spy/ ad ware ØV

Prøv regcleaner på spywarefree.dk

Hent en hijackthis : http://www.arlet.dk/hjt.htm

Med en hijackthis skal vi nok få den væk

Logfile of HijackThis v1.97.7
Scan saved at 21:50:04, on 15-04-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\trcboot.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
C:\Programmer\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\drivers\ldlcserv.exe
C:\Programmer\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\pctspk.exe
C:\Programmer\Softex\Winroute\winroute.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\Programmer\Fælles filer\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
C:\Programmer\Logitech\ImageStudio\LogiTray.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\WINNT\MS\SMS\CLICOMP\SWDist32\bin\smsmon32.exe
C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
C:\WINNT\dl.exe
C:\WINNT\dlm.exe
C:\PROGRA~1\DOESUP~1\setup bike.exe
C:\WINNT\system32\internat.exe
C:\Programmer\Fælles filer\Nokia\Services\ServiceLayer.exe
C:\Programmer\Microsoft Office\Office\OSA.EXE
C:\Programmer\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programmer\SysAI\SysAI.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\FlashGet\flashget.exe
C:\Downloads\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://prosearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://prosearching.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://prosearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://prosearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://prosearching.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://prosearching.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
N3 - Netscape 7: user_pref("browser.startup.homepage", "prosearching.com"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\h36i7kvw.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgrammer%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\h36i7kvw.slt\prefs.js)
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\SysAI\AproposPlugin.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {81A541C9-C17F-4A79-9F36-DA21683226C2} - C:\PROGRA~1\SOFTWA~1\BYTE JUMP.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: window else - {B8C8EA37-DFFD-2052-F1BE-CDB182844CF9} - C:\PROGRA~1\SOFTWA~1\BYTE JUMP.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [winroute] C:\Programmer\Softex\Winroute\winroute.exe
O4 - HKLM\..\Run: [SMS Application Launcher] C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
O4 - HKLM\..\Run: [CreateCD50] "C:\Programmer\Fælles filer\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] C:\Programmer\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [Dial32] C:\WINNT\dl.exe
O4 - HKLM\..\Run: [Dial33] C:\WINNT\dlm.exe
O4 - HKLM\..\Run: [CakeHeart] C:\PROGRA~1\DOESUP~1\setup bike.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: Resume Windows Update Installation.lnk = C:\WINNT\Windows Update Setup Files\ie6setup.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Programmer\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Hurtig søgning.lnk = C:\Programmer\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office-start.lnk = C:\Programmer\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\Programmer\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Programmer\FlashGet\jc_link.htm
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CCS\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CS1\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CS2\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk

Hent og kør CWSHredder herfra: http://www.arlet.dk/special.htm
genstart og ny hijackthis log, for der er mere snavs

jeg gætter på det er dem med prosearching der skal væk, ikke?

først den cwshredder og ny log.

Derefter står resten af snavset, samt den værktøjslinje for tur

cwshredder sagde altså der ikke var noget....

men her er loggenLogfile of HijackThis v1.97.7
Scan saved at 21:50:04, on 15-04-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\trcboot.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
C:\Programmer\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\drivers\ldlcserv.exe
C:\Programmer\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\pctspk.exe
C:\Programmer\Softex\Winroute\winroute.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\Programmer\Fælles filer\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
C:\Programmer\Logitech\ImageStudio\LogiTray.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\WINNT\MS\SMS\CLICOMP\SWDist32\bin\smsmon32.exe
C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
C:\WINNT\dl.exe
C:\WINNT\dlm.exe
C:\PROGRA~1\DOESUP~1\setup bike.exe
C:\WINNT\system32\internat.exe
C:\Programmer\Fælles filer\Nokia\Services\ServiceLayer.exe
C:\Programmer\Microsoft Office\Office\OSA.EXE
C:\Programmer\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programmer\SysAI\SysAI.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\FlashGet\flashget.exe
C:\Downloads\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://prosearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://prosearching.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://prosearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://prosearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://prosearching.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://prosearching.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
N3 - Netscape 7: user_pref("browser.startup.homepage", "prosearching.com"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\h36i7kvw.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgrammer%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\h36i7kvw.slt\prefs.js)
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\SysAI\AproposPlugin.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {81A541C9-C17F-4A79-9F36-DA21683226C2} - C:\PROGRA~1\SOFTWA~1\BYTE JUMP.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: window else - {B8C8EA37-DFFD-2052-F1BE-CDB182844CF9} - C:\PROGRA~1\SOFTWA~1\BYTE JUMP.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [winroute] C:\Programmer\Softex\Winroute\winroute.exe
O4 - HKLM\..\Run: [SMS Application Launcher] C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
O4 - HKLM\..\Run: [CreateCD50] "C:\Programmer\Fælles filer\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] C:\Programmer\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [Dial32] C:\WINNT\dl.exe
O4 - HKLM\..\Run: [Dial33] C:\WINNT\dlm.exe
O4 - HKLM\..\Run: [CakeHeart] C:\PROGRA~1\DOESUP~1\setup bike.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: Resume Windows Update Installation.lnk = C:\WINNT\Windows Update Setup Files\ie6setup.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Programmer\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Hurtig søgning.lnk = C:\Programmer\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office-start.lnk = C:\Programmer\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\Programmer\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Programmer\FlashGet\jc_link.htm
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CCS\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CS1\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CS2\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk

Så går jeg igang med at tjekke.

Tager en lille ½ time

ok jeg takker

Flyt først filen Hijackthis til en mappe oprettet kun til den.

Du skal nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://prosearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://prosearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://prosearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://prosearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://prosearching.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://prosearching.com/searchbar.html

O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Programmer\SysAI\AproposPlugin.dll
O2 - BHO: (no name) - {81A541C9-C17F-4A79-9F36-DA21683226C2} - C:\PROGRA~1\SOFTWA~1\BYTE JUMP.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll

O3 - Toolbar: window else - {B8C8EA37-DFFD-2052-F1BE-CDB182844CF9} - C:\PROGRA~1\SOFTWA~1\BYTE JUMP.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Dial32] C:\WINNT\dl.exe
O4 - HKLM\..\Run: [Dial33] C:\WINNT\dlm.exe
O4 - HKLM\..\Run: [CakeHeart] C:\PROGRA~1\DOESUP~1\setup bike.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - Global Startup: Microsoft Hurtig søgning.lnk = C:\Programmer\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office-start.lnk = C:\Programmer\Microsoft Office\Office\OSA.EXE



Find og slet i fejlsikret(f8 ved opstart):


C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\WINNT\dl.exe
C:\WINNT\dlm.exe
C:\PROGRA~1\DOESUP~1\setup bike.exe



Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.

O4 - HKLM\..\Run: [Dial32] C:\WINNT\dl.exe
O4 - HKLM\..\Run: [Dial33] C:\WINNT\dlm.exe
kunne ikke finde disse to...

C:\WINNT\dl.exe
C:\WINNT\dlm.exe
disse to kunne jeg heller ikke finde

men nu genstarter jeg og sender en log asap

HER ER DEN. DEN IRRITERENDE BJÆLKE ER I HVERT FALD VÆK. DET ER DE MEST VELFORTJENTE POINT, JEG HAR GIVET UD. TAK FOR DET

Logfile of HijackThis v1.97.7
Scan saved at 22:42:46, on 15-04-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\trcboot.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
C:\Programmer\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\drivers\ldlcserv.exe
C:\Programmer\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\pctspk.exe
C:\Programmer\Softex\Winroute\winroute.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\Programmer\Fælles filer\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
C:\Programmer\Logitech\ImageStudio\LogiTray.exe
C:\WINNT\MS\SMS\CLICOMP\SWDist32\bin\smsmon32.exe
C:\Programmer\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
C:\WINNT\system32\internat.exe
C:\Programmer\Fælles filer\Nokia\Services\ServiceLayer.exe
C:\Programmer\Yahoo!\Messenger\ymsgr_tray.exe
C:\Programmer\FlashGet\flashget.exe
C:\Downloads\software\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
N3 - Netscape 7: user_pref("browser.startup.homepage", "prosearching.com"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\h36i7kvw.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgrammer%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\h36i7kvw.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [winroute] C:\Programmer\Softex\Winroute\winroute.exe
O4 - HKLM\..\Run: [SMS Application Launcher] C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
O4 - HKLM\..\Run: [CreateCD50] "C:\Programmer\Fælles filer\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programmer\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programmer\Fælles filer\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programmer\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programmer\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Programmer\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programmer\Fælles filer\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [CakeHeart] C:\PROGRA~1\DOESUP~1\setup bike.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: Resume Windows Update Installation.lnk = C:\WINNT\Windows Update Setup Files\ie6setup.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Programmer\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Programmer\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Programmer\FlashGet\jc_link.htm
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CCS\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CS1\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intern.rosenholm.dk
O17 - HKLM\System\CS2\Services\Tcpip\..\{033DE1C1-039F-4738-A907-E06DAA1AA558}: Domain = rosenholm.dk

JEG KAN SE DER STADIG ER EN
O4 - HKLM\..\Run: [CakeHeart] C:\PROGRA~1\DOESUP~1\setup bike.exe
..DEN SKAL VÆK, IKKE

Jo, det skal den, og mappen C:\PROGRA~1\DOESUP~1 skal slettes.

OK TAK

Kan se at Fromsej har været længe oppe*S*

Hvis du har fået den væk.
Så er du ren

For at beskytte dig mod snavs har jeg lavet en sikkerhedspakke,
som du kan hente her : www.arlet.dk/pakke.htm

fantastisk... tak