NEWDOTNET - min pc er gået i kage

test

Umiddelbart gæt:

Prøv, når du står på den grå baggrund.. tryk CTRL-SHIFT-ESCAPE og vælg  Filer og  "Nyt job (Kør)" .. skriv "explorer" uden "'er.

Kan du starte den i fejlsikrettilstand (Taste F8 i opstarten)

mvh
Jan C

ja, jeg kan nu få den til at starte i Fejlsikret uden Netværk

er ved at kopiere det jeg ikke kan udvære over på en anden disk.... hvis det nu går i bæ

og så har jeg afinstalleret NEWDOTNET

Det vil være en god ide, at have disse to programmer liggende på maskinen, til problemet er løst. Newdotnet kan godt nuppe internetforbindelsen.

Hent disse to programmer:
http://cexx.org/lspfix.htm - Direkte download link http://cexx.org/lspfix.zip
http://www.bleepingcomputer.com/forums/index.php?showtutorial=59 - Vejledning.
http://danborg.org/spy/Newnet/winsockxpfix.exe - Winsockfix.

Hvis du skulle miste din internet forbindelse efter fjernelsen af Newnet, så kører du først LSP-FIX. Sæt flueben i "I know what i am doing", klik finish og genstart. Hvis det ikke skulle virke, så kører du Winsockfix. Tag Reg.Backup, og når den er færdig, klik "fix" og genstart.

OBS: LSP-FIX, og/eller Winsockfix må du kun køre hvis du mister internet forbindelsen.

Gå ind her og hent Hijackthis.

Kør Hijackthis, scan, save log og kopier logfilen herind, så kigger jeg på den. Maskinen er nok stadigvæk lidt "ustabil", så lad være med at køre nogle scannere, til jeg har set loggen.

HijackThis er her http://www.spywarefri.dk/vaerktoj.htm

*suk* Et direkte link her  http://www.spywarefri.dk/downloads1/hijackthis.exe

jamen maskinen kan jo ikke starte op, ergo kan jeg ikke komme på nettet og poste fra hijack??

Hordan kan du så skrive på Eksperten :))

Okay. Har du prøvet "Sidst kendte konfiguration hvor systemet virkede". Den ligger i f8 menuen hvor du går i fejlsikret.

Læg programmet og logfilen over på en diskette eller (eller USB-KEY hvis den virker i fejlsikret tilstand)

forevernewbie:

Der er kun 20-25 linier i logfilen...

Kan du specificere hvilke du vil kigge på, så må jeg skrive dem manuelt ind her på den bærbare...??

010 - broken internet access because of LSP chain gap (#5 in chain of 5 missing)

023 - service - bla bla bla - c:\programmer\kaspersky lab\kaspersky anti-virus 6.0\avp.exe -r (file missing)

er man gået i seng? :-)

arrghh!! .-)

010 - broken internet access because of LSP chain gap (#5 in chain of 5 missing)
Din internet forbindelse har det ikke godt. Den er sikkert røget. Der skal du køre LSPfix eller Winsockfix, for at fixe den.

Prøvede du "Sidst kendte konfiguration hvor systemet virkede" ?

Hvis den ikke virker, så bliver du nok nødt til at køre en repair, før vi kan komme videre http://www.hcma.dk/tips1to10.htm#no4 Der er en lille risiko for at den kan gå galt, så godt du har hentet dine vigtige ting ud.

TAK

jeg prøver lige... .-)

Det virkere sateme!!!

Du er en KNAG!!! :-)

hvordan giver jeg dig point...?!

Det var da godt, men kom lige med en HijackThis, så vi kan få fjernet skidtet.

den kommer lige om lidt.

Et andet spørgsmål - lige så snart jeg aktiverer Kaspersky Protection, så ryger adgangen til internettet. Den kan pludseligt ikke finde nogen sider. Slår jeg det så fra igen, så er adgangen til internettet tilbage - uden genstart eller noget.

Kender du noget til det??

Jeg vil mene at du kan få probs igen, hvis Newdotnet ikke bliver fjernet helt, og på den rigtige måde.

Ok, jeg så ikke lige dit svar, men forklaringen er nok det jeg lige skrev.

Eller også bruger du Sygate firewall ;)

Logfile of HijackThis v1.99.1
Scan saved at 23:24:10, on 12-05-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Programmer\Fælles filer\ReGet Shared\Catcher.dll
O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - C:\Programmer\ReGetDx\iebar.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: Download a&lt med ReGet Deluxe - C:\Programmer\Fælles filer\ReGet Shared\CC_All.htm
O8 - Extra context menu item: Download med Re&Get Deluxe - C:\Programmer\Fælles filer\ReGet Shared\CC_Link.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP chain gap (#5 in chain of 5 missing)
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Programmer\Fælles filer\EPSON\EBAPI\eEBSVC.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programmer\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Programmer\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

det er så den fra FØR jeg kørte lsp-fix

Her er den nyeste:

Logfile of HijackThis v1.99.1
Scan saved at 00:14:57, on 13-05-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\D-Tools\daemon.exe
C:\PROGRA~1\Cacheman\Cacheman.exe
C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmer\Fælles filer\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programmer\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Programmer\Fælles filer\ReGet Shared\Catcher.dll
O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - C:\Programmer\ReGetDx\iebar.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: Download a&lt med ReGet Deluxe - C:\Programmer\Fælles filer\ReGet Shared\CC_All.htm
O8 - Extra context menu item: Download med Re&Get Deluxe - C:\Programmer\Fælles filer\ReGet Shared\CC_Link.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programmer\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Programmer\Fælles filer\EPSON\EBAPI\eEBSVC.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programmer\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Programmer\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

Jeg kører med Zone Labs firewall - og nu du sagde det så slog jeg den lige fra, og startede kaspersky...

Og vupti... så virker internettet samtidigt med kaspersky

Program konflikt.

Sker også tit, hvis man har forskellige antivirus programmer kørende samtidig. :)

bittert - kan man ikke gøre noget ved det??

Din log er faktisk ren, men lad os lige tjekke for NewDotNet:

Sørg for stadigvæk at have LSPfix, og Winsockfix i baghånden.

Find uninstalleren, hvis du kan, nede i Windows. Den hedder NDNuninstallX_XX.exe dobbeltklik den, og følg vejledningen. Genstart maskinen (du bliver måske bedt om det).

Tjek om du har mapper som hedder NewDotNet eller bare Newnet, og slet dem hvis de er der.

Så vil jeg foreslå, at du tager et tjek med denne scanner:

Hent denne scanner http://www.superantispyware.com/downloads/SUPERAntiSpyware1241.exe

Installer, og opdater scanneren manuelt. OBS, ved installationen bliver det foreslået at du registrerer med din email. Det behøver du ikke at gøre.

Start op i fejlsikret tilstand.

Start SuperAntiSpyware, klik "Scan your computer", sæt flueben i dine drev, ovre til venstre i vinduet. Ovre til højre i vinduet, sætter du prik i "Perform Complete Scan". Klik "næste", nu scanner den. Når den er færdig, så markerer du det den finder, og lader scannereren fjerne det.

Genstart til normal tilstand (scanneren tilbyder måske at gøre det).

Åbn scanneren igen, og klik "preferences"-> "stastics/logs". Marker loggen, og klik "View log". Kopier loggen her ind i tråden.

Det vil også være en god ide, at køre en scanning med Kaspersky, når du alligevel er i fejlsikret.

Ang Kaspersky, så havde den forrige version et problem med visse firewalls, især Sygate. Den nye som du har, har åbenbart det samme problem. I den forrige version var det "protection against network attakcs", som var problemet. Nu kender jeg ikke den nye version, så prøv lige at tjekke for en indstilling der ligner det. Du kan roligt slå den fra, da den ikke er specielt nødvendig, og slet ikke når du har Zonealarm.

Hmm, det lader til at Zonealarm og Kaspersky 6.0 ikke er helt gode venner, men det kan sikkert godt løses.

Det lader til at du skal slå "proactive defense" fra i Zonealarm http://forum.kaspersky.com/lofiversion/index.php/t11134.html
Måske skal der også skal "pilles" lidt ved nogle andre indstillinger.

Nu ævler jeg. "Proactive defense" i Kaspersky skal slåes fra.

Hov, nu ser jeg lige at Kaspersky har fået en httpscanner, og sådan en har før givet problemer med Zonealarm. Tjek lige, om det ikke hjælper bare at slå den fra.

Her er loggen fra SUPERAntiSpyware:

SUPERAntiSpyware Scan Log
Generated 05/13/2006 at 08:33 AM

Core Rules Database Version : 2930
Trace Rules Database Version: 1050

Memory threats detected  : 0
Registry threats detected : 72
File threats detected    : 202

Adware.MyWay
    HKLM\Software\Classes\CLSID\{014DA6C9-189F-421a-88CD-07CFE51CFF10}
    HKCR\CLSID\{014DA6C9-189F-421A-88CD-07CFE51CFF10}
    HKCR\CLSID\{014DA6C9-189F-421A-88CD-07CFE51CFF10}\InprocServer32
    HKLM\Software\MyWay
    HKLM\Software\MyWay\SearchAssistant

Adware.TopText
    HKLM\Software\Classes\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}\Implemented Categories
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}\Implemented Categories\{00021494-0000-0000-C000-000000000046}
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}\InprocServer32
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}\InprocServer32#ThreadingModel
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}\ProgID
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}\Programmable
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}\TypeLib
    HKCR\CLSID\{9FF56D85-DB4F-4267-B669-8D05B0BF9A04}\VersionIndependentProgID
    C:\PROGRA~1\TopText\eapbh.dll

Unclassified.Unknown Origin
    HKLM\Software\Classes\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}\Implemented Categories
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}\Implemented Categories\{00021493-0000-0000-C000-000000000046}
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}\InprocServer32
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}\InprocServer32#ThreadingModel
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}\ProgID
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}\Programmable
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}\TypeLib
    HKCR\CLSID\{F7384C48-97B6-45DF-A2FA-1D7762D32F9C}\VersionIndependentProgID

Adware.Tracking Cookie
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@hitbox[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-space.hitbox[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@statcounter[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@z1.adserver[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@top.addfreestats[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@dealtime[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ad.ofir[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-bskyb.hitbox[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@paycounter[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@sextracker[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@2o7[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ilead.itrack[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.banneradmin.rai[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@cts.metricsdirect[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@stat.dealtime[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.upspiral[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-ati.hitbox[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ads.pointroll[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@bs.serving-sys[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adv.juventus[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@lscore.adbureau[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@307[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1070926701[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.screensavers[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ad.adtoma[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@paypopup[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@mediaplex[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@cgi-bin[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@as1.falkag[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-rochester.hitbox[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1071829577[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@xxxcounter[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@tradedoubler[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ads.vnuemedia[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@0[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.888[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@counter6.sextracker[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@nextag[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@serving-sys[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ads.cdfreaks[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@atdmt[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@0[6].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ad1.emediate[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@overture[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@atwola[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@zedo[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@425[3].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@tribalfusion[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@belnk[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@targetnet[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@edge.ru4[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adserver.banneradministration[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@creativeby.viewpoint[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@saletrack.co[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@doubleclick[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@e2.emediate[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1070564663[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.statsinaflash[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@qksrv[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adopt.specificclick[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ad1.hardware[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@2[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@a[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@N2614[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@advertising[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@i.screensavers[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@813[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@sel.as-eu.falkag[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@tripod.lycos[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@questionmarket[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@trafficmp[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@0[5].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@563[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@pacificpoker[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@bustypl[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@estat[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ads.tripod.lycos[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ad-ware-pl.web.czest[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adtech[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@dist.belnk[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.bookmarxxx[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@apmebf[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@stats.channel4[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@tripod[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@track.adform[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@weborama[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@bluestreak[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ads.planetactive[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@fastclick[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@yieldmanager[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@dealtime.co[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.dealtime[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@interclick[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-systran.hitbox[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-blastradius.hitbox[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.etracker[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ads.realtechnetwork[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adopt.euroclick[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adfair[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adv.virgilio[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-deltatre.hitbox[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1071434163[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ads2.drivelinemedia[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1072556060[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.serials[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@stat.postdanmark[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@servedby.advertising[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1072556617[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@upspiral[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-iwantoneofthose.hitbox[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@m1.webstats4u[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adknowledge[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@yadro[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@hmt.connexpromotions[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@adultfriendfinder[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@redorbit[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1071460215[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ad.adnet[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@www.redorbit[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@bizrate[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1070265994[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ehg-adidasus.hitbox[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ad.zanox[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1072608787[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@ad.yieldmanager[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@xiti[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1071642027[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1071965287[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@1071908268[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@as-eu.falkag[2].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@stats[1].txt
    C:\Documents and Settings\Thomas Kramer\Cookies\thomas kramer@stats[3].txt
    D:\Cookies\thomas kramer@2o7[1].txt
    D:\Cookies\thomas kramer@ad-indicator[1].txt
    D:\Cookies\thomas kramer@ad.adtoma[1].txt
    D:\Cookies\thomas kramer@ad.ofir[2].txt
    D:\Cookies\thomas kramer@ad1.emediate[2].txt
    D:\Cookies\thomas kramer@adecn[2].txt
    D:\Cookies\thomas kramer@ads.realcastmedia[1].txt
    D:\Cookies\thomas kramer@adtech[2].txt
    D:\Cookies\thomas kramer@adultfriendfinder[1].txt
    D:\Cookies\thomas kramer@adv.juventus[1].txt
    D:\Cookies\thomas kramer@advertising[2].txt
    D:\Cookies\thomas kramer@apmebf[2].txt
    D:\Cookies\thomas kramer@as-us.falkag[1].txt
    D:\Cookies\thomas kramer@as1.falkag[2].txt
    D:\Cookies\thomas kramer@atdmt[2].txt
    D:\Cookies\thomas kramer@atwola[1].txt
    D:\Cookies\thomas kramer@banner.commissionpartner[1].txt
    D:\Cookies\thomas kramer@bs.serving-sys[1].txt
    D:\Cookies\thomas kramer@burstnet[1].txt
    D:\Cookies\thomas kramer@c2.zedo[2].txt
    D:\Cookies\thomas kramer@cas1.click-a-site[1].txt
    D:\Cookies\thomas kramer@clkhype.adbureau[2].txt
    D:\Cookies\thomas kramer@commission-junction[2].txt
    D:\Cookies\thomas kramer@counter.fateback[1].txt
    D:\Cookies\thomas kramer@counter.hitslink[1].txt
    D:\Cookies\thomas kramer@counter.plugin[1].txt
    D:\Cookies\thomas kramer@counter1.sextracker[1].txt
    D:\Cookies\thomas kramer@counter4.sextracker[1].txt
    D:\Cookies\thomas kramer@counter6.sextracker[1].txt
    D:\Cookies\thomas kramer@cracks[1].txt
    D:\Cookies\thomas kramer@cs.sexcounter[2].txt
    D:\Cookies\thomas kramer@dist.belnk[2].txt
    D:\Cookies\thomas kramer@doubleclick[1].txt
    D:\Cookies\thomas kramer@ehg-ati.hitbox[2].txt
    D:\Cookies\thomas kramer@ehg-bskyb.hitbox[1].txt
    D:\Cookies\thomas kramer@ehg-eline.hitbox[1].txt
    D:\Cookies\thomas kramer@ehg-oreilly.hitbox[2].txt
    D:\Cookies\thomas kramer@fastclick[1].txt
    D:\Cookies\thomas kramer@hg1.hitbox[2].txt
    D:\Cookies\thomas kramer@hitbox[2].txt
    D:\Cookies\thomas kramer@maxserving[1].txt
    D:\Cookies\thomas kramer@mediaplex[1].txt
    D:\Cookies\thomas kramer@mscracks[2].txt
    D:\Cookies\thomas kramer@qksrv[1].txt
    D:\Cookies\thomas kramer@questionmarket[1].txt
    D:\Cookies\thomas kramer@servedby.advertising[2].txt
    D:\Cookies\thomas kramer@server.iad.liveperson[1].txt
    D:\Cookies\thomas kramer@serving-sys[1].txt
    D:\Cookies\thomas kramer@sextracker[2].txt
    D:\Cookies\thomas kramer@spylog[1].txt
    D:\Cookies\thomas kramer@starware[2].txt
    D:\Cookies\thomas kramer@stat.katalysatormedia[1].txt
    D:\Cookies\thomas kramer@statcounter[1].txt
    D:\Cookies\thomas kramer@targetnet[1].txt
    D:\Cookies\thomas kramer@techtracker[2].txt
    D:\Cookies\thomas kramer@track.adform[2].txt
    D:\Cookies\thomas kramer@tradedoubler[2].txt
    D:\Cookies\thomas kramer@tribalfusion[2].txt
    D:\Cookies\thomas kramer@tripod[1].txt
    D:\Cookies\thomas kramer@valueclick[2].txt
    D:\Cookies\thomas kramer@versiontracker[1].txt
    D:\Cookies\thomas kramer@www.banneradmin.rai[2].txt
    D:\Cookies\thomas kramer@www.mystats[1].txt
    D:\Cookies\thomas kramer@www.screensavers[2].txt
    D:\Cookies\thomas kramer@www.serialsite[2].txt
    D:\Cookies\thomas kramer@yadro[2].txt
    D:\Cookies\thomas kramer@z1.adserver[2].txt
    D:\Cookies\thomas kramer@zedo[2].txt

Adware.WhenU
    HKCR\WUSN.1
    HKCR\WUSN.1#WUSN_Id
    HKCR\WUSE.1
    HKCR\WUSE.1#WUSE_Id

Adware.Ezula
    HKCR\EZulaBootExe.InstallCtrl
    HKCR\EZulaBootExe.InstallCtrl\CLSID
    HKCR\EZulaBootExe.InstallCtrl\CurVer
    HKCR\EZulaBootExe.InstallCtrl.1
    HKCR\EZulaBootExe.InstallCtrl.1\CLSID
    HKCR\CLSID\{C03351A4-6755-11D4-8A73-0050DA2EE1BE}
    HKCR\CLSID\{C03351A4-6755-11D4-8A73-0050DA2EE1BE}#AppID
    HKCR\CLSID\{C03351A4-6755-11D4-8A73-0050DA2EE1BE}\LocalServer32
    HKCR\CLSID\{C03351A4-6755-11D4-8A73-0050DA2EE1BE}\ProgID
    HKCR\CLSID\{C03351A4-6755-11D4-8A73-0050DA2EE1BE}\Programmable
    HKCR\CLSID\{C03351A4-6755-11D4-8A73-0050DA2EE1BE}\TypeLib
    HKCR\CLSID\{C03351A4-6755-11D4-8A73-0050DA2EE1BE}\VersionIndependentProgID
    HKCR\TypeLib\{C0335197-6755-11D4-8A73-0050DA2EE1BE}
    HKCR\TypeLib\{C0335197-6755-11D4-8A73-0050DA2EE1BE}\1.0
    HKCR\TypeLib\{C0335197-6755-11D4-8A73-0050DA2EE1BE}\1.0\0
    HKCR\TypeLib\{C0335197-6755-11D4-8A73-0050DA2EE1BE}\1.0\0\win32
    HKCR\TypeLib\{C0335197-6755-11D4-8A73-0050DA2EE1BE}\1.0\FLAGS
    HKCR\TypeLib\{C0335197-6755-11D4-8A73-0050DA2EE1BE}\1.0\HELPDIR
    HKCR\Interface\{C03351A3-6755-11D4-8A73-0050DA2EE1BE}
    HKCR\Interface\{C03351A3-6755-11D4-8A73-0050DA2EE1BE}\ProxyStubClsid
    HKCR\Interface\{C03351A3-6755-11D4-8A73-0050DA2EE1BE}\ProxyStubClsid32
    HKCR\Interface\{C03351A3-6755-11D4-8A73-0050DA2EE1BE}\TypeLib
    HKCR\Interface\{C03351A3-6755-11D4-8A73-0050DA2EE1BE}\TypeLib#Version
    HKCR\AppId\eZulaBootExe.EXE
    HKCR\AppId\eZulaBootExe.EXE#AppID
    HKCR\AppId\{C0335198-6755-11D4-8A73-0050DA2EE1BE}
    HKCR\CLSID\{9CFA26C0-81DA-4C9D-A501-F144A4A000FA}
    HKCR\CLSID\{9CFA26C0-81DA-4C9D-A501-F144A4A000FA}\InprocServer32
    HKCR\CLSID\{9CFA26C0-81DA-4C9D-A501-F144A4A000FA}\InprocServer32#ThreadingModel
    HKCR\CLSID\{9CFA26C0-81DA-4C9D-A501-F144A4A000FA}\ProgID
    HKCR\CLSID\{9CFA26C0-81DA-4C9D-A501-F144A4A000FA}\Programmable
    HKCR\CLSID\{9CFA26C0-81DA-4C9D-A501-F144A4A000FA}\TypeLib
    HKCR\CLSID\{9CFA26C0-81DA-4C9D-A501-F144A4A000FA}\VersionIndependentProgID
    HKCR\TypeLib\{9CFA26C1-81DA-4C9D-A501-F144A4A000FA}
    HKCR\TypeLib\{9CFA26C1-81DA-4C9D-A501-F144A4A000FA}\1.0
    HKCR\TypeLib\{9CFA26C1-81DA-4C9D-A501-F144A4A000FA}\1.0\0
    HKCR\TypeLib\{9CFA26C1-81DA-4C9D-A501-F144A4A000FA}\1.0\0\win32
    HKCR\TypeLib\{9CFA26C1-81DA-4C9D-A501-F144A4A000FA}\1.0\FLAGS
    HKCR\TypeLib\{9CFA26C1-81DA-4C9D-A501-F144A4A000FA}\1.0\HELPDIR

Trojan.NewDotNet
    HKU\.DEFAULT\Software\New.net
    HKU\S-1-5-18\Software\New.net

27.EXE
    E:\System Volume Information\_restore{0806B7EE-7053-4588-9E1C-A418E493DBE5}\RP15\A0001225.exe

Så er der ikke mere NewDotNet eller andet skidt. Din maskine er ren nu.


Efter et virus/spyware angreb, er det altid en god ide at rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.

Hent ATF Cleaner her fra http://www.atribune.org/content/view/19/2/

Start ATF Cleaner. Sæt flueben i "Select all" (du kan undlade cookies, hvis du vil). Klik "Empty selected".

Link til sikring af din computer http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

IE-Spyad og Spywareblaster fra pakken, vil være et godt supplement til din sikkerhed.


Prøvede du forslagende mht Kaspersky og Zonealarm ?

Jeg har fået det til at virke - takket være dit link.

Jeg siger rigtig mange tak for hjælpen - du reddede mig fra en unødvendig geninstallation af hele gøjemøget, og mange spildte timer.

Jeg håber du har fået pointene nu :-)

Det var da godt det lykkedes :)

Næh, jeg har nu ikke fået point. Prøv at markere mit brugernavn, og klik accepter.