Archief - virus: pc valt uit, logje effe bekijke pls

Hallo, mijn pc is sinds woensdag redelijk gefuckt ik met antivir gaf de hele tijd een virus aan en als ik dan op delete duw gaat het maar niet weg. Toen is een volledige scan gedaan, toen heb ik heel wat virussen weggekregen maar dat ene virus blijft er maar op. Nu valt ook om de zoveel tijd mijn pc uit. Zou je mijn logje is willen checken?

thx!



Logfile of HijackThis v1.99.1
Scan saved at 13:13:34, on 7-10-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Save\Save.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\hijack this\HijackThis.exe
C:\Program Files\AntiVir PersonalEdition Classic\GUARDGUI.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.beyondgaming.be
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 202.143.133.242:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {73364D99-1240-4dff-B11A-67E448373048} - C:\WINDOWS\system32\ipv6monl.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSNS PLUS XP2] msnbeta.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [MSNS PLUS XP2] msnbeta.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/08c967873a01b9781b15/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {E46370AC-6F66-4101-B8D3-30934B66EA6D} (AXDllHost Control) - http://www.smissie.com/AXDllHost.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dvb03a - dvb03a.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Download haxfix.exe.
Plaats het op je bureaublad.
Sluit alle andere programma's en sluit alle open vensters.
Dubbelklik op haxfix.exe om de installatie te starten.
Plaats een vinkje bij "Create a desktop icon".
Klik op "Next" en volg de instructies op het scherm.
Als de installatie klaar is zorg je dat er een vinkje staat bij "Launch HaxFix".
Klik op "Finish".
Er opent een rood doschermpje.
Kies voor Optie 1: Make logfile door op 1 te drukken.
Dit kan even duren. Wanneer HaxFix hiermee klaar is opent er een kladblokbestandje (haxlog.txt)
Post de inhoud van dat bestandje.

HAXFIX logfile - by Marckie
______________
version 4.21
za 07-10-2006 14:37:38,28

checking for haxdoor
--------------------
checking for a3d files....
a3d files not found

checking for matching notify keys....
matching notify keys found
dvb0

checking for matching services....
matching services found
dvb03a
dvb06a

checking for matching safeboot services....
matching safeboot services found
dvb06a.sys

checking for other haxdoorfiles....


Checking for goldun
-------------------

checking for SSODL keys....
no ssodl keys found

checking for notify keys....
no notify keys found

checking for services....
no services found

checking for other goldunfiles....


Finished

Start Haxfix opnieuw door op je bureaublad op het icoontje HaxFix te klikken.
(of open de map program files\haxfix en dubbelklik op fix.bat)
Optie 2: Run auto fix
Sluit alle andere vensters, de computer zal tijdens het runnen van HaxFix herstarten.
Tik in 2 en druk op Enter om Optie 2 "Run auto fix" te starten.
Volg de instructies op het scherm.
De computer zal opnieuw starten.
Als Haxfix klaar is, opent er een kladblokbestand (c:\haxfix.txt). Post de inhoud van dit bestandje.

HAXFIX logfile - by Marckie
--------------
version 4.21
za 07-10-2006 16:19:10,68

--- Auto Haxdoorfix ---


searching for files:


searching for services....
service dvb03a found
[SWSC] DeleteService SUCCESS
service dvb06a found
[SWSC] DeleteService SUCCESS


--- Goldunfix ---


searching for files:

searching for SSODLkeys:
no SSODLkeys found

searching for notifykeys:
no notifykeys found

searching for services:
no services found


.....rebooting the computer.....


searching for ssodlkeys

not needed


searching for notifykeys

notifykey dvb03a not found


searching for services

service dvb03a not found
service dvb06a not found


searching for safeboot services

safeboot service dvb06a.sys not found


searching for files

dvb03a.dll exists
deleting dvb03a.dll
dvb03a.dll has been deleted

dvb03a.sys exists
deleting dvb03a.sys
dvb03a.sys has been deleted

dvb06a.sys exists
deleting dvb06a.sys
dvb06a.sys has been deleted


checking for other files

No other files found


checking for a3d files

no a3d files found


Finished

* Je kan deze instructies best uitprinten of opslaan in een kladblokbestand, want straks zal je in veilige modus
moeten gaan werken, en dan is deze pagina niet beschikbaar (geen internet)

* Download smitRem.exe en sla dit op op het Bureaublad.
Dubbelklik op het bestand en pak het uit naar zijn eigen map op het Bureaublad.


* Download en installeer AVG Anti-Spyware.

• 
  Na de installatie, open AVG Anti-Spyware:
  * onder "Status", klik op Change state naast "Resident shield". (wijzig van active naar inactive!)
  * onder "Update", klik op de Start update knop.
  * onder "Scanner", tab "Settings":
  • - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine. (ZEER BELANGRIJK!)
    * onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
  Sluit AVG Anti-Spyware. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm
Download link van Ad-aware: http://www.lavasoftusa.com/products/ad-aware_se_personal.php

* Start je computer op in VEILIGE MODUS

* Open de smitrem-map op je bureaublad, en dubbelklik op RunThis.bat. Volg de aanwijzigingen op het scherm.
Je bureaublad en ikoontjes zullen even verdwijnen en daarna terug verschijnen, dit is normaal.
Wacht tot het tooltje zijn werk heeft gedaan en Disk Cleanup afgelopen is. Dit kan enige tijd duren, dus wees geduldig.

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

* Start AVG Anti-Spyware.

• * Klik op Scan en kies Complete System Scan.
  Na de scan; volg onderstaande instructies :
  BELANGRIJK : Klik niet op de "Save Scan Report" knop vooraleer je de "Apply all Actions" knop hebt aangeklikt !
  * Draag er zorg voor dat Set all elements to: op Quarantine staat (1),
  zoniet klik op de link en kies Quarantine in de popup menu. (2)
  (Dit geldt niet voor cookies, deze worden onveranderlijk gedelete !)
  * Onderaan het venster klik op de Apply all Actions knop. (3)
  
  
  
  * Wanneer je de melding krijgt 'All actions have been applied', klik je onderaan op de knop Save Report.

* Ga dan naar Start -> configuratiescherm -> vormgeving en thema's -> bureaublad ->bureaublad aanpassen -> Website -> haal het vinkje weg bij "Security Info" als het er nog staat.

* Herstart je computer in normale modus.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Doe een online scan via Panda's online virus scan en bewaar het rapport dat je krijgt na het scannen

* Herstart je pc nogmaals en plaats dan een nieuw logje van Hijackthis, samen met het rapport van AVG Anti-Spyware 7.5 en Panda, Post de log van de smitRem tool, die je hier kan vinden: C:\smitfiles.txt.

smitRem © log file
version 3.2

by noahdfear


Microsoft Windows XP [versie 5.1.2600]
"IE"="6.0000"

Running from
C:\Documents and Settings\Jodi\Bureaublad\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Appinitdll check ........ Thank you Grinler!

dumphive.exe (C)2000-2004 Markus Stephany
REGEDIT4

[Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!


checking for drsmartload2 key


drsmartload2 key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
AlfaCleaner uninstaller NOT present
SpyFalcon uninstaller NOT present
SpywareQuake uninstaller NOT present
SpywareSheriff uninstaller NOT present
Trust Cleaner uninstaller NOT present
SpyHeal uninstaller NOT present
VirusBurst uninstaller NOT present
BraveSentry uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

amcompat.tlb
nscompat.tlb
logfiles


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 812 'explorer.exe'
Killing PID 812 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN!

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 15:08:30 11-10-2006

+ Scan result:



C:\Documents and Settings\Jodi\Menu Start\Programma's\WhenU -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Jodi\Menu Start\Programma's\WhenU\Learn More About WhenU Save.url -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Jodi\Menu Start\Programma's\WhenU\Learn More About WhenU SaveNow.url -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Jodi\Menu Start\Programma's\WhenU\Uninstall.lnk -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Jodi\Menu Start\Programma's\WhenU\WhenU Help Desk.lnk -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Documents and Settings\Jodi\Menu Start\Programma's\WhenU\WhenU.com Website.url -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\ACM.dll -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\Save.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\Save.exe.acm.dll.mdmp -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\SaveUninst.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\Saveupdate.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\extra.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\ffext.mod -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\save.db -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\save.htm -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\Program Files\Save\store.db -> Adware.SaveNow : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSaveMsg -> Adware.SaveNow : Cleaned with backup (quarantined).
HKLM\SOFTWARE\WhenUSave -> Adware.SaveNow : Cleaned with backup (quarantined).
HKLM\SOFTWARE\WhenUSave\Partners -> Adware.SaveNow : Cleaned with backup (quarantined).
HKLM\SOFTWARE\WhenUSave\Partners\BSPL -> Adware.SaveNow : Cleaned with backup (quarantined).
HKU\S-1-5-21-2052111302-113007714-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\WhenUSave -> Adware.SaveNow : Error during cleaning.
:mozilla.497:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.454:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.455:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.456:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.457:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.458:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.459:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.460:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.461:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.462:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.476:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.477:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][1].txt -> TrackingCookie.Addcontrol : Cleaned.
:mozilla.479:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.480:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.48:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.490:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.491:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.500:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.504:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.503:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.286:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.427:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.345:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][1].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.266:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.483:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.404:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@com[1].txt -> TrackingCookie.Com : Cleaned.
:mozilla.428:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.271:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.294:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.333:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.467:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.463:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][2].txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.429:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][2].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.267:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Gamershell : Cleaned.
:mozilla.268:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.305:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.306:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.312:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.420:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.421:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.246:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.247:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.203:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.501:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.502:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.310:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.110:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.122:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.176:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.225:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.53:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.488:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.489:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.505:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.506:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][2].txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.23:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.25:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.26:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.27:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.40:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.195:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.204:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.381:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.382:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.78:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.79:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.80:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.81:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.183:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.44:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.65:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.66:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.67:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.68:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.70:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.77:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.82:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.85:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.139:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.140:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.112:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned.
:mozilla.113:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned.
:mozilla.151:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.152:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.153:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.199:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Trafic : Cleaned.
:mozilla.117:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.218:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.219:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.220:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.222:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.223:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.234:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.277:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\Jodi\Cookies\jodi@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.15:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.326:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.96:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.507:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.508:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.509:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.510:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Jodi\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.135:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.136:C:\Documents and Settings\Jodi\Application Data\Mozilla\Firefox\Profiles\4yghy4h5.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.


::Report end

Logfile of HijackThis v1.99.1
Scan saved at 15:34:10, on 11-10-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\System32\divxsm.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.beyondgaming.be
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 202.143.133.242:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {73364D99-1240-4dff-B11A-67E448373048} - C:\WINDOWS\system32\ipv6monl.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSNS PLUS XP2] msnbeta.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [MSNS PLUS XP2] msnbeta.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/08c967873a01b9781b15/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {E46370AC-6F66-4101-B8D3-30934B66EA6D} (AXDllHost Control) - http://www.smissie.com/AXDllHost.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


ja die panda scan werkt hier niet, ik krijg een error als ik wil scannen

* Fix de volgende regels in hijackthis:

O2 - BHO: (no name) - {73364D99-1240-4dff-B11A-67E448373048} - C:\WINDOWS\system32\ipv6monl.dll (file missing)
O4 - HKLM\..\Run: [MSNS PLUS XP2] msnbeta.exe
O4 - HKLM\..\RunServices: [MSNS PLUS XP2] msnbeta.exe

* Post dan een nieuw hijackthis logje hier en vertel hoe alles verder werkt.

Logfile of HijackThis v1.99.1
Scan saved at 16:07:01, on 11-10-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.beyondgaming.be
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 202.143.133.242:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/08c967873a01b9781b15/netzip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {E46370AC-6F66-4101-B8D3-30934B66EA6D} (AXDllHost Control) - http://www.smissie.com/AXDllHost.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

virusmelding komt niet meer, pc valt nimeer uit, mijn internet blijft soms wel nog wat hangen ma da heeft hier misschien niet mee te maken
bedankt hé!!

* Je Java software is verouderd. oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem. Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

• Download de nieuwste versie hier: Java Runtime Environment (JRE) 5.0 Update 9.
• Scroll naar beneden tot waar er staat: "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Klik dan rechts op de "Download" knop.
• Vink het volgende aan waar er staat: "Accept License Agreement".
• De pagina zal herladen.
• Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen En bewaar het naar je bureaublad.
• Sluit alle programma's die eventueel open zijn - Zeker je web browser!
• Ga dan naar Start > Configuratiescherm en dubbelklik op software en verwijder alle oudere versies van Java.
• Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
• Klik dan op Verwijderen of Wijzig/Verwijder knop.
• Herhaal dit tot alle oudere versies verdwenen zijn.
• Na het verwijderen van alle oudere versies, herstart dan je pc.
• Dubbelkik dan op jre-1_5_0_09-windows-i586-p.exe op je bureaublad om de nieuwste versie van Java te installeren.

* Voor de rest ziet het er goed uit.

oke merci hé

Graag gedaan.