Hvem kan hjælpe mig af med tool bars og pop ups?

Kigger på den.

har ikke så meget forstand på det der hijack, men da jeg havde toolbars osv, brugte jeg microsofts antispyware beta. Hvilket i øvrigt er et vildt godt program.
Ved ikke lige om det løser dit problem, men du kan da prøve ;D
http://www.microsoft.com/athome/security/spyware/software/default.mspx

http://www.microsoft.com/athome/security/spyware/software/requirements.mspx =>
"Microsoft Windows 2000, Windows XP, or Windows Server™ 2003"

Brugeren her: "Platform: Windows ME (Win9x 4.90.3000)"

Sååå - den går ikke her...

fix med hijackthis:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dbthbdtbfxcqth.com/OTYab/fpChOgNkYpwPVvRt67IV0juQaZHUzwpqHZyH3tsTneAHkK7LoxwWKwXpqq.htm

Den anden toolbar skulle vel ikke være den fra Yahoo?
Hvis ja, fjern den via tilføj/fjern programmer.

Genstart pc og smid en ny log herind.

O4 - HKCU\..\Run: [File Vga] C:\WINDOWS\APPLIC~1\4LIES\Mode Axis.exe
Skal også fixes, og mappen C:\WINDOWS\APPLIC~1\4LIES\ skal slettes.

Lop, som der er tale om her, har en forbandet uvane med at lægge sig i Application Data, i nogle undermapper med mærkelige navne.

Tak.. jeg gjorde som i sagde, men search now! og en Iexplore toolbar er her stadig.

Her er den nye log:

Logfile of HijackThis v1.99.1
Scan saved at 10:28:44, on 30-07-2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\AHEAD\INCD\INCD.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\PROGRAMMER\ULEAD SYSTEMS\ULEAD PHOTO EXPLORER 8.0\MONITOR.EXE
C:\WINDOWS\SYSTEM\HPZTSB01.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMER\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAMMER\ICQLITE\ICQLITE.EXE
C:\PROGRAMMER\HARDWARE\KEYBOARD\IKEYMAIN.EXE
C:\PROGRAMMER\HARDWARE\MOUSE\AMOUMAIN.EXE
C:\PROGRAMMER\FæLLES FILER\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAMMER\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAMMER\AIM95\AIM.EXE
C:\PROGRAMMER\YAHOO!\MESSENGER\YPAGER.EXE
C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAMMER\NORTON ANTIVIRUS\NSCHED32.EXE
C:\PROGRAMMER\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAMMER\COREL\WORDPERFECT OFFICE 2000\PROGRAMS\ALARM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMER\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAMMER\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SKRIVEBORD\DOWNLOADEDE\HIJACKTHIS\2005\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jordanknight.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAMMER\SPYWAREGUARD\DLPROTECT.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [InCD] C:\Programmer\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmer\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [Stone's TimeTool] C:\PROGRAMMER\TIMETOOL\TIMETOOL.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Programmer\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programmer\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\HARDWARE\KEYBOARD\IKEYMAIN.EXE
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\HARDWARE\MOUSE\AMOUMAIN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Programmer\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PeakRoadModeSpam] C:\WINDOWS\All Users\Application Data\Skip Aim Peak Road\coalbows.exe
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAMMER\FæLLES FILER\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRAMMER\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAMMER\YAHOO!\MESSENGER\ypager.exe -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Norton Program Scheduler.lnk = C:\Programmer\Norton AntiVirus\NSCHED32.EXE
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Programmer\Corel\WordPerfect Office 2000\programs\alarm.exe
O8 - Extra context menu item: Yahoo! Search - file:///C:\Programmer\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Programmer\Yahoo!\Common/ycdict.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAMMER\AIM95\AIM.EXE
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMER\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMER\YAHOO!\MESSENGER\YPAGER.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {01020304-0506-0708-090A-0B0C0D0E0F08} - http://messenger.yahoo.com/maintenance/patch.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab

Kopier det mellem de stiplede linier ind i et notesblokdokument, vælg gem som, gem det som dølop.bat, for at kunne gemme som batfil, skal du klikke på Filtyper og vælge Alle filer.
---------------------------------
CD\
CD windows\application data
DIR >C:\lop.txt
CD\
CD WINDOWS\All Users\Application Data
DIR >>C:\lop.txt
CD\
notepad lop.txt
---------------------------------
Dobbeltklik på dølop.bat, der skulle gerne åbne sig et tekstdokument, kopier indholdet herind.
hvis, mod forventning, det ikke åbner, så find tekstfilen lop.txt (den ligger i C:\ )
Og kopier indholdet herind.

John>>Det der skal ledes efter kan i læse lidt om her:
http://www.eksperten.dk/spm/633478

Kør så Hijackthis igen og fix:
O4 - HKLM\..\Run: [PeakRoadModeSpam] C:\WINDOWS\All Users\Application Data\Skip Aim Peak Road\coalbows.exe

Slet mappen \Skip Aim Peak Road\, genstart, kom med en frisk Hijackthislog og teksten fra lop.txt.

Enheden i drev C er LOKAL DISK
Enhedens serienummer er 3C5F-12F0
Indhold af C:\

MSDOS    SYS        1.647  20-04-02  17.17 MSDOS.SYS
COMMAND  DOS        93.920  08-06-00  17.00 COMMAND.DOS
MSDOS    DOS        1.660  20-04-01  11.56 MSDOS.DOS
MSDOS    ---            22  20-04-01  11.35 MSDOS.---
SETUPLOG TXT      265.411  03-06-05  18.11 SETUPLOG.TXT
WINDOWS        <DIR>        20-04-01  11.37 WINDOWS
DEBUG    TXT        4.997  26-07-05  12.30 debug.txt
BJCPRI~1      <DIR>        20-04-02  16.16 BJC Printer
ACROREAD      <DIR>        20-04-02  16.16 Acroread
ASPI    LOG      685.664  20-05-03  12.42 ASPI.LOG
SETUPXLG TXT        3.595  02-09-02  18.20 SETUPXLG.TXT
DEFAULT  SET          279  17-01-03  19.57 default.set
INSTALL  LOG        2.823  29-11-03  11.36 INSTALL.LOG
QFX            <DIR>        26-06-02  14.56 qfx
DBASIC  LOG          332  16-07-02  19.52 dbasic.log
UNZIPPED      <DIR>        04-11-02  23.17 unzipped
VERSION        <DIR>        02-12-02  13.06 version
NOVERS~1      <DIR>        02-12-02  13.06 noversion
_NIM4711 TMP 1.166.175.696  28-01-03  12.54 _NIM4711.TMP
COMPATID TXT          534  03-06-05  18.11 COMPATID.TXT
SCANDISK LOG          708  30-07-05  10.03 SCANDISK.LOG
CLASSES  1ST    4.857.888  20-04-02  17.11 CLASSES.1ST
COMMAND  COM        93.920  08-06-00  17.00 COMMAND.COM
DOKUME~1      <DIR>        20-04-02  17.18 Dokumenter
MSDOS    BAK            22  20-04-02  16.54 MSDOS.BAK
IO      SYS      110.592  08-06-00  17.00 IO.SYS
SETUPLOG OLD        1.298  20-04-02  16.33 SETUPLOG.OLD
SUHDLOG  DAT        5.166  20-04-02  17.11 SUHDLOG.DAT
CONFIG  SYS            0  04-05-05  15.56 CONFIG.SYS
NETLOG  TXT        16.866  20-04-02  17.19 NETLOG.TXT
AUTOEXEC BAT          301  04-05-05  15.56 AUTOEXEC.BAT
CONFIG  BAK            0  04-05-05  15.56 CONFIG.BAK
AUTOEXEC BAK          321  04-05-05  15.56 AUTOEXEC.BAK
SYSTEM  1ST    2.113.568  20-04-02  17.11 SYSTEM.1ST
PROGRA~1      <DIR>        20-04-02  16.56 Programmer
MYMUSI~1      <DIR>        21-04-02  1.01 My Music
UNWISE  EXE      162.304  24-05-01  12.59 UNWISE.EXE
MSCAN          <DIR>        27-12-02  12.09 MSCAN
SIERRA        <DIR>        20-04-02  21.04 SIERRA
C-MEDIA        <DIR>        20-04-02  21.17 C-Media
AUTOEXEC NAV          212  20-04-02  21.38 autoexec.nav
PROGRA~2      <DIR>        21-04-02  12.17 Program Files
DIVERS~1      <DIR>        20-04-02  16.16 diverse programmer
TEXTBR~1      <DIR>        20-04-02  16.16 TextBridgeClassic
TEMP          <DIR>        28-05-02  18.08 TEMP
DANSKE~1      <DIR>        30-05-02  14.05 DanskeBank
EPUSBDRV      <DIR>        31-05-02  14.56 EPUSBDRV
TEMPINST      <DIR>        05-01-03  12.10 tempinst
~MSSETUP T    <DIR>        05-01-03  12.12 ~MSSETUP.T
MYPICT~1      <DIR>        05-01-03  12.16 My Pictures
MYPHOTO        <DIR>        01-03-05  18.31 MyPhoto
LOG      TXT            82  12-06-04  22.56 log.txt
WINDOW~1 BMK            63  07-08-04  23.05 WINDOWSWinHlp32.BMK
IMAGINFO PE4          327  07-08-04  23.24 imaginfo.pe4
AUTOEXEC 001          281  08-10-04  22.24 AUTOEXEC.001
IMAGEIIO PE4        2.222  07-08-04  23.24 imageiio.pe4
DLLCOM~1      <DIR>        17-03-05  22.48 DLLCompare
KASPER~1      <DIR>        17-03-05  23.15 Kaspersky
VLIST    LOG          320  17-03-05  23.20 vlist.log
AUTOEXEC 002          301  17-03-05  21.28 AUTOEXEC.002
DEVICE~1 LOG        2.688  09-04-05  23.04 devicetable.log
LOP      TXT            0  30-07-05  18.57 lop.txt
        37 fil(er)  1.174.606.030 byte
        25 mappe(r)      10.213,66 MB ledig

Enheden i drev C er LOKAL DISK
Enhedens serienummer er 3C5F-12F0
Indhold af C:\

MSDOS    SYS        1.647  20-04-02  17.17 MSDOS.SYS
COMMAND  DOS        93.920  08-06-00  17.00 COMMAND.DOS
MSDOS    DOS        1.660  20-04-01  11.56 MSDOS.DOS
MSDOS    ---            22  20-04-01  11.35 MSDOS.---
SETUPLOG TXT      265.411  03-06-05  18.11 SETUPLOG.TXT
WINDOWS        <DIR>        20-04-01  11.37 WINDOWS
DEBUG    TXT        4.997  26-07-05  12.30 debug.txt
BJCPRI~1      <DIR>        20-04-02  16.16 BJC Printer
ACROREAD      <DIR>        20-04-02  16.16 Acroread
ASPI    LOG      685.664  20-05-03  12.42 ASPI.LOG
SETUPXLG TXT        3.595  02-09-02  18.20 SETUPXLG.TXT
DEFAULT  SET          279  17-01-03  19.57 default.set
INSTALL  LOG        2.823  29-11-03  11.36 INSTALL.LOG
QFX            <DIR>        26-06-02  14.56 qfx
DBASIC  LOG          332  16-07-02  19.52 dbasic.log
UNZIPPED      <DIR>        04-11-02  23.17 unzipped
VERSION        <DIR>        02-12-02  13.06 version
NOVERS~1      <DIR>        02-12-02  13.06 noversion
_NIM4711 TMP 1.166.175.696  28-01-03  12.54 _NIM4711.TMP
COMPATID TXT          534  03-06-05  18.11 COMPATID.TXT
SCANDISK LOG          708  30-07-05  10.03 SCANDISK.LOG
CLASSES  1ST    4.857.888  20-04-02  17.11 CLASSES.1ST
COMMAND  COM        93.920  08-06-00  17.00 COMMAND.COM
DOKUME~1      <DIR>        20-04-02  17.18 Dokumenter
MSDOS    BAK            22  20-04-02  16.54 MSDOS.BAK
IO      SYS      110.592  08-06-00  17.00 IO.SYS
SETUPLOG OLD        1.298  20-04-02  16.33 SETUPLOG.OLD
SUHDLOG  DAT        5.166  20-04-02  17.11 SUHDLOG.DAT
CONFIG  SYS            0  04-05-05  15.56 CONFIG.SYS
NETLOG  TXT        16.866  20-04-02  17.19 NETLOG.TXT
AUTOEXEC BAT          301  04-05-05  15.56 AUTOEXEC.BAT
CONFIG  BAK            0  04-05-05  15.56 CONFIG.BAK
AUTOEXEC BAK          321  04-05-05  15.56 AUTOEXEC.BAK
SYSTEM  1ST    2.113.568  20-04-02  17.11 SYSTEM.1ST
PROGRA~1      <DIR>        20-04-02  16.56 Programmer
MYMUSI~1      <DIR>        21-04-02  1.01 My Music
UNWISE  EXE      162.304  24-05-01  12.59 UNWISE.EXE
MSCAN          <DIR>        27-12-02  12.09 MSCAN
SIERRA        <DIR>        20-04-02  21.04 SIERRA
C-MEDIA        <DIR>        20-04-02  21.17 C-Media
AUTOEXEC NAV          212  20-04-02  21.38 autoexec.nav
PROGRA~2      <DIR>        21-04-02  12.17 Program Files
DIVERS~1      <DIR>        20-04-02  16.16 diverse programmer
TEXTBR~1      <DIR>        20-04-02  16.16 TextBridgeClassic
TEMP          <DIR>        28-05-02  18.08 TEMP
DANSKE~1      <DIR>        30-05-02  14.05 DanskeBank
EPUSBDRV      <DIR>        31-05-02  14.56 EPUSBDRV
TEMPINST      <DIR>        05-01-03  12.10 tempinst
~MSSETUP T    <DIR>        05-01-03  12.12 ~MSSETUP.T
MYPICT~1      <DIR>        05-01-03  12.16 My Pictures
MYPHOTO        <DIR>        01-03-05  18.31 MyPhoto
LOG      TXT            82  12-06-04  22.56 log.txt
WINDOW~1 BMK            63  07-08-04  23.05 WINDOWSWinHlp32.BMK
IMAGINFO PE4          327  07-08-04  23.24 imaginfo.pe4
AUTOEXEC 001          281  08-10-04  22.24 AUTOEXEC.001
IMAGEIIO PE4        2.222  07-08-04  23.24 imageiio.pe4
DLLCOM~1      <DIR>        17-03-05  22.48 DLLCompare
KASPER~1      <DIR>        17-03-05  23.15 Kaspersky
VLIST    LOG          320  17-03-05  23.20 vlist.log
AUTOEXEC 002          301  17-03-05  21.28 AUTOEXEC.002
DEVICE~1 LOG        2.688  09-04-05  23.04 devicetable.log
LOP      TXT        3.651  30-07-05  18.57 lop.txt
        37 fil(er)  1.174.609.681 byte
        25 mappe(r)      10.213,66 MB ledig

fromsej> takker - var ved at gå til, da jeg ikke kunne se snavset :)
Du tager den bare herfra :)

det begynder at se lovende ud..

Ny Hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 20:06:03, on 30-07-2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMER\AHEAD\INCD\INCD.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\PROGRAMMER\ULEAD SYSTEMS\ULEAD PHOTO EXPLORER 8.0\MONITOR.EXE
C:\WINDOWS\SYSTEM\HPZTSB01.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAMMER\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAMMER\ICQLITE\ICQLITE.EXE
C:\PROGRAMMER\HARDWARE\KEYBOARD\IKEYMAIN.EXE
C:\PROGRAMMER\HARDWARE\MOUSE\AMOUMAIN.EXE
C:\PROGRAMMER\FæLLES FILER\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAMMER\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAMMER\AIM95\AIM.EXE
C:\PROGRAMMER\YAHOO!\MESSENGER\YPAGER.EXE
C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAMMER\NORTON ANTIVIRUS\NSCHED32.EXE
C:\PROGRAMMER\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAMMER\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\PROGRAMMER\COREL\WORDPERFECT OFFICE 2000\PROGRAMS\ALARM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMMER\SPYWAREGUARD\SGBHP.EXE
C:\WINDOWS\SKRIVEBORD\DOWNLOADEDE\HIJACKTHIS\2005\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jordanknight.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAMMER\SPYWAREGUARD\DLPROTECT.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [InCD] C:\Programmer\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [Ulead Memory Card Detector] C:\Programmer\Ulead Systems\Ulead Photo Explorer 8.0\Monitor.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Programmer\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [Stone's TimeTool] C:\PROGRAMMER\TIMETOOL\TIMETOOL.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Programmer\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programmer\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\HARDWARE\KEYBOARD\IKEYMAIN.EXE
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\HARDWARE\MOUSE\AMOUMAIN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Programmer\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAMMER\FæLLES FILER\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRAMMER\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAMMER\YAHOO!\MESSENGER\ypager.exe -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAMMER\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Norton Program Scheduler.lnk = C:\Programmer\Norton AntiVirus\NSCHED32.EXE
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Programmer\Corel\WordPerfect Office 2000\programs\alarm.exe
O8 - Extra context menu item: Yahoo! Search - file:///C:\Programmer\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Programmer\Yahoo!\Common/ycdict.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAMMER\AIM95\AIM.EXE
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMER\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMMER\YAHOO!\MESSENGER\YPAGER.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O16 - DPF: {01020304-0506-0708-090A-0B0C0D0E0F08} - http://messenger.yahoo.com/maintenance/patch.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab

Ny Lop.txt:


Enheden i drev C er LOKAL DISK
Enhedens serienummer er 3C5F-12F0
Indhold af C:\

MSDOS    SYS        1.647  20-04-02  17.17 MSDOS.SYS
COMMAND  DOS        93.920  08-06-00  17.00 COMMAND.DOS
MSDOS    DOS        1.660  20-04-01  11.56 MSDOS.DOS
MSDOS    ---            22  20-04-01  11.35 MSDOS.---
SETUPLOG TXT      265.411  03-06-05  18.11 SETUPLOG.TXT
WINDOWS        <DIR>        20-04-01  11.37 WINDOWS
DEBUG    TXT        4.997  26-07-05  12.30 debug.txt
BJCPRI~1      <DIR>        20-04-02  16.16 BJC Printer
ACROREAD      <DIR>        20-04-02  16.16 Acroread
ASPI    LOG      685.664  20-05-03  12.42 ASPI.LOG
SETUPXLG TXT        3.595  02-09-02  18.20 SETUPXLG.TXT
DEFAULT  SET          279  17-01-03  19.57 default.set
INSTALL  LOG        2.823  29-11-03  11.36 INSTALL.LOG
QFX            <DIR>        26-06-02  14.56 qfx
DBASIC  LOG          332  16-07-02  19.52 dbasic.log
UNZIPPED      <DIR>        04-11-02  23.17 unzipped
VERSION        <DIR>        02-12-02  13.06 version
NOVERS~1      <DIR>        02-12-02  13.06 noversion
_NIM4711 TMP 1.166.175.696  28-01-03  12.54 _NIM4711.TMP
COMPATID TXT          534  03-06-05  18.11 COMPATID.TXT
SCANDISK LOG          975  30-07-05  20.02 SCANDISK.LOG
CLASSES  1ST    4.857.888  20-04-02  17.11 CLASSES.1ST
COMMAND  COM        93.920  08-06-00  17.00 COMMAND.COM
DOKUME~1      <DIR>        20-04-02  17.18 Dokumenter
MSDOS    BAK            22  20-04-02  16.54 MSDOS.BAK
IO      SYS      110.592  08-06-00  17.00 IO.SYS
SETUPLOG OLD        1.298  20-04-02  16.33 SETUPLOG.OLD
SUHDLOG  DAT        5.166  20-04-02  17.11 SUHDLOG.DAT
CONFIG  SYS            0  04-05-05  15.56 CONFIG.SYS
NETLOG  TXT        16.866  20-04-02  17.19 NETLOG.TXT
AUTOEXEC BAT          301  04-05-05  15.56 AUTOEXEC.BAT
CONFIG  BAK            0  04-05-05  15.56 CONFIG.BAK
AUTOEXEC BAK          321  04-05-05  15.56 AUTOEXEC.BAK
SYSTEM  1ST    2.113.568  20-04-02  17.11 SYSTEM.1ST
PROGRA~1      <DIR>        20-04-02  16.56 Programmer
MYMUSI~1      <DIR>        21-04-02  1.01 My Music
UNWISE  EXE      162.304  24-05-01  12.59 UNWISE.EXE
MSCAN          <DIR>        27-12-02  12.09 MSCAN
SIERRA        <DIR>        20-04-02  21.04 SIERRA
C-MEDIA        <DIR>        20-04-02  21.17 C-Media
AUTOEXEC NAV          212  20-04-02  21.38 autoexec.nav
PROGRA~2      <DIR>        21-04-02  12.17 Program Files
DIVERS~1      <DIR>        20-04-02  16.16 diverse programmer
TEXTBR~1      <DIR>        20-04-02  16.16 TextBridgeClassic
TEMP          <DIR>        28-05-02  18.08 TEMP
DANSKE~1      <DIR>        30-05-02  14.05 DanskeBank
EPUSBDRV      <DIR>        31-05-02  14.56 EPUSBDRV
TEMPINST      <DIR>        05-01-03  12.10 tempinst
~MSSETUP T    <DIR>        05-01-03  12.12 ~MSSETUP.T
MYPICT~1      <DIR>        05-01-03  12.16 My Pictures
MYPHOTO        <DIR>        01-03-05  18.31 MyPhoto
LOG      TXT            82  12-06-04  22.56 log.txt
WINDOW~1 BMK            63  07-08-04  23.05 WINDOWSWinHlp32.BMK
IMAGINFO PE4          327  07-08-04  23.24 imaginfo.pe4
AUTOEXEC 001          281  08-10-04  22.24 AUTOEXEC.001
IMAGEIIO PE4        2.222  07-08-04  23.24 imageiio.pe4
DLLCOM~1      <DIR>        17-03-05  22.48 DLLCompare
KASPER~1      <DIR>        17-03-05  23.15 Kaspersky
VLIST    LOG          320  17-03-05  23.20 vlist.log
AUTOEXEC 002          301  17-03-05  21.28 AUTOEXEC.002
DEVICE~1 LOG        2.688  09-04-05  23.04 devicetable.log
LOP      TXT            0  30-07-05  20.07 lop.txt
        37 fil(er)  1.174.606.297 byte
        25 mappe(r)      10.224,84 MB ledig

Enheden i drev C er LOKAL DISK
Enhedens serienummer er 3C5F-12F0
Indhold af C:\

MSDOS    SYS        1.647  20-04-02  17.17 MSDOS.SYS
COMMAND  DOS        93.920  08-06-00  17.00 COMMAND.DOS
MSDOS    DOS        1.660  20-04-01  11.56 MSDOS.DOS
MSDOS    ---            22  20-04-01  11.35 MSDOS.---
SETUPLOG TXT      265.411  03-06-05  18.11 SETUPLOG.TXT
WINDOWS        <DIR>        20-04-01  11.37 WINDOWS
DEBUG    TXT        4.997  26-07-05  12.30 debug.txt
BJCPRI~1      <DIR>        20-04-02  16.16 BJC Printer
ACROREAD      <DIR>        20-04-02  16.16 Acroread
ASPI    LOG      685.664  20-05-03  12.42 ASPI.LOG
SETUPXLG TXT        3.595  02-09-02  18.20 SETUPXLG.TXT
DEFAULT  SET          279  17-01-03  19.57 default.set
INSTALL  LOG        2.823  29-11-03  11.36 INSTALL.LOG
QFX            <DIR>        26-06-02  14.56 qfx
DBASIC  LOG          332  16-07-02  19.52 dbasic.log
UNZIPPED      <DIR>        04-11-02  23.17 unzipped
VERSION        <DIR>        02-12-02  13.06 version
NOVERS~1      <DIR>        02-12-02  13.06 noversion
_NIM4711 TMP 1.166.175.696  28-01-03  12.54 _NIM4711.TMP
COMPATID TXT          534  03-06-05  18.11 COMPATID.TXT
SCANDISK LOG          975  30-07-05  20.02 SCANDISK.LOG
CLASSES  1ST    4.857.888  20-04-02  17.11 CLASSES.1ST
COMMAND  COM        93.920  08-06-00  17.00 COMMAND.COM
DOKUME~1      <DIR>        20-04-02  17.18 Dokumenter
MSDOS    BAK            22  20-04-02  16.54 MSDOS.BAK
IO      SYS      110.592  08-06-00  17.00 IO.SYS
SETUPLOG OLD        1.298  20-04-02  16.33 SETUPLOG.OLD
SUHDLOG  DAT        5.166  20-04-02  17.11 SUHDLOG.DAT
CONFIG  SYS            0  04-05-05  15.56 CONFIG.SYS
NETLOG  TXT        16.866  20-04-02  17.19 NETLOG.TXT
AUTOEXEC BAT          301  04-05-05  15.56 AUTOEXEC.BAT
CONFIG  BAK            0  04-05-05  15.56 CONFIG.BAK
AUTOEXEC BAK          321  04-05-05  15.56 AUTOEXEC.BAK
SYSTEM  1ST    2.113.568  20-04-02  17.11 SYSTEM.1ST
PROGRA~1      <DIR>        20-04-02  16.56 Programmer
MYMUSI~1      <DIR>        21-04-02  1.01 My Music
UNWISE  EXE      162.304  24-05-01  12.59 UNWISE.EXE
MSCAN          <DIR>        27-12-02  12.09 MSCAN
SIERRA        <DIR>        20-04-02  21.04 SIERRA
C-MEDIA        <DIR>        20-04-02  21.17 C-Media
AUTOEXEC NAV          212  20-04-02  21.38 autoexec.nav
PROGRA~2      <DIR>        21-04-02  12.17 Program Files
DIVERS~1      <DIR>        20-04-02  16.16 diverse programmer
TEXTBR~1      <DIR>        20-04-02  16.16 TextBridgeClassic
TEMP          <DIR>        28-05-02  18.08 TEMP
DANSKE~1      <DIR>        30-05-02  14.05 DanskeBank
EPUSBDRV      <DIR>        31-05-02  14.56 EPUSBDRV
TEMPINST      <DIR>        05-01-03  12.10 tempinst
~MSSETUP T    <DIR>        05-01-03  12.12 ~MSSETUP.T
MYPICT~1      <DIR>        05-01-03  12.16 My Pictures
MYPHOTO        <DIR>        01-03-05  18.31 MyPhoto
LOG      TXT            82  12-06-04  22.56 log.txt
WINDOW~1 BMK            63  07-08-04  23.05 WINDOWSWinHlp32.BMK
IMAGINFO PE4          327  07-08-04  23.24 imaginfo.pe4
AUTOEXEC 001          281  08-10-04  22.24 AUTOEXEC.001
IMAGEIIO PE4        2.222  07-08-04  23.24 imageiio.pe4
DLLCOM~1      <DIR>        17-03-05  22.48 DLLCompare
KASPER~1      <DIR>        17-03-05  23.15 Kaspersky
VLIST    LOG          320  17-03-05  23.20 vlist.log
AUTOEXEC 002          301  17-03-05  21.28 AUTOEXEC.002
DEVICE~1 LOG        2.688  09-04-05  23.04 devicetable.log
LOP      TXT        3.651  30-07-05  20.07 lop.txt
        37 fil(er)  1.174.609.948 byte
        25 mappe(r)      10.224,84 MB ledig

- Jeg har ikke set noget til toolbarene de sidste 5 minuter.

Mange tak!

Din log er ren nu.

Du bør lige deaktivere systemgendannelse, genstarte og genaktivere den.
http://spywarefri.dk/virusscannere.htm#alle - Systemgendannelse.

For at holde den ren kan du kigge på vores pakke til formålet.
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414
http://fromsej.dk/html/avoid.html
Mvh:

Er der en der kan gennemskue fejlen i min batfil?
Vi får ikke listet C:\windows\application data, det forstår jeg ikke.

Øhh, jeg tør næsten ikke sige det, men prøv med denne sti ;)

C:\Documents and Settings\All Users\Application Data

Så den må skulle se således ud:

CD\
CD C:\Documents and Settings\All Users\Application Data
DIR >C:\lop.txt
CD %userprofile%\application data
DIR >C:\lop.txt
CD\
notepad lop.txt

Hmm.. Nu ser jeg lige at det er ME, og det ændrer jo lidt på det. Mon ikke den her kan bruges alligevel %userprofile%\application data. Eller også skal ME bruge C:\ foran stien for at virke.