Archief - Logje checken aub?

Hey

Ik heb de laatste tijd nogal laast van popups tijdens het surfen.

Kheb al ad-aware eens laten runnen en heb nu hijack logje gemaakt:

Logfile of HijackThis v1.99.1
Scan saved at 18:06:03, on 4/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\Rar$EX00.936\HijackThis.exe
C:\WINDOWS\system32\rundll32.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1107274053192
O16 - DPF: {B467A3AF-E45B-4B1B-9983-C035D988FB0F} (VacPro.belgio_ver10) - http://advnt01.com/dialer/belgio_ver10.CAB
O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\fppo0373e.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe



Kijken jullie dit eens na?

Mvg

Download de trial versie van Spy Sweeper en installeer het via de 'standaard installatie'. (er word gevraagd om je e-mail adres, je kan deze gerust geven )

Er zal u gevraagd worden om de nieuwste definitie's van Spysweeper te installeren. (dit kan enkele minuten duren)

Klik dan op Options > Sweep Options en vink aan: Sweep all Folders on Selected drives. en Local Disc C. onder What to Sweep, vink je alles aan

Klik op Sweep en laat het je systeem volledig scannen. Sla het rapport van de scan op.

Herstart de PC en post een nieuw HJT log + het scanrapport van Spy Sweeper

Zoals gevraagd:

Spy Sweeper rapport:

********
18:58: | Start of Session, vrijdag 4 november 2005 |
18:58: Spy Sweeper started
18:58: Sweep initiated using definitions version 567
18:58: Starting Memory Sweep
19:00: Memory Sweep Complete, Elapsed Time: 00:01:33
19:00: Starting Registry Sweep
19:00: Found Adware: 7adpower
19:00: HKCR\clsid\{b467a3af-e45b-4b1b-9983-c035d988fb0f}\ (27 subtraces) (ID = 102126)
19:00: HKCR\interface\{0ce29ba4-fd64-403e-a27e-1d12d819eaa6}\ (8 subtraces) (ID = 102132)
19:00: HKCR\interface\{4678a22a-18f4-4743-9575-6f1deea8a935}\ (8 subtraces) (ID = 102146)
19:00: HKLM\software\classes\clsid\{b467a3af-e45b-4b1b-9983-c035d988fb0f}\ (27 subtraces) (ID = 102183)
19:00: HKLM\software\classes\interface\{0ce29ba4-fd64-403e-a27e-1d12d819eaa6}\ (8 subtraces) (ID = 102190)
19:00: HKLM\software\classes\interface\{4678a22a-18f4-4743-9575-6f1deea8a935}\ (8 subtraces) (ID = 102206)
19:00: HKLM\software\classes\typelib\{9e36a1f1-8f72-43b1-a1d9-554a313228e8}\ (9 subtraces) (ID = 102221)
19:00: HKLM\software\classes\vacpro.belgio_ver10\ (3 subtraces) (ID = 102237)
19:00: HKCR\typelib\{9e36a1f1-8f72-43b1-a1d9-554a313228e8}\ (9 subtraces) (ID = 102266)
19:00: HKCR\vacpro.belgio_ver10\ (3 subtraces) (ID = 102282)
19:00: Found Adware: deskad
19:00: HKLM\software\deskad service\ (9 subtraces) (ID = 124927)
19:00: Found Adware: searchrelevancy
19:00: HKCR\interface\{300fa067-9b94-45cf-a30b-cb5221eeb0c3}\ (8 subtraces) (ID = 141290)
19:00: HKLM\software\classes\interface\{300fa067-9b94-45cf-a30b-cb5221eeb0c3}\ (8 subtraces) (ID = 141293)
19:00: HKLM\software\classes\typelib\{65a6bb6d-78d0-4e0a-824d-2de1e0d154af}\ (9 subtraces) (ID = 141295)
19:00: HKLM\software\classes\updater.bho\ (5 subtraces) (ID = 141297)
19:00: HKCR\typelib\{65a6bb6d-78d0-4e0a-824d-2de1e0d154af}\ (9 subtraces) (ID = 141302)
19:00: HKCR\updater.bho\ (5 subtraces) (ID = 141303)
19:00: Found Adware: winad
19:00: HKLM\software\windows adstatus\ (8 subtraces) (ID = 147240)
19:00: Found Adware: ist yoursitebar
19:00: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\conflict.1\ysbactivex.dll (ID = 762453)
19:00: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/mediagatewayx.dll\ (2 subtraces) (ID = 763026)
19:00: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\mediagatewayx.dll (ID = 763028)
19:00: Found Adware: targetsaver
19:00: HKU\S-1-5-21-2025429265-706699826-1060284298-1003\software\tsl2\ (1 subtraces) (ID = 143616)
19:00: Found Adware: exact navisearch
19:00: HKU\S-1-5-18\software\microsoft\windows\currentversion\run\ || nav auto updates (ID = 129128)
19:00: Found Adware: 180search assistant/zango
19:00: HKU\S-1-5-18\software\salm\ (16 subtraces) (ID = 135792)
19:00: Registry Sweep Complete, Elapsed Time:00:00:12
19:00: Starting Cookie Sweep
19:00: Found Spy Cookie: websponsors cookie
19:00: [email protected][2].txt (ID = 3665)
19:00: Found Spy Cookie: yieldmanager cookie
19:00: [email protected][2].txt (ID = 3751)
19:00: Found Spy Cookie: hbmediapro cookie
19:00: [email protected][2].txt (ID = 2768)
19:00: Found Spy Cookie: apmebf cookie
19:00: christophe@apmebf[2].txt (ID = 2229)
19:00: Found Spy Cookie: atlas dmt cookie
19:00: christophe@atdmt[1].txt (ID = 2253)
19:00: Found Spy Cookie: azjmp cookie
19:00: christophe@azjmp[2].txt (ID = 2270)
19:00: Found Spy Cookie: inet-traffic.com cookie
19:00: [email protected][2].txt (ID = 2856)
19:00: Found Spy Cookie: belnk cookie
19:00: christophe@belnk[1].txt (ID = 2292)
19:00: Found Spy Cookie: burstnet cookie
19:00: christophe@burstnet[2].txt (ID = 2336)
19:00: Found Spy Cookie: gostats cookie
19:00: [email protected][2].txt (ID = 2748)
19:00: [email protected][2].txt (ID = 2293)
19:00: Found Spy Cookie: metriweb.be cookie
19:00: christophe@metriweb[1].txt (ID = 2992)
19:00: Found Spy Cookie: 2o7.net cookie
19:00: [email protected][2].txt (ID = 1958)
19:00: Found Spy Cookie: paypopup cookie
19:00: christophe@paypopup[2].txt (ID = 3119)
19:00: [email protected][2].txt (ID = 3120)
19:00: Found Spy Cookie: qksrv cookie
19:00: christophe@qksrv[2].txt (ID = 3213)
19:00: Found Spy Cookie: realmedia cookie
19:00: christophe@realmedia[1].txt (ID = 3235)
19:00: Found Spy Cookie: rn11 cookie
19:00: christophe@rn11[2].txt (ID = 3261)
19:00: Found Spy Cookie: domain sponsor cookie
19:00: [email protected][1].txt (ID = 2534)
19:00: Found Spy Cookie: reliablestats cookie
19:00: [email protected][1].txt (ID = 3254)
19:00: Found Spy Cookie: tradedoubler cookie
19:00: christophe@tradedoubler[2].txt (ID = 3575)
19:00: Found Spy Cookie: xiti cookie
19:00: christophe@xiti[1].txt (ID = 3717)
19:00: Found Spy Cookie: yadro cookie
19:00: christophe@yadro[1].txt (ID = 3743)
19:00: Cookie Sweep Complete, Elapsed Time: 00:00:05
19:00: Starting File Sweep
19:00: Found Adware: effective-i toolbar
19:00: c:\program files\thesearchaccelerator (1 subtraces) (ID = -2147481059)
19:00: Found Adware: isearch desktop search
19:00: command.exe (ID = 144946)
19:01: 113_dollarrevenue_4_0_3_9[1].exe (ID = 166444)
19:01: tsupdate[1].ini (ID = 112322)
19:01: ysb[1].dll (ID = 161559)
19:01: Found Adware: ist istbar
19:01: 0006_regular[1].cab (ID = 64478)
19:01: backup-20051104-180203-232.dll (ID = 159757)
19:01: tsinstall_4_0_3_8_b17.exe (ID = 78267)
19:02: Found Adware: whenu save
19:02: saveinstwm.exe (ID = 74391)
19:02: Found Adware: whenu savenow
19:02: vvsninst.exe (ID = 74460)
19:02: 113_dollarrevenue_4_0_3_9.exe (ID = 166444)
19:02: Found Adware: sp2ms
19:02: drsmartload.exe (ID = 178567)
19:02: Found Adware: surf accuracy
19:02: sacc.prod.v1116.20oct2005.exe[1] (ID = 180326)
19:02: sacc[1].cfg (ID = 162775)
19:02: Found Adware: powerscan
19:02: power_remove[1].exe (ID = 72675)
19:02: uninstaller.prod.24oct2005.exe[1] (ID = 180136)
19:02: tsupdate_4_0_3_9_b2.exe (ID = 78281)
19:02: istrecover[1].exe (ID = 64496)
19:02: sacc_remove[1].exe (ID = 107476)
19:02: belgio_ver10[1].cab (ID = 48419)
19:02: Found Adware: ist sidefind
19:02: sidefind[1].exe (ID = 107461)
19:02: powerscan[1].exe (ID = 72679)
19:02: istsvc[1].exe (ID = 107294)
19:03: Found Adware: exact cashback/bargain buddy
19:03: bb[1].exe (ID = 50567)
19:03: Found Adware: moneytree
19:03: nem220[1].dll (ID = 64043)
19:03: ysb[1].dll (ID = 91036)
19:03: sacc[1].exe (ID = 110372)
19:03: sidefind13[1].dll (ID = 76049)
19:03: sfbho13[1].dll (ID = 76029)
19:03: belgio_ver10.ocx (ID = 48421)
19:03: Found Adware: shopathomeselect
19:03: bunsetup.cab (ID = 75706)
19:04: glf35glf35.exe (ID = 166444)
19:04: glf8glf8.exe (ID = 78276)
19:05: belgio_ver10.inf (ID = 48420)
19:05: Found Adware: atlas offeragent
19:05: offeragent[1].exe (ID = 109956)
19:06: Found Adware: look2me
19:06: enr0l19m1.dll (ID = 163672)
19:06: package_marketing27[1].exe (ID = 110382)
19:06: ucmoreiex.exe (ID = 59853)
19:06: mediagateway[1].exe (ID = 161149)
19:07: ucmtsaie.dll (ID = 106574)
19:07: ucmoreiex[1].exe (ID = 59853)
19:07: installer.exe (ID = 168558)
19:07: uninstall.exe (ID = 72675)
19:07: istdownload[1].exe (ID = 158575)
19:07: istrecover[1].exe (ID = 64496)
19:07: sacc.prod.v1110.07sep2005.exe[1] (ID = 146926)
19:07: uninstaller.prod.21sep2005.exe[1] (ID = 156655)
19:07: Found Adware: internetoptimizer
19:07: optimize[1].exe (ID = 159920)
19:07: sidefind[1].exe (ID = 154905)
19:07: powerscan[1].exe (ID = 72679)
19:08: drsmartload[1].exe (ID = 178567)
19:08: sfbho13[1].dll (ID = 157821)
19:08: ysbactivex.dll (ID = 181444)
19:08: installer[1].exe (ID = 168558)
19:08: sidefind13[1].dll (ID = 157822)
19:11: Found System Monitor: msn sniffer
19:11: msnsniffer_trial_setup.exe (ID = 135536)
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Unhandled Archive Type
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:16: Warning: Invalid file - not a PKZip file
19:17: Warning: Unhandled Archive Type
19:17: Warning: Invalid file - not a PKZip file
19:17: Warning: Invalid file - not a PKZip file
19:17: Warning: Invalid file - not a PKZip file
19:17: Warning: Invalid file - not a PKZip file
19:17: Warning: Invalid file - not a PKZip file
19:17: Warning: Invalid file - not a PKZip file
19:17: Warning: Invalid file - not a PKZip file
19:17: Warning: Invalid file - not a PKZip file
19:17: Warning: Invalid file - not a PKZip file
19:18: Warning: Invalid file - not a PKZip file
19:18: Warning: Invalid file - not a PKZip file
19:19: Warning: Invalid file - not a PKZip file
19:22: File Sweep Complete, Elapsed Time: 00:22:04
19:22: Full Sweep has completed. Elapsed time 00:23:59
19:22: Traces Found: 294
19:50: Removal process initiated
19:50: Quarantining All Traces: 180search assistant/zango
19:50: Quarantining All Traces: isearch desktop search
19:50: Quarantining All Traces: ist istbar
19:50: Quarantining All Traces: look2me
19:50: Quarantining All Traces: msn sniffer
19:50: Quarantining All Traces: internetoptimizer
19:50: Quarantining All Traces: sp2ms
19:50: Quarantining All Traces: 7adpower
19:50: Quarantining All Traces: atlas offeragent
19:50: Quarantining All Traces: deskad
19:50: Quarantining All Traces: effective-i toolbar
19:50: Quarantining All Traces: exact cashback/bargain buddy
19:50: Quarantining All Traces: exact navisearch
19:50: Quarantining All Traces: ist sidefind
19:50: Quarantining All Traces: ist yoursitebar
19:50: Quarantining All Traces: moneytree
19:50: Quarantining All Traces: powerscan
19:50: Quarantining All Traces: searchrelevancy
19:50: Quarantining All Traces: shopathomeselect
19:50: Quarantining All Traces: surf accuracy
19:50: Quarantining All Traces: targetsaver
19:51: Quarantining All Traces: whenu savenow
19:51: Quarantining All Traces: whenu save
19:51: Quarantining All Traces: winad
19:51: Quarantining All Traces: 2o7.net cookie
19:51: Quarantining All Traces: apmebf cookie
19:51: Quarantining All Traces: atlas dmt cookie
19:51: Quarantining All Traces: azjmp cookie
19:51: Quarantining All Traces: belnk cookie
19:51: Quarantining All Traces: burstnet cookie
19:51: Quarantining All Traces: domain sponsor cookie
19:51: Quarantining All Traces: gostats cookie
19:51: Quarantining All Traces: hbmediapro cookie
19:51: Quarantining All Traces: inet-traffic.com cookie
19:51: Quarantining All Traces: metriweb.be cookie
19:51: Quarantining All Traces: paypopup cookie
19:51: Quarantining All Traces: qksrv cookie
19:51: Quarantining All Traces: realmedia cookie
19:51: Quarantining All Traces: reliablestats cookie
19:51: Quarantining All Traces: rn11 cookie
19:51: Quarantining All Traces: tradedoubler cookie
19:51: Quarantining All Traces: websponsors cookie
19:51: Quarantining All Traces: xiti cookie
19:51: Quarantining All Traces: yadro cookie
19:51: Quarantining All Traces: yieldmanager cookie
19:51: Removal process completed. Elapsed time 00:00:49
********
18:57: | Start of Session, vrijdag 4 november 2005 |
18:57: Spy Sweeper started
18:57: Messenger service has been disabled.
18:58: Your spyware definitions have been updated.
18:58: | End of Session, vrijdag 4 november 2005 |

* Download L2mfix op een van deze links:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Bewaar het bestand op het bureablad en dubbelklik l2mfix.exe. Klik op de Install knop en volg de instructies. Open de l2mfix map die nu op het bureaublad staat. Dubbelklik l2mfix.bat en selecteer optie #1 voor Run Find Log (typ 1 en vervolgens enter) De PC wordt gescand. Na ongeveer 2 minuten zal er een kladblokbestand openen. Kopieer de inhoud van dit logje en post het hier.

BELANGRIJK: Selecteer optie 2 NIET zolang dit niet gevraagd wordt !!!!

* Post ook nog een nieuw HJT log aub

Logje:
L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read INGEBOUWD\Gebruikers
(ID-IO) ALLOW Read INGEBOUWD\Gebruikers
(ID-NI) ALLOW Read INGEBOUWD\Hoofdgebruikers
(ID-IO) ALLOW Read INGEBOUWD\Hoofdgebruikers
(ID-NI) ALLOW Full access INGEBOUWD\Administrators
(ID-IO) ALLOW Full access INGEBOUWD\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access MAKER EIGENAAR


**********************************************************************************
useragent:
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Eigenschappenvenster van multimediabestand"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-scannerbeheer"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Het tabblad Beveiliging"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Eigenschappenblad voor OLE-docbestand"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell-uitbreidingen voor delen"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Beeldschermadapter"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Monitor"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Beeldscherm-panning"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Het tabblad Beveiliging"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibiliteitspagina"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Knipselgegevensverwerker van shell"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Schijfkopieer-uitbreiding"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell-uitbreidingen voor Microsoft Windows Network-objecten"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-monitorbeheer"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-printerbeheer"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell-uitbreidingen voor bestandscompressie"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Shell-uitbreiding voor Web Printer"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Snelmenu Codering"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Werkmap"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal-pictogramuitbreiding"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profiel"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Het tabblad Beveiliging voor printers"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell-uitbreidingen voor delen"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-extensie"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto-handtekeningextensie"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netwerkverbindingen"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Netwerkverbindingen"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners en camera's"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners en camera's"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners en camera's"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners en camera's"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners en camera's"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell-uitbreidingen voor Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Geplande taken"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taakbalk en menu Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Zoeken"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help en ondersteuning"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help en ondersteuning"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uitvoeren..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Lettertypen"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Systeembeheer"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet-werkbalk"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Downloadstatus"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Uitgebreide shell-map"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Uitgebreide shell-map 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft-browserbalk"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Zoekbalk"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Mediabalk"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Zoeken binnen deelvenster"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Zoeken op het web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Hulpprogramma met opties voor registerboomstructuur"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoAanvullen"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU-lijst voor AutoAanvullen"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Aangepaste MRU-lijst voor AutoAanvullen"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Toegankelijk"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Pop-upbalk Volgen"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Parser voor adresbalk"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lijst voor AutoAanvullen: Microsoft Geschiedenis"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lijst voor AutoAanvullen: Microsoft Shell-map"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft-container met meervoudige lijst voor AutoAanvullen"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Sitemenu van shell-band"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Gebruikersondersteuning"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globale mapinstellingen"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url-geschiedenisservice"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Geschiedenis"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tijdelijke Internet-bestanden"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tijdelijke Internet-bestanden"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url-zoeken Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite-welkomstscherm"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Het Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Cachemap van ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Map met abonnementen"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Toepassingsbeheer"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Programma voor inventarisatie van ge‹nstalleerde toepassingen"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI- en bestandsextractieprogramma voor miniaturen"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informatie over de handler voor miniatuurweergaven (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML-extractie voor miniatuurweergaven"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Wizard Webpublicaties"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Afdrukken via het web bestellen"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell-object voor publicatiewizard"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Wizard Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Gebruikersaccounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanaal-bestand"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Kanaal-snelkoppeling"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Handler-object voor kanalen"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Map Off line bestanden"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Personen..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{E976844F-E7A7-41E1-B7DF-6FDC48AE2C57}"="MJ2Desc Shell Extension"
"{B8323370-FF27-11D2-97B6-204C4F4F5020}"="SmartFTP Shell Extension DLL"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Webmappen"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:
Locate .tmp files:
**********************************************************************************
Directory Listing of system files:
Het volume in station C heeft geen naam.
Het volumenummer is 7003-47E7

Map van C:\WINDOWS\System32

04/11/2005 18:44 <DIR> dllcache
04/11/2005 18:05 234.645 guard.tmp
04/11/2005 17:45 234.645 fppo0373e.dll
01/02/2005 16:24 <DIR> Microsoft
2 bestand(en) 469.290 bytes
2 map(pen) 9.755.361.280 bytes beschikbaar



Hijack this log:
Logfile of HijackThis v1.99.1
Scan saved at 20:25:07, on 4/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\Rar$EX00.442\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [orfm] C:\PROGRA~1\COMMON~1\orfm\orfmm.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1107274053192
O16 - DPF: {B467A3AF-E45B-4B1B-9983-C035D988FB0F} - http://advnt01.com/dialer/belgio_ver10.CAB
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Sluit alle programma's, dit gedeelte vereist een heropstart van de PC.

Open de l2mfix map op je bureaublad en dubbelklik op l2mfix.bat. Kies optie #2 Run Fix (typ 2 en vervolgens enter). Druk op een toets om de PC te herstarten. Het is mogelijk dat na de herstart het bureaublad en de icoontjes verdwijnen. L2mfix zal nu de PC verder scannen. Na de scan verschijnt er een kladblokbestand. Kopieer de inhoud van dit bestand en post het in deze thread samen met een nieuw HJT log.

BELANGRIJK: Run geen andere bestanden in de L2mfix map zolang dit niet gevraagd wordt!
Indien na de herstart de icoontjes niet verdwijnen of de log verschijnt niet: dubbelklik dan op het second.bat bestand om verder te gaan met de fix.

Voila:

Hieronder de log die ik kreeg na de herstart:

Setting Directory
C:\
C:\
System Rebooted!

Running From:
C:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1648 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1672 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\fppo0373e.dll
1 bestand(en) gekopieerd.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 bestand(en) gekopieerd.
deleting: C:\WINDOWS\system32\fppo0373e.dll
Successfully Deleted: C:\WINDOWS\system32\fppo0373e.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp


Zipping up files for submission:
adding: fppo0373e.dll (188 bytes security) (deflated 4%)
adding: guard.tmp (188 bytes security) (deflated 4%)
adding: clear.reg (188 bytes security) (deflated 2%)
adding: lo2.txt (188 bytes security) (deflated 61%)
adding: LuResult.txt (188 bytes security) (deflated 11%)
adding: test.txt (188 bytes security) (deflated 30%)
adding: test2.txt (188 bytes security) (stored 0%)
adding: test3.txt (188 bytes security) (stored 0%)
adding: test5.txt (188 bytes security) (stored 0%)
adding: xfind.txt (188 bytes security) (deflated 24%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read INGEBOUWD\Gebruikers
(ID-IO) ALLOW Read INGEBOUWD\Gebruikers
(ID-NI) ALLOW Read INGEBOUWD\Hoofdgebruikers
(ID-IO) ALLOW Read INGEBOUWD\Hoofdgebruikers
(ID-NI) ALLOW Full access INGEBOUWD\Administrators
(ID-IO) ALLOW Full access INGEBOUWD\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access MAKER EIGENAAR


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

Restoring Windows Update Certificates.:

deleting local copy: fppo0373e.dll
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\fppo0373e.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
************************************************************************
****



Hier een nieuwe Hijack log

Logfile of HijackThis v1.99.1
Scan saved at 13:04:16, on 5/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\Rar$EX00.396\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [orfm] C:\PROGRA~1\COMMON~1\orfm\orfmm.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1107274053192
O16 - DPF: {B467A3AF-E45B-4B1B-9983-C035D988FB0F} - http://advnt01.com/dialer/belgio_ver10.CAB
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe


Nog slechte dingen die moeten verwijderd worden?

* Je hebt HijackThis gestart vanuit je Temp-map. HijackThis maakt backups van de sleutels die je verwijdert. In je Temp-map gaan deze backups heel makkelijk verloren. Verplaats daarom Hijacktis.exe naar een eigen map (vb.: c:\hijackthis) en start HijackThis vanuit die map.

* Start HJT, scan en vink volgende items aan:
O16 - DPF: {B467A3AF-E45B-4B1B-9983-C035D988FB0F} - http://advnt01.com/dialer/belgio_ver10.CAB

Kan je eens even volgend bestand laten scannen op jotti? http://virusscan.jotti.org/
C:\Program Files\Common Files\orfm\orfmm.exe

Sla het rapportje op en post het hier.

Zoals gevraagd:

Nieuwe HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 14:07:02, on 5/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Christophe\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [orfm] C:\PROGRA~1\COMMON~1\orfm\orfmm.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1107274053192
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe


Volgend bestand: C:\Program Files\Common Files\orfm\orfmm.exe
vind ik echter wel niet op mijn harde schijf, ik heb er hem eens laten naar zoeken ook en geen resultaat.

Het zou toch ergens op de PC moeten staan.

Maak eerst de verborgen bestanden zichtbaar:
Ga naar Start en klik op Deze computer.
In de menubalk selecteer je Extra en dan Mapopties.
Selecteer de tab Weergave.
Bij Verborgen bestanden en mappen selecteer je Verborgen bestanden en mappen weergeven.
Bij Bestanden en mappen haal je het vinkje weg bij: Beveiligde besturingssysteembestanden verbergen (aanbevolen).
Klik op Ja om dit te bevestigen.
Klik op OK.

Zoek dan opnieuw naar het bestand.

Ik heb beide acties gedaan en opnieuw gezocht naar het bestand, echter zonder resultaat.
Zou het kunnen dat het bestand reeds verwijderd is, als ik echter uitvoeren - msconfig doe staat het nog bij opstarten aangevinkt.
Ik heb het daar uitgevinkt en nieuwe hijackthis log gemaakt:

Logfile of HijackThis v1.99.1
Scan saved at 10:47:59, on 6/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Christophe\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1107274053192
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Dit logje ziet er prima uit!

Nog enkele tips om de PC clean te houden in de toekomst:

* Gebruik een AntiVirus programma - Het is erg belangrijk dat er een antivirus programma op uw computer draait. Dit alleen kan al een hoop problemen in de toekomst voorkomen.

Dit zijn twee goede (gratis) antivirusprogramma's:
- AVG
- Avast

Dit zijn twee goede online virusscanners:
- Housecall
- Bitdefender

* Update uw antivirussoftware - Het is erg belangrijk dat u uw antivirus software minstens 1 keer per week update (Het liefst vaker). Als u uw antivirus software niet up-to-date houdt is het niet meer in staat om de nieuwste varianten te herkennen/verwijderen.

* Gebruik een Firewall - Ook de firewall is een erg belangrijk onderdeel voor uw computer. Zonder een firewall staat uw computer open voor hackers en kan de computer door hackers worden overgenomen.

Dit zijn een aantal goede (gratis) firewalls:
- Sygate Personal Firewall
- ZoneAlarm
- Outpost Personal Firewall
- Kerio Personal Firewall

* Bezoek regelmatig de Microsoft's Windows Update Site - Het is belangrijk dat u deze site regelmatig bezoekt. Dit verzekert u ervan dat uw computer altijd de laatste beveiligingsupdates bevat. Als er nieuwe updates zijn, installeer ze dan direct, start uw computer opnieuw op, en bezoek de site opnieuw om te kijken of er nog meer updates geïnstalleerd kunnen worden.

* Installeer Spybot - Search and Destroy - Installeer en download Spybot - Search and Destroy met de Teatimer optie. Dit zal, naast uw virusbescherming, real time spyware & hijacker bescherming op uw computer bieden.

* Installeer Ad-Aware - Download en Installeer Ad-Aware.

* Installeer SpywareBlaster - Het programma houdt alle pop-ups tegen, waardoor de kans kleiner is dat softwarespionnen zich via een webpagina installeren. Het blokkeert ook een groot aantal bekende malafide websites.

* Update al deze programma's regelmatig - Update alle programma's die aangeraden zijn. Zonder regelmatige updates zult u niet beschermd zijn wanneer er nieuwe verdachte programma's uitkomen.

Heel hartelijk bedankt voor alle hulp en tips Jownz.

Met plezier!

Jownz zei:

Dit logje ziet er prima uit!

Nog enkele tips om de PC clean te houden in de toekomst:

* Gebruik een AntiVirus programma - Het is erg belangrijk dat er een antivirus programma op uw computer draait. Dit alleen kan al een hoop problemen in de toekomst voorkomen.

Dit zijn twee goede (gratis) antivirusprogramma's:
- AVG
- Avast

Dit zijn twee goede online virusscanners:
- Housecall
- Bitdefender

* Update uw antivirussoftware - Het is erg belangrijk dat u uw antivirus software minstens 1 keer per week update (Het liefst vaker). Als u uw antivirus software niet up-to-date houdt is het niet meer in staat om de nieuwste varianten te herkennen/verwijderen.

* Gebruik een Firewall - Ook de firewall is een erg belangrijk onderdeel voor uw computer. Zonder een firewall staat uw computer open voor hackers en kan de computer door hackers worden overgenomen.

Dit zijn een aantal goede (gratis) firewalls:
- Sygate Personal Firewall
- ZoneAlarm
- Outpost Personal Firewall
- Kerio Personal Firewall

* Bezoek regelmatig de Microsoft's Windows Update Site - Het is belangrijk dat u deze site regelmatig bezoekt. Dit verzekert u ervan dat uw computer altijd de laatste beveiligingsupdates bevat. Als er nieuwe updates zijn, installeer ze dan direct, start uw computer opnieuw op, en bezoek de site opnieuw om te kijken of er nog meer updates geïnstalleerd kunnen worden.

* Installeer Spybot - Search and Destroy - Installeer en download Spybot - Search and Destroy met de Teatimer optie. Dit zal, naast uw virusbescherming, real time spyware & hijacker bescherming op uw computer bieden.

* Installeer Ad-Aware - Download en Installeer Ad-Aware.

* Installeer SpywareBlaster - Het programma houdt alle pop-ups tegen, waardoor de kans kleiner is dat softwarespionnen zich via een webpagina installeren. Het blokkeert ook een groot aantal bekende malafide websites.

* Update al deze programma's regelmatig - Update alle programma's die aangeraden zijn. Zonder regelmatige updates zult u niet beschermd zijn wanneer er nieuwe verdachte programma's uitkomen.

Klik om te vergroten...

Ik vind het best zielig wat je allemaal niet moet draaien hebben om je "EIGEN" pc veilig te houden.... Door al die programmas gaat je pc zoveel trager gaan...

Van mij moet je niks hoor...

Het is echter wel aan te raden. En wat snelheid betreft, dat valt best mee vind ik persoonlijk. Niet alle programma's draaien constant.