Notifikationer

Markér alle som læst Log ud

joda5 Nybegynder

19. september 2005 - 20:07 Der er 8 kommentarer og
2 løsninger

Hijack Logfil hjælp

Hej

Jeg har problemer med pop-ups fra Aurora ABI Network. Er der nogen der kan fortælle mig, hvad jeg kan fjerne ? Her er min logfil.

Logfile of HijackThis v1.99.1
Scan saved at 19:51:31, on 19-09-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\Mixer.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Winamp\winampa.exe
c:\windows\system32\owxtdr.exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Programmer\Kazaa Lite K++\Kazaa.kpp
C:\Programmer\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gvd.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotbar.com/dyn/hotbar/3.0/sb_searchPageHome.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.gvd.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programmer\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [oimcgpg] c:\windows\system32\owxtdr.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GStartup.lnk = C:\RECYCLER\NPROTECT\00209631.exe
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Programmer\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmer\Fælles filer\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

På forhånd tak
Joda5

Synes godt om

ejvindh Ekspert

19. september 2005 - 20:10 #1

Jeg kigger på den.

Synes godt om

ejvindh Ekspert

19. september 2005 - 20:15 #2

1. Hent Ewido herfra (14 dages version af plus-versionen - herefter bliver den "neddroslet" til gratis-versionen):

http://shop.element5.com/product.html?productid=531168&affiliateid=200010704 (klik på demo download)

Installer og kør Ewido - opdater programmet (men lad være med at scanne).

2. Hent Adaware her:

http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10045910.html

... og Adwares VX2 plugin her:

http://www.lavasoft.de/software/addons/vx2cleaner.shtml

Installer Adaware (under installationen bliver du spurgt om du vil opdatere og køre en fuld scanning - fjern alle tre flueben), og installer herefter VX2 plugin ved at dobbeltklikke på vx2cleaner_inst.exe (brug alle standard indstillinger)

3. Kør Adaware og opdater programmet med de nyeste opdateringer. Klik på Add-ons i den venstre kolonne. Vælg VX2 Cleaner V2.0 og klik på "Run Tool". Klik på OK - hvis programmet finder noget, så klik på "Clean". Når rensningen er overstået, så skal du klikke på "Close" og lukket programmet.

4. Genstart din computer og kør Adaware igen. Denne gang skal du klikke på "Start" og vælge "Perform smart system scan" - klik herefter på "Next". Når scanningen er gennemført, klik på "Next" - vælg alt hvad programmet finder (højreklik på en linie og vælg "Select all objects". Klik "Next", og klik "OK".

Du bliver spurgt om at køre Adaware ved genstart - klik "OK" og luk Adaware. Genstart din computer.

5. For at få et sidste sikkerhedscheck... kør en fuld scanning med Ewido - husk at opdatere programmet først. Når programmet er færdig med at scanne skal du klikke på "Save Report" (husk hvor du gemmer rapporten).

6. Genstart din computer og læg en frisk HijackThis log herind, sammen med rapporten fra Ewido.

Synes godt om

joda5 Nybegynder

20. september 2005 - 00:23 #3

Hej Ejvindh

Efter at have fuldt din vejledning ser log fil og ewido rapport sådan ud:

Logfile of HijackThis v1.99.1
Scan saved at 00:19:31, on 20-09-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\Mixer.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmer\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gvd.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotbar.com/dyn/hotbar/3.0/sb_searchPageHome.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.gvd.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programmer\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GStartup.lnk = C:\RECYCLER\NPROTECT\00209631.exe
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmer\Fælles filer\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 00:16:21, 20-09-2005
+ Report-Checksum: 99E7845D

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\unebmm350 -> Spyware.MoneyMaker : Cleaned with backup
HKU\S-1-5-21-527237240-1957994488-682003330-1003\Software\Microsoft\Internet Explorer\Extensions\{6685509E-B47B-4f47-8E16-9A5F3A62F683} -> Spyware.MoneyMaker : Cleaned with backup
HKU\S-1-5-21-527237240-1957994488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{000020DD-C72E-4113-AF77-DD56626C6C42} -> Spyware.TwainTech : Cleaned with backup
HKU\S-1-5-21-527237240-1957994488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6685509E-B47B-4F47-8E16-9A5F3A62F683} -> Spyware.MoneyMaker : Cleaned with backup
HKU\S-1-5-21-527237240-1957994488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9E1089BC-1AE8-4685-8D77-6721E5C318A8} -> Spyware.ComLoad : Cleaned with backup
HKU\S-1-5-21-527237240-1957994488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50} -> Dialer.Generic : Cleaned with backup
HKU\S-1-5-21-527237240-1957994488-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC87A650-207D-4392-A6A1-82ADBC56FA64} -> Spyware.MoneyTree : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.112:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.116:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.117:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.118:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.126:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Masterstats : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Cqcounter : Cleaned with backup
:mozilla.144:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.145:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.146:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.147:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.148:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.186:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.190:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.196:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.197:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.198:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.199:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.207:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.208:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.215:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.220:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Sexlist : Cleaned with backup
:mozilla.222:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.223:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.224:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.225:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.226:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.227:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.228:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.229:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.230:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.231:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.232:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.233:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.234:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.235:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.236:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.237:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.238:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.239:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.240:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.241:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.242:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.243:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.244:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.245:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.246:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.247:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.248:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.249:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.250:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.251:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.252:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.291:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.307:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Clickhype : Cleaned with backup
:mozilla.317:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.323:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.325:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Paycounter : Cleaned with backup
:mozilla.326:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.339:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.361:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.362:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.363:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.364:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
:mozilla.396:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.397:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.398:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.425:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.438:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.449:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Belstat : Cleaned with backup
:mozilla.450:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Belstat : Cleaned with backup
:mozilla.451:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Clickzs : Cleaned with backup
:mozilla.470:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
:mozilla.526:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
:mozilla.527:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
:mozilla.528:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
:mozilla.529:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
:mozilla.530:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
:mozilla.531:C:\Documents and Settings\Joan og David\Application Data\Mozilla\Firefox\Profiles\k3xuv4kh.default\cookies.txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@banner.grandonline[2].txt -> Spyware.Cookie.Grandonline : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@grandonline[2].txt -> Spyware.Cookie.Grandonline : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@ilead.itrack[2].txt -> Spyware.Cookie.Itrack : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@image.masterstats[1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
C:\Documents and Settings\Joan og David\Cookies\joan og david@www.grandonline[1].txt -> Spyware.Cookie.Grandonline : Cleaned with backup
C:\Documents and Settings\Joan og David\Lokale indstillinger\Temp\cln1C.tmp -> TrojanDownloader.Dyfuca.dk : Cleaned with backup
C:\Documents and Settings\Joan og David\Lokale indstillinger\Temp\DDS\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Joan og David\Lokale indstillinger\Temp\Hbinst.exe -> Spyware.HotBar : Cleaned with backup
C:\Documents and Settings\Joan og David\Lokale indstillinger\Temp\IHD\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Joan og David\Lokale indstillinger\Temp\PEU\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Joan og David\Lokale indstillinger\Temp\QGX\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\Joan og David\Lokale indstillinger\Temp\ZPY\aurareco.exe -> Adware.BetterInternet : Cleaned with backup
C:\Programmer\FileSubmit\Harry Potter and the Chamber of Secrets\nnez_388.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\Lycos\ss_IGN1_setup.exe -> Spyware.Sidesearch.d : Cleaned with backup
C:\WINDOWS\NDNuninstall5_20.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\NDNuninstall5_40.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\NDNuninstall5_64.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\NDNuninstall6_10.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\NDNuninstall6_22.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\NDNuninstall6_30.exe -> Spyware.NewDotNet : Cleaned with backup
C:\WINDOWS\ooxddy.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINDOWS\ryehmzlonjg.exe -> Adware.BetterInternet : Cleaned with backup

::Report End

Synes godt om

ejvindh Ekspert

20. september 2005 - 08:14 #4

OK, det tog en del af det. Jeg kan se på dine logs, at du har haft meget forskelligt snavs inde på din pc. Samtidig viste din tidligere log, at du bruger P2P-programmer (Kazaa Lite). Jeg vil derfor gøre opmærksom på, at disse 2 ting meget vel kan hænge sammen. Selvom Kazaa Lite efter sigende ikke selv skulle indeholde Spyware, så er meget af det man henter gennem disse netværk inficeret med snavs. Dertil kommer at Kazaa Lite, så vidt jeg ved, er et ulovligt program (er et crack af det oprindelige Kazaa).

Nå, men nok om det. Nu skal den renses i bund. Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotbar.com/dyn/hotbar/3.0/sb_searchPageHome.htm
O4 - Global Startup: GStartup.lnk = C:\RECYCLER\NPROTECT\00209631.exe

Det kan være en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse (http://www.spywarefri.dk/virusscannere.htm#alle) - genstart din computer - aktiver systemgendannelse.

Du skal også rense browser cachen (hvis du bruger IE-explorer)
1. Klik på Funktioner - Internetindstillinger
2. Under midlertidige filer, klik på Slet cookies
3. Under midlertidige filer, klik på slet filer – sæt flueben i slet alt offline indhold
4. Under Oversigten, klik på ryd oversigten
5. Klik på ok.

Tøm din papirkurv.

Gå også ind i Firefox: Klik på Funktioner-Indstillinger-Privatliv-Ryd alt-Slet alt information.

Genstart herefter computeren, og lav en ny HJT-log, som du lægger herind.

Synes godt om

joda5 Nybegynder

20. september 2005 - 18:19 #5

Jeg har nu gjort det meste af det du skrev. Det eneste jeg ikke har gjort er at rydde op i systemgendannelses filerne, jeg forstod ikke lige helt hvad det var jeg skulle gøre på www.spywarefri.dk.

Min logfil ser nu således ud:

Logfile of HijackThis v1.99.1
Scan saved at 18:16:21, on 20-09-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\WINDOWS\Mixer.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\Programmer\Symantec\LiveUpdate\AUpdate.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\imapi.exe
C:\Programmer\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gvd.dk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.gvd.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programmer\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmer\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programmer\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programmer\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmer\Fælles filer\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Synes godt om

joda5 Nybegynder

20. september 2005 - 18:22 #6

Hvilken virusscanner skulle jeg bruge når jeg har deaktiveret systemgendannelsen ?

Synes godt om

ejvindh Ekspert

20. september 2005 - 19:55 #7

Din log er ren :-)

Det link jeg gav dig til spywarefri skulle blot demonstrere, hvordan man deaktiverer systemgendannelse:
"Højreklik på "Denne Computer" på skrivebordet, vælg egenskaber og fanebladet "Systemgendannelse" og sæt flueben i "Deaktiver systemgendannelse". Klik ok og genstart. Når du skal aktivere systemgendannelse igen går du samme vej og fjerner fluebenet i "Deaktiver systemgendannelse"."

Det var ikke meningen, at du skulle køre noget virus-scan på dette tidspunkt. Det var blot for at få slettet alle de filer, der ligger herinde (så du ikke på et senere tidspunkt kommer til at gendanne computeren til den tilstand, hvor du havde virus inde) :-)

For at forhindre gentagelser, vil jeg anbefale dig at lægge nogle små programmer ind, som forhindrer spyware i at komme ind i første omgang. Som minimum vil jeg anbefale at lægge Spywareguard, Spywareblaster og IE-spyad ind. Alle programmer kan du finde links til herfra:
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm

Alle computere bør være beskyttet af en firewall. Link og vejledning til en god og gratis firewall finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=9706

Synes godt om

joda5 Nybegynder

20. september 2005 - 22:55 #8

Mange tak for hjælpen

Synes godt om

ejvindh Ekspert

21. september 2005 - 07:55 #9

Det var så lidt. Du lukker spørgsmålet ved at markere mit navn ude til venstre, og derefter klikke på accepter. :-)

Synes godt om

ejvindh Ekspert

22. september 2005 - 10:05 #10

Jeg takker for point :-)

Synes godt om

Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Følg dette spørgsmål

Opret Preview

Se alle it-kurser fra Computerworld Kurser

IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Se alle it-kurser

Flere spørgsmål fra Virus kategorien

Titel	Indlæg	Oprettet	Seneste aktivitet
Vil skrifte antivirusprogram. Af ErikHg i Virus	22	26/11/202510:42	23/12/202514:29
Er gratis Bitdefender værd at installere ? Af Ikke-ekspert i Virus	8	31/08/202519:08	01/09/202514:18
Ukendte filer på min Pc Af jonpet i Virus	10	03/02/202514:20	04/02/202511:05
mulig ukendt virus Af jackie18 i Virus	3	18/01/202514:07	18/01/202516:39
virus popper op med jævne mellemrum Af Malm i Virus	13	18/01/202511:40	20/01/202517:53

Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten

Seneste artiklerRSS