Hoi c3826926,
Kijk eerst in Configuratiescherm > Software of SaveNow aka Save! aka WhenUSave daar vermeld staat. Als dat zo is verwijder het dan eerst daar voor je met het volgende doorgaat. Anders kun je meteen aan de slag.
Je hebt lop.com, SaveNow, Gator en Weathercast.
Vink onderstaande items aan in HijackThis, sluit alle IE, OE en verkenner vensters en klik op Fix checked:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://N11343.sfux.com/passthrough/index.html?
http://www.wanadoo.nl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://A30361.sfux.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://A30361.sfux.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://A30361.sfux.com/searchbar.html
O2 - BHO: (no name) - {fc57e484-99e8-463a-a078-9640eb0d60d6} - C:\DOCUME~1\PAULVA~1\APPLIC~1\qlyydrnoah.dll
O3 - Toolbar: pgrfrdreufo - {1016d760-504b-47fe-a833-c282065096c1} - C:\DOCUME~1\PAULVA~1\APPLIC~1\qlyydrnoah.dll
O4 - HKLM\..\Run: [] C:\WINDOWS\Options\OEMReset.exe /Audit
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\paul van dijk\local settings\temp\trickler_4010.exe"
O4 - HKLM\..\Run: [inoaly] C:\DOCUME~1\PAULVA~1\APPLIC~1\epaeeuio.exe -QuieT
O4 - HKCU\..\Run: [WeatherCast] C:\Program Files\WeatherCast\Weather.exe /q
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} -
http://www.terra.es/personal9/centuryrules/wrn/mp3_plugin.exe
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} -
http://www.getweathercast.com/WeatherAutoCAST0010.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = H23761.sfux.com
O17 - HKLM\Software\..\Telephony: DomainName = H23761.sfux.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B2AD334-8813-436A-9F10-F17F00EBFBFE}: Domain = H23761.sfux.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B9BB44F-CFDC-4034-961B-46DC67A60365}: Domain = H23761.sfux.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{37EAFC23-094A-49B2-BC2F-19193670CFDF}: Domain = H23761.sfux.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{B74561C8-D9BF-4575-8343-7F200D7D1139}: Domain = H23761.sfux.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBEBC3F3-CDB8-4D7A-8F66-0F50080FC240}: Domain = H23761.sfux.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = H23761.sfux.com
Start daarna opnieuw op en volg JBS´advies op.
Download
Spybot - Search & Destroy installeer het, haal alle updates op, scan je computer en laat alles dat in het rood aangegeven wordt repareren.
Suc6,
Pieter