler jeg lige dem? ;)

Kærligst Kristina
Avatar billede resist Nybegynder
08. november 2004 - 22:52 #19
Marker mit navn (resist) og accepter svaret ;-)
Avatar billede yorktuba Nybegynder
09. november 2004 - 17:51 #20
ahh smart ;o)
Avatar billede resist Nybegynder
09. november 2004 - 19:19 #21
Takker for point ;-)
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester