Hent først den nyeste version af HJT og smid en ny log herind.

- HJT 1.99.1
http://www.softpedia.com/get/Intern......

Sorry ventetiden

Logfile of HijackThis v1.99.1
Scan saved at 00:29:42, on 26-03-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINNTSystem32smss.exe
C:WINNTsystem32winlogon.exe
C:WINNTsystem32services.exe
C:WINNTsystem32lsass.exe
C:WINNTsystem32svchost.exe
C:WINNTsystem32spoolsv.exe
C:ProgrammerNetropaMultimedia Keyboard
hksrv.exe
C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
C:WINNTsystem32CTsvcCDA.exe
C:WINNTSystem32svchost.exe
C:ProgrammerNorton AntiVirus
avapsvc.exe
C:ProgrammerNorton Personal FirewallNISUM.EXE
C:WINNTSystem32
vsvc32.exe
C:WINNTsystem32 egsvc.exe
C:WINNTsystem32MSTask.exe
C:WINNTsystem32stisvc.exe
C:ProgrammerNorton Personal FirewallSymProxySvc.exe
C:WINNTSystem32WBEMWinMgmt.exe
C:WINNTsystem32MsPMSPSv.exe
C:WINNTsystem32svchost.exe
C:WINNTSystem32svchost.exe
C:ProgrammerNorton Personal FirewallNISSERV.EXE
C:WINNTExplorer.EXE
C:PROGRA~1NORTON~1
avapw32.exe
C:ProgrammerNorton Personal FirewallIAMAPP.EXE
C:ProgrammerCreativeSBAudigy2Surround MixerCTSysVol.exe
C:ProgrammerCreativeSBAudigy2DVDAudioCTDVDDet.EXE
C:ProgrammerMicrosoft HardwareMousepoint32.exe
C:ProgrammerNetropaMultimedia KeyboardMMKeybd.exe
E:WarezAppz - cracksRefreshLock.exe
C:ProgrammerNetropaMultimedia KeyboardTrayMon.exe
C:ProgrammerNetropaOnscreen DisplayOSD.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:ProgrammerDU MeterDUMeter.exe
C:WINNTsystem32internat.exe
C:ProgrammerCreativeMediaSourceRemoteControlRcMan.exe
C:ProgrammerMSN MessengerMsnMsgr.Exe
C:ProgrammerTEXTwareHotKeyTwalink.exe
E:Privatircmirc.exe
C:ProgrammerInternet Exploreriexplore.exe
C:ProgrammerInternet ExplorerIEXPLORE.EXE
C:ProgrammerInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsAdministratorSkrivebordHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:ProgrammerNorton AntiVirusNavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammerNorton AntiVirusNavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINNTsystem32msdxm.ocx
O4 - HKLM..Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~1
avapw32.exe
O4 - HKLM..Run: [iamapp] C:ProgrammerNorton Personal FirewallIAMAPP.EXE
O4 - HKLM..Run: [CTSysVol] C:ProgrammerCreativeSBAudigy2Surround MixerCTSysVol.exe
O4 - HKLM..Run: [CTDVDDet] C:ProgrammerCreativeSBAudigy2DVDAudioCTDVDDet.EXE
O4 - HKLM..Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM..Run: [SBDrvDet] C:ProgrammerCreativeSB Drive DetSBDrvDet.exe /r
O4 - HKLM..Run: [POINTER] point32.exe
O4 - HKLM..Run: [MULTIMEDIA KEYBOARD] C:ProgrammerNetropaMultimedia KeyboardMMKeybd.exe
O4 - HKLM..Run: [RefreshLock] E:WarezAppz - cracksRefreshLock.exe
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKLM..Run: [SSC_UserPrompt] C:ProgrammerFælles filerSymantec SharedSecurity CenterUsrPrmpt.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINNTsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP
O4 - HKLM..Run: [DU Meter] C:ProgrammerDU MeterDUMeter.exe
O4 - HKCU..Run: [internat.exe] internat.exe
O4 - HKCU..Run: [RemoteCenter] C:ProgrammerCreativeMediaSourceRemoteControlRcMan.exe
O4 - HKCU..Run: [MsnMsgr] "C:ProgrammerMSN MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [Steam] C:ProgrammerSteamSteam.exe -silent
O4 - HKCU..Run: [Skype] "C:ProgrammerSkypePhoneSkype.exe" /nosplash /minimized
O4 - Global Startup: HotKey.lnk = C:ProgrammerTEXTwareHotKeyTwalink.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~3Office10EXCEL.EXE/3000
O12 - Plugin for .spop: C:ProgrammerInternet ExplorerPluginsNPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binar......
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netrad...
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com......
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/......
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar......
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/Spee...
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:WINNTsystem32CTsvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:WINNTSystem32dmadmin.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:ProgrammerNorton AntiVirus
avapsvc.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:ProgrammerNetropaMultimedia Keyboard
hksrv.exe
O23 - Service: Norton Personal Firewall Service (NISSERV) - Symantec Corporation - C:ProgrammerNorton Personal FirewallNISSERV.EXE
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - C:ProgrammerNorton Personal FirewallNISUM.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINNTSystem32
vsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:PROGRA~1FLLESF~1SYMANT~1SCRIPT~1SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:ProgrammerFælles filerSymantec SharedSNDSrvc.exe
O23 - Service: Norton Personal Firewall Proxy Service (SymProxySvc) - Symantec Corporation - C:ProgrammerNorton Personal FirewallSymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:ProgrammerFælles filerSymantec SharedSecurity CenterSymWSC.exe
O23 - Service: ZESOFT - Unknown owner - C:WINNTzeta.exe

#2
Helt ok jeg kigger på den

ent disse programmer som skal bruges i fejlsikret tilstand

- Kaspersky Scanner
http://www.spywareinfo.dk/download/...

- Ad-aware SE Personal Edition 1.05
http://www.download.com/3001-8022_4...

- Spybot - Search & Destroy 1.3
http://users.skynet.be/fa964703/spy......

Installer og opdater Ad-aware og Spybot

Genstart i fejlsikret tilstand.
(Tryk F8 gentagne gange ved opstart)

Kør så en ny scanning med HJT og sæt flueben ved disse:

O23 - Service: ZESOFT - Unknown owner - C:WINNTzeta.exe

Du kan med fordel også fixe dem her de ligger bare og sluger pc'ens kræfter og programmerne kan sagtens startes normalt.

O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [CTDVDDet] C:ProgrammerCreativeSBAudigy2DVDAudioCTDVDDet.EXE
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINNTsystem32NvCpl.dll,NvStartup
O4 - HKCU..Run: [Steam] C:ProgrammerSteamSteam.exe -silent
O4 - HKCU..Run: [Skype] "C:ProgrammerSkypePhoneSkype.exe" /nosplash /minimized

Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”.

Søg og slet nedenstående filer/mapper, hvis de stadig er der. Husk at ændre mappeindstillinger så du kan se skjulte filer samt systemfiler.
(Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".)

C:\WINNT\zeta.exe >> Slet Filen

Jeg vil bede dig kigge på nedenstående fil også.

C:\WINNT\system32\internat.exe

Hvis der er et "?" ikon ud for den skal den ikke slettes, hvis der er et "zip-fil" ikon ud for den skal den slettes.
Du må meget gerne give mig besked om hvilket ikon der var og om du slettede den.

Ændre derefter mappeindstillinger tilbage til ikke at vise skjulte filer og skjulte systemfiler.

-----------------------
Installer og scan så med Kaspersky scanneren.
Sæt flueben i følgende: Memory, Startup folders, drive, Registry, System folders og Services.
- og prik i følgende: All local drives og Scan all files. Klik på scan.

Du skal ikke klikke på Add to Startup folders, for så scannes din PC, hver gang du starter Windows op
-----------------------
Ad-aware SE
Tag en "Full System Scan" med Ad-aware og ikke "Smart System Scan" og fix alt det den finder med rød tekst
-----------------------
Spybot S&D
Der er vist bare en knap som hedder Scan og fix alt det den finder og selv sætter flueben i.
-----------------------
Kør så en diskoprydning.
(Start=> Programmer=> Tilbehør=> Systemværktøjer=> Diskoprydning. Sæt flueben ved temp-filer, temporary internet files og papirkurv).
-----------------------

Genstart i normal tilstand. Kør en ny scanning med HJT og smid loggen herind til kontrol. Læg evt. også et par ord, om du har problemer med din PC, eller om det bare var et tjek

Hey hey.. Her er den nye log

Logfile of HijackThis v1.99.1
Scan saved at 10:36:44, on 27-03-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINNTSystem32smss.exe
C:WINNTsystem32winlogon.exe
C:WINNTsystem32services.exe
C:WINNTsystem32lsass.exe
C:WINNTsystem32svchost.exe
C:WINNTsystem32spoolsv.exe
C:ProgrammerNetropaMultimedia Keyboard
hksrv.exe
C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
C:WINNTsystem32CTsvcCDA.exe
C:WINNTSystem32svchost.exe
C:ProgrammerNorton AntiVirus
avapsvc.exe
C:ProgrammerNorton Personal FirewallNISUM.EXE
C:WINNTSystem32
vsvc32.exe
C:WINNTsystem32 egsvc.exe
C:WINNTsystem32MSTask.exe
C:WINNTsystem32stisvc.exe
C:ProgrammerNorton Personal FirewallSymProxySvc.exe
C:WINNTSystem32WBEMWinMgmt.exe
C:WINNTsystem32MsPMSPSv.exe
C:WINNTsystem32svchost.exe
C:ProgrammerNorton Personal FirewallNISSERV.EXE
C:WINNTSystem32svchost.exe
C:WINNTExplorer.EXE
C:PROGRA~1NORTON~1
avapw32.exe
C:ProgrammerNorton Personal FirewallIAMAPP.EXE
C:ProgrammerCreativeSBAudigy2Surround MixerCTSysVol.exe
C:ProgrammerNetropaMultimedia KeyboardMMKeybd.exe
E:WarezAppz - cracksRefreshLock.exe
C:ProgrammerNetropaMultimedia KeyboardTrayMon.exe
C:ProgrammerNetropaOnscreen DisplayOSD.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:ProgrammerDU MeterDUMeter.exe
C:WINNTsystem32internat.exe
C:ProgrammerCreativeMediaSourceRemoteControlRcMan.exe
C:ProgrammerMSN MessengerMsnMsgr.Exe
C:ProgrammerTEXTwareHotKeyTwalink.exe
E:Privatircmirc.exe
C:ProgrammerInternet Exploreriexplore.exe
C:ProgrammerInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsAdministratorSkrivebordHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammerAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:ProgrammerSpybot - Search & DestroySDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:ProgrammerNorton AntiVirusNavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:ProgrammerNorton AntiVirusNavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINNTsystem32msdxm.ocx
O4 - HKLM..Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~1
avapw32.exe
O4 - HKLM..Run: [iamapp] C:ProgrammerNorton Personal FirewallIAMAPP.EXE
O4 - HKLM..Run: [CTSysVol] C:ProgrammerCreativeSBAudigy2Surround MixerCTSysVol.exe
O4 - HKLM..Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM..Run: [SBDrvDet] C:ProgrammerCreativeSB Drive DetSBDrvDet.exe /r
O4 - HKLM..Run: [MULTIMEDIA KEYBOARD] C:ProgrammerNetropaMultimedia KeyboardMMKeybd.exe
O4 - HKLM..Run: [RefreshLock] E:WarezAppz - cracksRefreshLock.exe
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKLM..Run: [SSC_UserPrompt] C:ProgrammerFælles filerSymantec SharedSecurity CenterUsrPrmpt.exe
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP
O4 - HKLM..Run: [DU Meter] C:ProgrammerDU MeterDUMeter.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINNTsystem32NvCpl.dll,NvStartup
O4 - HKCU..Run: [internat.exe] internat.exe
O4 - HKCU..Run: [RemoteCenter] C:ProgrammerCreativeMediaSourceRemoteControlRcMan.exe
O4 - HKCU..Run: [MsnMsgr] "C:ProgrammerMSN MessengerMsnMsgr.Exe" /background
O4 - Global Startup: HotKey.lnk = C:ProgrammerTEXTwareHotKeyTwalink.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:PROGRA~1MICROS~3Office10EXCEL.EXE/3000
O12 - Plugin for .spop: C:ProgrammerInternet ExplorerPluginsNPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binar......
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netrad...
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com......
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/......
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar......
O16 - DPF: {D3426292-3750-4D80-9D0F-2816F61A6D15} (SpeedTest Control) - http://81.19.245.211/speedtest/Spee...
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:WINNTsystem32CTsvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:WINNTSystem32dmadmin.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:ProgrammerNorton AntiVirus
avapsvc.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:ProgrammerNetropaMultimedia Keyboard
hksrv.exe
O23 - Service: Norton Personal Firewall Service (NISSERV) - Symantec Corporation - C:ProgrammerNorton Personal FirewallNISSERV.EXE
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - C:ProgrammerNorton Personal FirewallNISUM.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINNTSystem32
vsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:PROGRA~1FLLESF~1SYMANT~1SCRIPT~1SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:ProgrammerFælles filerSymantec SharedSNDSrvc.exe
O23 - Service: Norton Personal Firewall Proxy Service (SymProxySvc) - Symantec Corporation - C:ProgrammerNorton Personal FirewallSymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:ProgrammerFælles filerSymantec SharedSecurity CenterSymWSC.exe



Jeg vil bede dig kigge på nedenstående fil også.

C:WINNTsystem32internat.exe

Hvis der er et "?" ikon ud for den skal den ikke slettes, hvis der er et "zip-fil" ikon ud for den skal den slettes.
Du må meget gerne give mig besked om hvilket ikon der var og om du slettede den.

Der var et "?" ikon og jeg slettede IKKE filen.

Jeg har ellers gjort hvad du sagde, og der var efterfølgende ingen problemer med at boote.

#4
Din log er også ren nu så det passer meget godt.

Husk at scanne nogle gange fremover med Spybot og Ad-aware bare engang om ugen eller hver 14. dag, og det behøves ikke at være i fejlsikret tilstand man gør det.