Kan ikke ændre Wallpaper i Windows XP

Smid din XP cdrom i dit drev og kør "sfc /scannow" (i start kør)


MVH

JAN C

"...noget spyware og efter fjernelsen af dette ..." - er du sikker på at du har fået 'alt' væk ?

Kør ellers denne procedure: http://www.eksperten.dk/artikler/954

(Ikke nødvendigvis mig der følger op...)

Til dr1:

Jeg har prøvet at køre alle scanningerne og vil lægge log'erne op i det andet forum som henvises til i artiklen.

Til jacla:
Jeg har prøvet at skrive dit forslag på alle mulige måder i kør, men kan ikke få det til at virke. Hvad skal der helt præcis stå i kør(hele stien)?

Du kan bare kopiere de relevante logs ind her, husk kun det absolut nederste af Dr.Web loggen.

der skal stå sfc /scannow og der skal være et mellemrum mellem sfc og /.

så skulle det virke

MVH

Jan C

Til jacla:
Ahhhhh... Nu virker det, men det løste ikke problemet.

-

Her er de forskellige logs:

Dr.Web:

Scan statistics

Objects scanned: 253
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 3096 Kb/s
Scan time: 00:00:22



Total session statistics

Objects scanned: 253
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 3096 Kb/s
Scan time: 00:00:22

SAS:
SUPERAntiSpyware Scan Log
Generated 04/29/2006 at 01:17 PM

Core Rules Database Version : 2904
Trace Rules Database Version: 1038

Memory threats detected  : 0
Registry threats detected : 1
File threats detected    : 3

Adware.180solutions/ZangoSearch
    HKCR\AppId\{D28CD14C-50BE-4CFA-951E-B37F25DA3472}

Adware.180solutions/Search Assistant
    C:\BACKUP MAPPE\$C\Documents and Settings\Jacob From\Lokale indstillinger\Temp\180sainstaller.exe
    C:\Documents and Settings\Mester\Lokale indstillinger\Temp\ICD1.tmp\SAIX.#ll
    C:\System Volume Information\_restore{B74D94D3-D1DB-4052-A567-C83FE77FCA49}\RP36\A0034041.exe


Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 14:06:25, on 29-04-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Nero\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmer\Winamp\winampa.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Nero\InCD\InCD.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\HistoryKill 2006\histkill.exe
C:\Programmer\BestPopupKiller\BestPopupKiller.exe
C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE
C:\Super AntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
D:\Programmer\Common\Bin\WinCinemaMgr.exe
C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
C:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\Programmer\Fælles filer\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\notepad.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Hijack This\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sporten.tv2.dk/nfl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmer\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programmer\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Nero\InCD\InCD.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [histkill] "C:\Programmer\HistoryKill 2006\histkill.exe" /STARTUP
O4 - HKCU\..\Run: [BestPopupKiller] "C:\Programmer\BestPopupKiller\BestPopupKiller.exe" /STARTUP
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Super AntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Programmer\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c32.cab?843373210750d3999b1fa7dea75638639044ba9b81aae879963f6ea5e0ccae04465cedf95be72974d84aafc58554af010c005919f785f94d9a9ee8a975615a0f6c4194226086:004d5a2ea06fdfd48a08e1adeff7b444
O20 - Winlogon Notify: SASWinLogon - C:\Super AntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmer\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programmer\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Nero\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programmer\Fælles filer\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ren log.

Hent dette lille værktøj, og gem det på dit skrivebord:
http://danborg.org/spy/download/Deskfix.exe

Dobbeltklik på den nye fil. Der vil komme en melding om, at brugen er på eget ansvar. Her skal du acceptere for at komme videre. Herefter forsvinder alt indhold fra dit skrivebord og proceslinien for et kort øjeblik. Når programmet melder at det har rettet din registrering, klikker du på OK.

Har du problemer med at køre exe-filen, kan du prøve denne fil i stedet (du må gerne oplyse herom i dit næste svar). Proceduren er den samme:
http://danborg.org/spy/download/Deskfix.vbs

Fantastisk. Min søn er tilbage på skrivebordet :-)

Nederste link (.vsb) virkede. Alt er normalt.

Tak for hjælpen. Hvordan er det så med pointene til det rigtige svar?

Har fundet ud af det. Tak for hjælpen igen

Velbekomme.*S*