virus/spyware? sakte og kommer ikke inn på mye

[...............]

- Det kommer mye popups!

- Kommer ikke inn på CTR+alt+delete=borte

- Prøvd og sletta noe som ikke skulle være der, men kom igjen=noe borte

- Kjørt gjennom den spyware og adware stickyen.hjalp ikke så mye

 

Noen måte jeg kan finne ut om det er en orm? eller hva det er som plager meg?

 

EDIT: denne kommer opp noen ganger:

Skjult tekst: (Marker innholdet i feltet for å se teksten):

LimeWire version 4.10.9

Java version 1.5.0_03 from Sun Microsystems Inc.

Windows XP v. 5.1 on x86

Free/total memory: 3272248/4128768

 

com.limegroup.gnutella.gui.GUILoader$StartupFailedException: invalid update.ver

at com.limegroup.gnutella.gui.GUILoader.sanityCheck(GUILoader.java:274)

at com.limegroup.gnutella.gui.GUILoader.load(GUILoader.java:40)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)

at java.lang.reflect.Method.invoke(Unknown Source)

at com.limegroup.gnutella.gui.Main.main(Main.java:44)

 

STARTUP ERROR!

 

-- listing properties --

WINDOW_Y=-4

WINDOW_X=-4

PORT=39793

RUN_ON_STARTUP=false

UPDATE_DELAY=252000020

UPDATE_GIVEUP_FACTOR=24

FILTER_HASH_QUERIES=true

INSTALLED=true

UI_LIBRARY_TREE_DIVIDER_LOCATION=123

AVERAGE_UPTIME=3711

TOTAL_UPTIME=37119

MAX_UPLOAD_BYTES_PER_SEC=19

MIN_CONNECT_TIME=7

COUNTRY=

LAST_SHUTDOWN_TIME=1149713146953

APP_WIDTH=1280

SESSIONS=11

000

 

Har slettet Limewire nå. PGA at den popa opp hele tia..

Denne kommer ikke opp lenger

 

EDIT2: Det er noe som heter Network Monitor, som jeg ikke får sletta.. Kanskje det kan hjelpe og identifisere?=Ser ut til å være borte

Endret 8. juni 2006 av beneiro

[zjulik]

Last ned Hijackthis fra min signatur, scan til en loggfil, lim inn loggen her. Da ser vi hva du har fått, og kan gi råd videre.

[...............]

Logfile of HijackThis v1.99.1

Scan saved at 23:17:55, on 07.06.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Skjult tekst: (Marker innholdet i feltet for å se teksten):

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Network Monitor\netmon.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

C:\Programfiler\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\WINDOWS\system32\wscntfy.exe

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\msconfig.exe

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\taskmgr.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\Kaspersky\mwavscan.com

C:\Kaspersky\kavss.exe

C:\WINDOWS\system32\msiexec.exe

C:\Programfiler\limewire\limewire.exe

C:\DOCUME~1\Tommy\LOKALE~1\Temp\Midlertidig mappe 2 for hijackthis.zip\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [csr] csrrs.exe

O4 - HKLM\..\Run: [gcasServ] "C:\Programfiler\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [steam] "c:\programfiler\steam\steam.exe" -silent

O4 - Startup: Adobe Gamma.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: msconfig.exe

O4 - Global Startup: taskmgr.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - AppInit_DLLs: C:\WINDOWS\system32\javaw.dll

O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\lvjo0913e.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: WMP54GSSVC - Unknown owner - C:\Programfiler\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe" "WMP54GSv1_1.exe (file missing)

 

Den du mente?

[zjulik]

Begynn med å kjøre Hijackthis igjen og kryss av for, deretter fiks, disse:

 

O4 - HKLM\..\Run: [csr] csrrs.exe

- virus

O4 - Global Startup: msconfig.exe

O4 - Global Startup: taskmgr.exe

- aldri sett dette, men det er helt sikkert ikke sunt

 

O20 - AppInit_DLLs: C:\WINDOWS\system32\javaw.dll

EDIT: Mystisk fil. Ta den bort.

 

Se deretter om du finner filen csrrs.exe i Windows eller Windows/system32-mappen, og prøv å slett den. Pass på at du tar nettopp den og ikke noe som ligner!

 

Kjør så en god runde CCleaner (link i sig) og ta deretter en omstart. Så legger du inn

den nyeste javaen (du har 1.503), 1.5.07: http://www.java.com/en/download/manual.jsp

 

Post så en ny logg.

Endret 7. juni 2006 av zjulik

[...............]

her vettu:

 

Logfile of HijackThis v1.99.1

Scan saved at 23:41:39, on 07.06.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Skjult tekst: (Marker innholdet i feltet for å se teksten):

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

C:\Programfiler\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\msiexec.exe

C:\DOCUME~1\Tommy\LOKALE~1\Temp\Midlertidig mappe 1 for hijackthis.zip\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_07\bin\ssv.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_07\bin\jusched.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [gcasServ] "C:\Programfiler\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [steam] "c:\programfiler\steam\steam.exe" -silent

O4 - Startup: Adobe Gamma.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_07\bin\npjpi150_07.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_07\bin\npjpi150_07.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - AppInit_DLLs: C:\WINDOWS\system32\javaw.dll

O20 - Winlogon Notify: SharedDlls - C:\WINDOWS\system32\j2p0lc7m1f.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: WMP54GSSVC - Unknown owner - C:\Programfiler\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe" "WMP54GSv1_1.exe (file missing)

 

BTW: Fant ikke csrrs.exe fila, bare en som var lik. Turte ikke slette den..

 

EDIT: Nå funker alt bra.. Utentatt MYE popups, noe mer jeg kan ta bort>?

Endret 7. juni 2006 av beneiro

[berxter]

Denne

O20 - Winlogon Notify: SharedDlls - C:\WINDOWS\system32\j2p0lc7m1f.dll

er nok en Look2me-komponent.

last ned L2mfix

 

"Save the file to your desktop. Double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into your next reply here."

Ikke kjør option #2 før vi har kikket på resultatet.

 

Prøv med den.

 

Bernt K

[...............]

Skjult tekst: (Marker innholdet i feltet for å se teksten):

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\

6c,00,00,00

"Logoff"="ChainWlxLogoffEvent"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Logoff"="CryptnetWlxLogoffEvent"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

"DLLName"="cscdll.dll"

"Logon"="WinlogonLogonEvent"

"Logoff"="WinlogonLogoffEvent"

"ScreenSaver"="WinlogonScreenSaverEvent"

"Startup"="WinlogonStartupEvent"

"Shutdown"="WinlogonShutdownEvent"

"StartShell"="WinlogonStartShellEvent"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

"DLLName"="wlnotify.dll"

"Logon"="SCardStartCertProp"

"Logoff"="SCardStopCertProp"

"Lock"="SCardSuspendCertProp"

"Unlock"="SCardResumeCertProp"

"Enabled"=dword:00000001

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"StartShell"="SchedStartShell"

"Logoff"="SchedEventLogOff"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

"Logoff"="WLEventLogoff"

"Impersonate"=dword:00000000

"Asynchronous"=dword:00000001

"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

"DLLName"="WlNotify.dll"

"Lock"="SensLockEvent"

"Logon"="SensLogonEvent"

"Logoff"="SensLogoffEvent"

"Safe"=dword:00000001

"MaxWait"=dword:00000258

"StartScreenSaver"="SensStartScreenSaverEvent"

"StopScreenSaver"="SensStopScreenSaverEvent"

"Startup"="SensStartupEvent"

"Shutdown"="SensShutdownEvent"

"StartShell"="SensStartShellEvent"

"PostShell"="SensPostShellEvent"

"Disconnect"="SensDisconnectEvent"

"Reconnect"="SensReconnectEvent"

"Unlock"="SensUnlockEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

"Asynchronous"=dword:00000000

"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\

6c,00,6c,00,00,00

"Impersonate"=dword:00000000

"Logoff"="TSEventLogoff"

"Logon"="TSEventLogon"

"PostShell"="TSEventPostShell"

"Shutdown"="TSEventShutdown"

"StartShell"="TSEventStartShell"

"Startup"="TSEventStartup"

"MaxWait"=dword:00000258

"Reconnect"="TSEventReconnect"

"Disconnect"="TSEventDisconnect"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Themes]

"Asynchronous"=dword:00000000

"DllName"="C:\\WINDOWS\\system32\\ktr6l79s1.dll"

"Impersonate"=dword:00000000

"Logon"="WinLogon"

"Logoff"="WinLogoff"

"Shutdown"="WinShutdown"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

"DLLName"="wlnotify.dll"

"Logon"="RegisterTicketExpiredNotificationEvent"

"Logoff"="UnregisterTicketExpiredNotificationEvent"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

 

**********************************************************************************

useragent:

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

"{83C87C68-12EA-29C4-1E67-9D63B36E3360}"=""

 

**********************************************************************************

Shell Extension key:

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

"{00022613-0000-0000-C000-000000000046}"="Egenskapsside for multimediefil"

"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM skannerbehandling"

"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS-sikkerhetsside"

"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Egenskapsside for OLE DOC-fil"

"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Skallutvidelse for deling"

"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"

"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermkort"

"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermtype"

"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermpanorering"

"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS-sikkerhetsside"

"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Kompatibilitetsside"

"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"

"{59099400-57FF-11CE-BD94-0020AF85B590}"="Diskkopieringsutvidelse"

"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Skallutvidelser for Microsoft Windows-nettverksobjekter"

"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM skjermbehandling"

"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM skriverbehandling"

"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Skallutvidelser for filkomprimering"

"{77597368-7b15-11d0-a0c2-080036af3f03}"="Skallutvidelse for Web-skriver"

"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"

"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Hurtigmeny for kryptering"

"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Koffert"

"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Ikonutvidelse for HyperTerminal"

"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Skrifter"

"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profil"

"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Skriversikkerhetsside"

"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Skallutvidelse for deling"

"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"

"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-utvidelse"

"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign-utvidelse"

"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Nettverkstilkoblinger"

"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Nettverkstilkoblinger"

"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Skannere og kameraer"

"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Skannere og kameraer"

"{905667aa-acd6-11d2-8080-00805f6596d2}"="Skannere og kameraer"

"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Skannere og kameraer"

"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Skannere og kameraer"

"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"

"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Skallutvidelser for Windows Script Host"

"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft-datakobling"

"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"

"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"

"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Planlagte oppgaver"

"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"

"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"

"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Oppgavelinje og Start-meny"

"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="S›k"

"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Hjelp og st›tte"

"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Hjelp og st›tte"

"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Kj›r..."

"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internett"

"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-post"

"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"

"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative verkt›y"

"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Egenskapsside for tidligere versjoner"

"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Tidligere versjoner"

"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"

"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"

"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"

"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"

"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"

"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"

"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internett-verkt›ylinje"

"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Nedlastingsstatus"

"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"

"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"

"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="B†ndproxy"

"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"

"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"

"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"

"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"

"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"

"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"

"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"

"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"

"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"

"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"

"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"

"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"

"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"

"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"

"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"

"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"

"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"

"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"

"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"

"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"

"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"

"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"

"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"

"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"

"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"

"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"

"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"

"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft-tjeneste for tidligere URL-adresser"

"{FF393560-C2A7-11CF-BFF4-444553540000}"="Logg"

"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Midlertidige Internett-filer"

"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Midlertidige Internett-filer"

"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft-binding for URL-s›k"

"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Velkomstbilde for Internet Explorer 4.0"

"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"

"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"

"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"

"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internett"

"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"

"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-b†nd"

"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"

"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"

"{88C6C381-2E85-11D0-94DE-444553540000}"="Mappe for ActiveX-hurtigbuffer"

"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"

"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"

"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Abonnementsmappe"

"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"

"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"

"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"

"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"

"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"

"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"

"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"

"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Behandling av skallprogrammer"

"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Enumerator for installerte programmer"

"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin Programpubliserer"

"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"

"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"

"{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"

"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Uttrekking av miniatyrbilder i GDI+-filer"

"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Behandling av informasjon om miniatyrbilder"

"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Uttrekking av HTML-miniatyrbilder"

"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"

"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Veiviser for Web-publisering"

"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Bestille utskrifter via Weben"

"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Veiviserobjekt for skallpublisering"

"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="F† en passport-veiviser"

"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Brukerkontoer"

"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"

"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"

"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanalfil"

"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Kanalsnarvei"

"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Kanalbehandlingsobjekt"

"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"

"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"

"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"

"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"

"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"

"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"

"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"

"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"

"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"

"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"

"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"

"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"

"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"

"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"

"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"

"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"

"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"

"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"

"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"

"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"

"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"

"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Mappe for Frakoblede filer"

"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"

"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"

"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"

"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"

"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"

"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Etter &personer..."

"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"

"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"

"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"

"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders"

"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"

"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"

"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"

"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"

"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"

"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"

"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"

"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"

"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"

"{BA58D928-05B1-445E-8203-9918021D982E}"=""

"{F012CBAC-2007-4A2E-8EDC-2FEDC085A71D}"=""

"{B9EA8F5D-E8A6-4613-9451-40DB8A33C925}"=""

"{C4A7D8EF-BB12-46CC-9B77-A02CE121144C}"=""

"{FEBD6F2C-A71B-4B76-B550-01BE4B750AEA}"=""

"{C786088B-1356-4B12-B5B7-5F8B02344C61}"=""

 

**********************************************************************************

HKEY ROOT CLASSIDS:

Windows Registry Editor Version 5.00

 

[HKEY_CLASSES_ROOT\CLSID\{BA58D928-05B1-445E-8203-9918021D982E}]

@=""

"IDEx"="ADDR"

 

[HKEY_CLASSES_ROOT\CLSID\{BA58D928-05B1-445E-8203-9918021D982E}\Implemented Categories]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{BA58D928-05B1-445E-8203-9918021D982E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{BA58D928-05B1-445E-8203-9918021D982E}\InprocServer32]

@="C:\\WINDOWS\\system32\\dUdx9_28.dll"

"ThreadingModel"="Apartment"

 

Windows Registry Editor Version 5.00

 

[HKEY_CLASSES_ROOT\CLSID\{C4A7D8EF-BB12-46CC-9B77-A02CE121144C}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{C4A7D8EF-BB12-46CC-9B77-A02CE121144C}\Implemented Categories]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{C4A7D8EF-BB12-46CC-9B77-A02CE121144C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{C4A7D8EF-BB12-46CC-9B77-A02CE121144C}\InprocServer32]

@="C:\\WINDOWS\\system32\\guard.tmp"

"ThreadingModel"="Apartment"

 

Windows Registry Editor Version 5.00

 

[HKEY_CLASSES_ROOT\CLSID\{FEBD6F2C-A71B-4B76-B550-01BE4B750AEA}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{FEBD6F2C-A71B-4B76-B550-01BE4B750AEA}\Implemented Categories]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{FEBD6F2C-A71B-4B76-B550-01BE4B750AEA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{FEBD6F2C-A71B-4B76-B550-01BE4B750AEA}\InprocServer32]

@="C:\\WINDOWS\\system32\\guard.tmp"

"ThreadingModel"="Apartment"

 

Windows Registry Editor Version 5.00

 

[HKEY_CLASSES_ROOT\CLSID\{C786088B-1356-4B12-B5B7-5F8B02344C61}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{C786088B-1356-4B12-B5B7-5F8B02344C61}\Implemented Categories]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{C786088B-1356-4B12-B5B7-5F8B02344C61}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]

@=""

 

[HKEY_CLASSES_ROOT\CLSID\{C786088B-1356-4B12-B5B7-5F8B02344C61}\InprocServer32]

@="C:\\WINDOWS\\system32\\wxweb.dll"

"ThreadingModel"="Apartment"

 

**********************************************************************************

Files Found are not all bad files:

 

C:\WINDOWS\SYSTEM32\

d3dx9_30.dll Fri 31 Mar 2006 12:40:58 A.... 2 388 176 2,28 M

i0jqla~1.dll Thu 8 Jun 2006 0:18:56 ..S.R 234 272 228,78 K

irl6l5~1.dll Thu 8 Jun 2006 14:34:10 ..S.R 235 969 230,44 K

javaw.dll Wed 7 Jun 2006 22:29:44 A.... 81 920 80,00 K

ktr6l7~1.dll Wed 7 Jun 2006 23:37:56 ..S.R 235 969 230,44 K

o2pqlc~1.dll Wed 7 Jun 2006 22:29:14 ..S.R 234 888 229,38 K

sirenacm.dll Sat 22 Apr 2006 17:22:48 A.... 60 200 58,79 K

vbzip10.dll Wed 7 Jun 2006 22:30:34 A.... 147 456 144,00 K

wxweb.dll Thu 8 Jun 2006 14:41:40 ..S.R 235 969 230,44 K

xacten~2.dll Fri 31 Mar 2006 12:39:48 A.... 229 584 224,20 K

xinput~2.dll Fri 31 Mar 2006 12:39:24 A.... 62 672 61,20 K

 

11 items found: 11 files (5 H/S), 0 directories.

Total of file sizes: 4 147 075 bytes 3,95 M

Locate .tmp files:

 

C:\WINDOWS\SYSTEM32\

setupe~1.tmp Wed 7 Jun 2006 22:28:16 A.... 36 864 36,00 K

 

1 item found: 1 file, 0 directories.

Total of file sizes: 36 864 bytes 36,00 K

**********************************************************************************

Directory Listing of system files:

Volumet i stasjon C er uten navn.

Volumserienummeret er 04FC-FBAF

 

Innhold i C:\WINDOWS\System32

 

08.06.2006 14:41 235ÿ969 wxweb.dll

08.06.2006 14:36 <DIR> dllcache

08.06.2006 14:34 235ÿ969 irl6l53s1.dll

08.06.2006 00:18 234ÿ272 i0jqla151d.dll

07.06.2006 23:37 235ÿ969 ktr6l79s1.dll

07.06.2006 22:29 234ÿ888 o2pqlc751f.dll

06.05.2006 23:33 <DIR> Microsoft

04.08.2004 01:03 155ÿ648 csrrs.exe.mwt

6 fil(er) 1ÿ332ÿ715 byte

2 mappe® 219ÿ509ÿ227ÿ520 byte ledig

 

Her er den

[berxter]

Ser ut som du bare kan kjøre alt #2 med en gang. Når du det har gjort legger du ut l2mfixloggen igjen, med en blodfersk HJTlogg i tillegg.

 

Bernt K

[...............]

Jeg trenger ikke mer hjelp.. *Glemmer posten**

[berxter]

Det er selvsagt greit, men jeg vil sette pris på å få høre om l2mfix'en tok kål på svineriet, eller om det er andre grunner til at du sier at det er nok? Av ren nysgjerrighet, selvsagt, og for å få vite om l2mfix fortsatt er et godt hjelpemiddel

 

Bernt K

[...............]

Jeg var nødt til å ha en pc, også har jeg nettopp bygd osv, så jeg hadde omtrent ikke noe på den..

 

Så tok å formaterte..

[berxter]

Jaja, det er jo alltids en utvei.

 

Bernt K