Hjælp til Hijack this

tjekker den nu

Tak Arlet, du har jo før hjulpet mig

Gå i kontrolpanel ->tilføj/fjern og afinstaller bearshare, da den er årsagen til alt det her.


Du skal nu til at i gang med at fixe:

Deaktiver systemgendannelse:
http://www.arlet.dk/systemgendannelsen.htm

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.


O4 - HKLM\..\Run: [OEM32 Tools] sres32.exe
O4 - HKLM\..\Run: [ivr] winupdate.exe
O4 - HKLM\..\Run: [Sound Loader] sndloader.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\vbfpvzph.exe
O4 - HKLM\..\Run: [Services] C:\vixen.exe
O4 - HKLM\..\Run: [System Update] C:\WINDOWS\System32\sjydrc.exe
O4 - HKLM\..\Run: [Systmesy] Systmesy.exe
O4 - HKLM\..\Run: [Microsoft Intrenet Explorer] Soundsyst.exe
O4 - HKLM\..\Run: [WhenUSave] "C:\Programmer\Save\Save.exe"
O4 - HKLM\..\RunServices: [OEM32 Tools] sres32.exe
O4 - HKLM\..\RunServices: [ivr] winupdate.exe
O4 - HKLM\..\RunServices: [Sound Loader] sndloader.exe
O4 - HKLM\..\RunServices: [Systmesy] Systmesy.exe
O4 - HKLM\..\RunServices: [Microsoft Intrenet Explorer] Soundsyst.exe
O4 - HKCU\..\Run: [OEM32 Tools] sres32.exe
O4 - HKCU\..\Run: [Systmesy] Systmesy.exe
O4 - HKCU\..\Run: [WeatherCast] "C:\Programmer\WeatherCast\Weather.exe" /q

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx


--------------------------------------------------------------------

Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

--------------------------------------------------------------------

Find og slet manuelt i fejlsikret(f8 ved opstart):

C:\vixen.exe
C:\WINDOWS\System32\Systmesy.exe
C:\WINDOWS\System32\Soundsyst.exe
C:\Programmer\Save<-hele mappen
C:\WINDOWS\System32\winupdate.exe
C:\WINDOWS\System32\sndloader.exe
C:\Programmer\WeatherCast<-hele mappen
C:\WINDOWS\System32\vbfpvzph.exe
C:\WINDOWS\System32\sjydrc.exe

------------------------------------------------

Hent og kør ad-aware herfra: http://www.arlet.dk/spywarescanner.htm
slet alt hvad den finder

----------------------------------------------------------

Hent og kør denne scanner fra Kaspersky : http://www.arlet.dk/mwti.htm
Slet alt hvad den finder

----------------------------------------------------------

Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.
Først når din log er endelig godkendt, må du aktiver din systemgendannelse igen.

Tak for meget hurtig hjælp - jeg vender tilbage såsnart det er gjort ;o)

Jeg kan ikke afinstallere bearshare - den skriver den mangler install.log - kan jeg bare fjerne directoryet bearshare, og softlinken - eller skal jeg ind i regedit og fjerne nogle nøgler ?

Det er ikke min computer - det ser ud som om de har installeret den to gange - den ligger både i c:\programmer\bearshare og d:\programmer\bearshare. men jeg kan se at i menuen start -> programmer peger den på d: så det er nok der den er installeret sidst, skal jeg bare prøve at fjerne den (Det er ikke nemt for en unix nørd som mig at finde hoved og hale på en XP maskine)

Ja, gå på d-drevet og slet den.

for en sikkerhedsskyld, så fix også denne i hijackthis, når du når dertil:
O4 - HKLM\..\Run: [BearShare] "D:\Programmer\BearShare\BearShare.exe" /pause

Tak - jeg vender tilbage

Når jeg kører kaspersky checkeren, finder den vira - men den skriver man skal købe programmet for at kunne fjerne dem - jeg kan ikke starte Norton Antivirus op - sikkert pga disse vira.
Flg. Vira finder den:
File C:\WINDOWS\System32\sres32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\sres32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\sres32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\sres32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\sres32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\ftpupd.exe infected by "Worm.Win32.Padobot.n" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\ntfs16.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\qlegwp.exe infected by "Worm.Win32.Padobot.g" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\sndloader.exe.poly infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\sres32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\TFTP10588 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winhlpp32.exe infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winupdate.exe.poly infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\STEEND~1\LOKALE~1\Temp\saveinstwm.exe infected by "not-a-virus:AdWare.SaveNow.z" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\STEEND~1\LOKALE~1\TEMPOR~1\Content.IE5\MMGU08IQ\kkq21[1].gif infected by "TrojanSpy.Win32.Qukart.gen" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Steen Dysted\Lokale indstillinger\Temp\saveinstwm.exe infected by "not-a-virus:AdWare.SaveNow.z" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Steen Dysted\Lokale indstillinger\Temporary Internet Files\Content.IE5\MMGU08IQ\kkq21[1].gif infected by "TrojanSpy.Win32.Qukart.gen" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-500\Dc1.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-500\Dc2.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-500\Dc3.exe infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-500\Dc4.exe infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-500\Dc5.exe infected by "Worm.Win32.Padobot.gen" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-500\Dc6.exe infected by "Worm.Win32.Padobot.n" Virus. Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-500\Dc8\SaveUninst.exe infected by "not-a-virus:AdWare.SaveNow.m" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\67ATLRME\x[1].exe infected by "Worm.Win32.Padobot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\67ATLRME\x[2].exe infected by "Worm.Win32.Padobot.g" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\67ATLRME\x[3].exe infected by "Worm.Win32.Padobot.g" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\67ATLRME\x[4].exe infected by "Worm.Win32.Padobot.n" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\ftpupd.exe infected by "Worm.Win32.Padobot.n" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\ntfs16.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\qlegwp.exe infected by "Worm.Win32.Padobot.g" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\sndloader.exe.poly infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\sres32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\TFTP10588 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\winhlpp32.exe infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\winupdate.exe.poly infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: No Action Taken.
File D:\Brugermapper\Downloads\BSINSTALL.exe infected by "not-a-virus:AdWare.SaveNow.z" Virus. Action Taken: No Action Taken.
File D:\Brugermapper\ianto\BSINSTALL.exe infected by "not-a-virus:AdWare.SaveNow.z" Virus. Action Taken: No Action Taken.
File D:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-1004\Dd4\Installer\BSINSTALL.exe infected by "not-a-virus:AdWare.SaveNow.z" Virus. Action Taken: No Action Taken.
File D:\RECYCLER\S-1-5-21-1220945662-854245398-682003330-1004\Dd4\Installer\saveinstwm.exe infected by "not-a-virus:AdWare.SaveNow.z" Virus. Action Taken: No Action Taken.

Så hent den herfra: http://www.spywareinfo.dk/download/mwav.exe

den fixer problemerne

Det hjalp - nu er den igang med at fjerne / rename filer

hmm ligemeget hvad jeg gør så bliver sres32.exe ved med at komme frem i hijack this

Nu ser hijackthis således ud.. Vixen.exe bliver ved med at komme fram - selvom jeg har slået systemgendannelse fra og har fjernet filen fra failsafe mode ...

Logfile of HijackThis v1.98.2
Scan saved at 12:56:45, on 11-12-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\vixen.exe
C:\WINDOWS\System32\ctfmon.exe
D:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
D:\Programmer\Corel\WordPerfect Office 2000\programs\dad9.exe
D:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
D:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\Messenger\msmsgs.exe
D:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\Internet Explorer\iexplore.exe
D:\Programmer\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\msiexec.exe
C:\lars\hijackthis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.3000.1001\da\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.3000.1001\da\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Programmer\Fælles filer\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\Run: [Services] C:\vixen.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] d:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Desktop Application Director 9.LNK = D:\Programmer\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: hp psc 2000 Series.lnk = D:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101880356296
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325

Nu fik jeg fjerne vixen - er jeg ren nu ????

Logfile of HijackThis v1.98.2
Scan saved at 13:24:58, on 11-12-2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\WINDOWS\System32\ctfmon.exe
D:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
D:\Programmer\Corel\WordPerfect Office 2000\programs\dad9.exe
D:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
D:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programmer\Messenger\msmsgs.exe
D:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
D:\Programmer\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\msiexec.exe
C:\lars\hijackthis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.3000.1001\da\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.3000.1001\da\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Programmer\Fælles filer\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] d:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Desktop Application Director 9.LNK = D:\Programmer\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: hp psc 2000 Series.lnk = D:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Programmer\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programmer\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Programmer\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Programmer\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101880356296
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325

og god karma tildelt - "hurtig og præcis..."

Så er du ren og kan aktiver din systemgendannelse igen

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan hente her : www.arlet.dk/pakke.htm

danke