Hej dr1 larry
Tak for det hurtige svar. Jeg er lige ved at prøve dit forslag. Har fået kørt en log fra Hijackthis (printet og derefter scannet fra en anden computer)
hi iackthi s
t-ogfi'le of rrend uicro nijackrhis v2.6.2
Scan saved at 22:2L:O2, on 1-2-08-2007
platform: windows xp spz (winnr 5.01.2600)
MSrE: rnternet explorer v6.00 sPz (6.00.2900.2L80)
Boot mode: Normal
Running processes:
c: \wrNoovs\system32\sms.s e xe
c: \wrNDowS\system32\wnil ogon. exe
c : \wrruoourrs\system32\rsvei ces . exe
c: \wrnoohrs\system32\sla ss. exe
c : \wrNDows\system32\svcho.s et xe
c : \wrnoows\system32\svchos.t e xe
c : \wrNDowS\system32\sposovl. exe
c : \programmer\edobe\acrobat 7. O\Di sti I I r\ncrotray. exe
c: \programmer\adobe\ndobeve rsion cue cS2\control panel\versioncuecs2tray. exe
c : \prog rammre\ raspe rsky t-ab\rasper sky nnti -vi rus 6 . O\avp. exe
c: \wrruoows\system32\ctfmo.n e xe
c:\proqrammer\Gooole\Gooqletoolbarttotifier\Gooqletoolbarttotifier.exe
c: \prodrammer\ldobe\ldob6v ersion cue cs2\6in\VersioncuecsZe. xe
C: \programmer\raspersky t-ab\raspersky Rnti -vi rus 6. 0\avp. exe
c: \programmer\paIl es fi I er\ui crosoft shared\vsTDEBuc\uolE,tX. E
c:\proOrammer\edobe\ndobvee rsion cue cs2\data\database\bin\mysqld-nt.exe
c : \wr ruoovtts\syste3m2\ svchost . exe
c: \wrNDolils\expolr e r. exe
c : \programmer\tnternet expl orer\lexPLoRE. ExE
c : \programmer\rrend tqi cro\ni jackrhi s\xi jackrhi s. exe
n0 HKcu\software\lttci rosoft\rnternet explo rer\t,tain , start page =
http : / /vwtwg. oogle .dk/
n0
'-
irkcu\s6ftfrare\t',tci rosoft\rnternet exp'lorer\tool bar, L'inksrold erName=
Hyperl i nks
n3 uRLSearchHookY: ahoo! rool bar {EF99BD32-cl-FB-L1-D2-892F-0090271D4F88}
c: \programmer\Yaho!o \C ompanoi n\rnstal I s\cpn\yt. d] I
02 eHo: vahoo! roolbar nelper {02478D38-C3F9-4EFB-985L-7695ECA05670}
c: \programmer\Yaho!o \c ompanoi n\rnstal I s\cpn\yt. d] 1
02 sHo: adobe pDF Reader r-in k He]per t06849E9p-c8oZ-4D5B9-8 7D-78487D68E0g3]
c: \programmer\ndobg\ecrobat 7. 0\ecti vex\ncrotEHe] pe r. d1 1
02 eHo: Goog'le too] bar ue1 pe r {AA58ED58-0Loo-4d91--8333-cFL0577473F7I
c : \p rog rammre\ googl e\googl etool bar 1..d l I
oZ BHo: adobe PDF conversion roolbar uelper
{ee7co045- E86L-484f-I 273 -0445E E16191-0} c : \p rogr ammre\ adobe\ac robat
7.O\Acrobat\acrorEFavcil e nt. dl l
02 BHo: Google toolbar Notifier BHo {ar69oe43-7D58-4638-e6pa-ce66B5AD205o}
c : \prog rammre\ coog'l e\coog1e tool bar ttoti fi e r\2 . 0 . 301.7 164\swg. d1'l
03 roolbar: adobe pDF : {47833539-D0c5-4L25-9FA8-08L9E2EAAc93}
c : \ pr og rammre\ ldobe\ac robat 7 . 0\ec robat\ec ror EF avc] i ent . dl I
03 roolbar: Ercoogle t23L8c281-4965-L1-d4-9Bl-8-009027A5CD4F]
c: \oroqrammer\ qooql e\qooqle too'lbarL.d ] I
03'- r5o]bar:'Vah6ot
-iooTbar
{Ep99eo32-cl-pe-LLD2-892F-009027LD4F88}
c: \programmer\ vahoo ! \Companoi n\tnstal I s\cpn\yt. dl I
04 nruu\. . \nun: [ncrobat assi stant 7 .0] "c:
\Programmer\ndobe\acrobat
7.0\Di sti I I r\acrotray. exe"
04 Hrlu\..\nun: [edobe version cue csz] "c:\programmer\ldobe\edobev ersion cue
Cs2\control panel\ ve rsi oncuecs2r.raye. xe"
04 HKLM.\ . \Run: [nvp]
"c : \prog rhmmre\ raspe rsky t-ab\rasper sky Anti -vi rus
0 . O\avp . exe "
04 HKcu\. . \nun : [crruoru. exe] c: \wrxocrws\system32\ctfmo.n e xe
04 urcu\. . \nun: [swg]
c: \proorammer\ cooql e\Gooqle tool barttoti fi er\cooql etool barttoti fi er. exe
0' L4o -K AnLkt ul se\ns-eLs-t5e-' )19\..'\nut: [crpuor,r.Exec] :\wrru5oh/s\system32\crFMoN.E(uXsEe r
04 HKUS\S-L-5-20\..\nun: [CrruON.EXEC] :\wrruOOh/S\system32\CTFMO(NU.sEeXrE
'
NEWARKSTJ ENESTE' )
0' S4 YSTHEKMU)'S \S-I-5-18\. . \Run:
0' o4e f aHu lKt Uus\s.De Er 'F) AULT\.. \ nun:
[crpuon. exe] c: \wrnoows\system32\crFM. EoXNE ( user
[crpuor.l EXE]c : \wrruoohrs\system32\crF.M EXoNE( user
hi iackthi s
04 - G'ol bal startup: AdobeA crobat spEedt -auncher.lnk= ?
04 - Global Startup: Adobe camna toader.lnk = ?
04 - Global startuf: AdobeR eaders peed Launch.lnk= c: \Programnre\ ldobe\acrobat
7.o\neader\ reader -sl . exe
08 - Extra context menu iten: convert link target to Adobe PDF -
res: //c: \Programnreu dobe\lc robat
7. o\Acrobat\AcrorEFavciel nt. dl'l /AcrorEcaptureh. tml
08 - Extra context menu iten: convert link target to existing PDF -
res: //c: \programmreM dobe\lc robat
7 , o\Acr obat\Ac ror EFavcIi ent. dl l /AcrorE'"Appen. hdt ml
08 - Extra context menu item: convert selected links to Adobe PDF -
res : //c: \proqrammer\ldobe\Acrobat
7.o\Acr obat\Acr or EFavcil ent. dl I /Acr orEcaptur ese'tl -in ks.h tm'l
08 - Extra context rnenuit em: convert selected ]inks to existing PDFres
: //c : \progranmer \adobe\lcrobat
7. o\Acr obat\Acr or EF avc]i ent. d'lI /Acr orEAppendsLeil nks.h tml
08 - Extra context menu item: convert sC]ection to Adobe PoF -
res: //c: \prog rammre\a dobe\ncrobat
7.o\Acr obat\AcrorEFavcil e nt. d'lI /AcrorEcapture.h tml
08 - Extra context menu item: convert selection to existing PDF -
res : //c: \proq rammre\l dobeMc robat
7.o\Acr obat\AcrorEFavcil e nt. d'11/Arco rEAppendh.t m'l
trogr ammre\ ndobe\Rcr obat
rt\Ac rorEFavcl i ent . dl I / acrotEcaptu re . html
I context menu item: convert to existing PDF
trogr ammre\ ndobe\ac robat
rt\AcrorEFavcl i ent. dl 1 /lcroreappend . html
I context menu item: e&ksporter til uicrosoft excel
'ROGR/qryl\CMR rO S-2\O r rrc E1 1\ EXCEL . EXEI3 0 00
\Common\ynis thel per. dl l
LM service adobe systems c:\programmer\ralles
;ha red\se rvi ce\ndobel msvc . exe
version cue csz edobe systems Incorporated
rdobe version cue Csz\bin\versionCuecs2.exe
rsky lnti -vi rus 6. 0 (evp) Kaspers ky lab
;ky uab\raspersky enti-vi rus 6.O\avp.exe
r uodater Service (qusvc) Gooqle
rcoinmon\coogel upddier \c6ogl euptlater se rvi ce . exe
/tes
res: / / c : \ t
7 . O\Ac robe
08 Extr€
res: / / c : \ t
7 . 0\Ac robe
oB Extr€
res: / / c : \ t
I button: webA nti-virus - {1F460357-8A94-4D71-9CA3-AA4EADCSFE3}-2 09 - Extrz
mer\Kaspersky t-ab\raspersky rnti-virus 6.O\sci ep'l ugi n. dl
'l
c:\progran
r button: opslag - {9278082-51 Ecc-41c8-B9B3Ec-9 c571A8263-} 09 - Extr.
,1\MICRoS-2\OFFiCE11\REFIDEBLLA R. C:\ PROGM^
I button: Messenge-r { FB5F 1910F- 110-11d2-BB9E-00C04F795-6 83} 09 - Extr:
mer \t,tessengre\m smsg.s e xe c: \Progran
:nulten: wln dohrMs essenqe-r 09 - Extra 'Tools' ml
tBgE-00c04F7956!3- ] c: \prog rammre\M essengre\m smsgse.x e { FB5F 1910-F110-11-dl2
wnrv.porta'lbank.dk o15 - Trusted zone: r
nrw.sparhin.dk o15 - Trusted zone: r
rttp://ururw.sparhim.dk o15 - Trusted zone: I
-c667-45DD-8035-217Bc2A6IA(r3ceti]v ex si kker hedssoftware 016 - DpF: {07D09E9E.
cont ro'l ) -
rk. dklpackage/sdclextern al /acti vexlacti vexsik ker hedssoftware https : //wnl. portal bar
-orod-1.10.c ab
-99f7-4bb4-88d8-fa1d4f56a2ab(y] rnststarter c'lass) - 016 - opr: {30528230.
c : \prog rammre\v ahoo !'
o23 se rvi ce : edobe
filer\ndobe Systems :
o23 Service: ldobe
c : \ progr ammre\ adobe\r
o23 Ser vi ce: KaspeI
c : \prog rammre\ raspe r:
o23 service: Gooqlr
c : \prog rammre\ coogTe'
t"A of file 6340 [r
Måske kan det være en ekstra hjælp?
Jeg tænkte også først at det måtte være en tast, der sad fast, men det ser det ikke ud til at være. Nu lader jeg den stå og tygge lidt på XP og går til ro. Jeg arbejder videre på den igen imorgen sidst på dagen. Indtil videre mange tak for hjælpen.
Annitta
