Archief - purityscan

math · 31 jul 2006

telkens als ik mijn pc aanzet start er een progamma ( purityscan ) op. Ik heb gezocht op het internet en blijkbaar is dit een programma dat pop-ups veroorzaakt. Ik heb al eens gescand met hitman pro en ad-adware, maar het programma verschijnt elke keer opnieuw. hoe kan ik het voledig verwijderen?

Logfile of HijackThis v1.99.1
Scan saved at 19:43:29, on 31/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRAM FILES\IPWINS\IPWINS.EXE
C:\PROGRAM FILES\COMMON FILES\{807CABC5-077B-2067-1204-031229030020}\UPDATE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\XPAGENT.EXE
C:\DOCUMENTS AND SETTINGS\PAUL YSEBAERT\APPLICATION DATA\S?CURITY\J?VAW.EXE
C:\WINDOWS\SSTEM3~1\services.exe
C:\WINDOWS\SYSTEM32\MSJTES40.EXE
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\TClock\TClock.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXE
C:\WINDOWS\system32\UAService7.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPFW.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\VALVE\STEAM\STEAM.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.telenet.be
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {12BC3DD7-D410-AFEC-3727-FB6A16DE8DEE} - C:\WINDOWS\system32\dnpmhaf.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG

ystem.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: Antifraudewerkbalk van Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12BC3DD7-D410-AFEC-3727-FB6A16DE8DEE} - C:\WINDOWS\system32\dnpmhaf.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: Antifraudewerkbalk van Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [nwkbula] c:\windows\system32\sfuobmb.exe r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [XPAgent] C:\WINDOWS\SYSTEM32\XPAGENT.EXE
O4 - HKCU\..\Run: [clbcatq] "C:\WINDOWS\system32\clbcatq.exe"
O4 - HKCU\..\Run: [mfc42u] "C:\WINDOWS\system32\mfc42u.exe"
O4 - HKCU\..\Run: [webcheck] "C:\WINDOWS\system32\webcheck.exe"
O4 - HKCU\..\Run: [wshatm] "C:\WINDOWS\system32\wshatm.exe"
O4 - HKCU\..\Run: [rasmontr] "C:\WINDOWS\system32\rasmontr.exe"
O4 - HKCU\..\Run: [mciavi32] "C:\WINDOWS\system32\mciavi32.exe"
O4 - HKCU\..\Run: [perfnet] "C:\WINDOWS\system32\perfnet.exe"
O4 - HKCU\..\Run: [comaddin] "C:\WINDOWS\system32\comaddin.exe"
O4 - HKCU\..\Run: [xfire_lsp_10650] "C:\WINDOWS\system32\xfire_lsp_10650.exe"
O4 - HKCU\..\Run: [vtdisp] "C:\WINDOWS\system32\vtdisp.exe"
O4 - HKCU\..\Run: [msls31] "C:\WINDOWS\system32\msls31.exe"
O4 - HKCU\..\Run: [atl71] "C:\WINDOWS\system32\atl71.exe"
O4 - HKCU\..\Run: [adsldpc] "C:\WINDOWS\system32\adsldpc.exe"
O4 - HKCU\..\Run: [lz32] "C:\WINDOWS\system32\lz32.exe"
O4 - HKCU\..\Run: [browsewm] "C:\WINDOWS\system32\browsewm.exe"
O4 - HKCU\..\Run: [odbccp32] "C:\WINDOWS\system32\odbccp32.exe"
O4 - HKCU\..\Run: [termmgr] "C:\WINDOWS\system32\termmgr.exe"
O4 - HKCU\..\Run: [netrap] "C:\WINDOWS\system32\netrap.exe"
O4 - HKCU\..\Run: [mag_hook] "C:\WINDOWS\system32\mag_hook.exe"
O4 - HKCU\..\Run: [sxs] "C:\WINDOWS\system32\sxs.exe"
O4 - HKCU\..\Run: [rasauto] "C:\WINDOWS\system32\rasauto.exe"
O4 - HKCU\..\Run: [umandlg] "C:\WINDOWS\system32\umandlg.exe"
O4 - HKCU\..\Run: [odbcint] "C:\WINDOWS\system32\odbcint.exe"
O4 - HKCU\..\Run: [ati2dvaa] "C:\WINDOWS\system32\ati2dvaa.exe"
O4 - HKCU\..\Run: [winsrv] "C:\WINDOWS\system32\winsrv.exe"
O4 - HKCU\..\Run: [pstorec] "C:\WINDOWS\system32\pstorec.exe"
O4 - HKCU\..\Run: [sqlwid] "C:\WINDOWS\system32\sqlwid.exe"
O4 - HKCU\..\Run: [mssign32] "C:\WINDOWS\system32\mssign32.exe"
O4 - HKCU\..\Run: [mfc70] "C:\WINDOWS\system32\mfc70.exe"
O4 - HKCU\..\Run: [olepro32] "C:\WINDOWS\system32\olepro32.exe"
O4 - HKCU\..\Run: [webvw] "C:\WINDOWS\system32\webvw.exe"
O4 - HKCU\..\Run: [powrprof] "C:\WINDOWS\system32\powrprof.exe"
O4 - HKCU\..\Run: [msrecr40] "C:\WINDOWS\system32\msrecr40.exe"
O4 - HKCU\..\Run: [kbdfc] "C:\WINDOWS\system32\kbdfc.exe"
O4 - HKCU\..\Run: [nddeapi] "C:\WINDOWS\system32\nddeapi.exe"
O4 - HKCU\..\Run: [certcli] "C:\WINDOWS\system32\certcli.exe"
O4 - HKCU\..\Run: [shimgvw] "C:\WINDOWS\system32\shimgvw.exe"
O4 - HKCU\..\Run: [kbdtuf] "C:\WINDOWS\system32\kbdtuf.exe"
O4 - HKCU\..\Run: [danim] "C:\WINDOWS\system32\danim.exe"
O4 - HKCU\..\Run: [secur32] "C:\WINDOWS\system32\secur32.exe"
O4 - HKCU\..\Run: [mscories] "C:\WINDOWS\system32\mscories.exe"
O4 - HKCU\..\Run: [fxsperf] "C:\WINDOWS\system32\fxsperf.exe"
O4 - HKCU\..\Run: [kbdus] "C:\WINDOWS\system32\kbdus.exe"
O4 - HKCU\..\Run: [symredir] "C:\WINDOWS\system32\symredir.exe"
O4 - HKCU\..\Run: [ulib] "C:\WINDOWS\system32\ulib.exe"
O4 - HKCU\..\Run: [shlwapi] "C:\WINDOWS\system32\shlwapi.exe"
O4 - HKCU\..\Run: [mswebdvd] "C:\WINDOWS\system32\mswebdvd.exe"
O4 - HKCU\..\Run: [msnetobj] "C:\WINDOWS\system32\msnetobj.exe"
O4 - HKCU\..\Run: [wuaueng1] "C:\WINDOWS\system32\wuaueng1.exe"
O4 - HKCU\..\Run: [licmgr10] "C:\WINDOWS\system32\licmgr10.exe"
O4 - HKCU\..\Run: [vticd] "C:\WINDOWS\system32\vticd.exe"
O4 - HKCU\..\Run: [wmadmod] "C:\WINDOWS\system32\wmadmod.exe"
O4 - HKCU\..\Run: [mciole16] "C:\WINDOWS\system32\mciole16.exe"
O4 - HKCU\..\Run: [wuauserv] "C:\WINDOWS\system32\wuauserv.exe"
O4 - HKCU\..\Run: [olesvr] "C:\WINDOWS\system32\olesvr.exe"
O4 - HKCU\..\Run: [shdoclc] "C:\WINDOWS\system32\shdoclc.exe"
O4 - HKCU\..\Run: [mtxlegih] "C:\WINDOWS\system32\mtxlegih.exe"
O4 - HKCU\..\Run: [usrdpa] "C:\WINDOWS\system32\usrdpa.exe"
O4 - HKCU\..\Run: [mswmdm] "C:\WINDOWS\system32\mswmdm.exe"
O4 - HKCU\..\Run: [wmvdmoe] "C:\WINDOWS\system32\wmvdmoe.exe"
O4 - HKCU\..\Run: [jobexec] "C:\WINDOWS\system32\jobexec.exe"
O4 - HKCU\..\Run: [xgate] "C:\WINDOWS\system32\xgate.exe"
O4 - HKCU\..\Run: [icm32] "C:\WINDOWS\system32\icm32.exe"
O4 - HKCU\..\Run: [wmerrnld] "C:\WINDOWS\system32\wmerrnld.exe"
O4 - HKCU\..\Run: [wdigest] "C:\WINDOWS\system32\wdigest.exe"
O4 - HKCU\..\Run: [wmspdmod] "C:\WINDOWS\system32\wmspdmod.exe"
O4 - HKCU\..\Run: [eax] "C:\WINDOWS\system32\eax.exe"
O4 - HKCU\..\Run: [catsrvps] "C:\WINDOWS\system32\catsrvps.exe"
O4 - HKCU\..\Run: [dplayx] "C:\WINDOWS\system32\dplayx.exe"
O4 - HKCU\..\Run: [usrvpa] "C:\WINDOWS\system32\usrvpa.exe"

math · 31 jul 2006

O4 - HKCU\..\Run: [legitcheckcontrol] "C:\WINDOWS\system32\legitcheckcontrol.exe"
O4 - HKCU\..\Run: [umpnpmgr] "C:\WINDOWS\system32\umpnpmgr.exe"
O4 - HKCU\..\Run: [ptpusd] "C:\WINDOWS\system32\ptpusd.exe"
O4 - HKCU\..\Run: [mindex] "C:\WINDOWS\system32\mindex.exe"
O4 - HKCU\..\Run: [tsd32] "C:\WINDOWS\system32\tsd32.exe"
O4 - HKCU\..\Run: [ntmsapi] "C:\WINDOWS\system32\ntmsapi.exe"
O4 - HKCU\..\Run: [dpvvox] "C:\WINDOWS\system32\dpvvox.exe"
O4 - HKCU\..\Run: [scrobj] "C:\WINDOWS\system32\scrobj.exe"
O4 - HKCU\..\Run: [msvcrt20] "C:\WINDOWS\system32\msvcrt20.exe"
O4 - HKCU\..\Run: [msimtf] "C:\WINDOWS\system32\msimtf.exe"
O4 - HKCU\..\Run: [dpnhupnp] "C:\WINDOWS\system32\dpnhupnp.exe"
O4 - HKCU\..\Run: [rasrad] "C:\WINDOWS\system32\rasrad.exe"
O4 - HKCU\..\Run: [msdtcprx] "C:\WINDOWS\system32\msdtcprx.exe"
O4 - HKCU\..\Run: [usrdtea] "C:\WINDOWS\system32\usrdtea.exe"
O4 - HKCU\..\Run: [msltus40] "C:\WINDOWS\system32\msltus40.exe"
O4 - HKCU\..\Run: [msisip] "C:\WINDOWS\system32\msisip.exe"
O4 - HKCU\..\Run: [dpwsock] "C:\WINDOWS\system32\dpwsock.exe"
O4 - HKCU\..\Run: [dpwsockx] "C:\WINDOWS\system32\dpwsockx.exe"
O4 - HKCU\..\Run: [dbnmpntw] "C:\WINDOWS\system32\dbnmpntw.exe"
O4 - HKCU\..\Run: [mucltui] "C:\WINDOWS\system32\mucltui.exe"
O4 - HKCU\..\Run: [lmhsvc] "C:\WINDOWS\system32\lmhsvc.exe"
O4 - HKCU\..\Run: [qcap] "C:\WINDOWS\system32\qcap.exe"
O4 - HKCU\..\Run: [rdpwsx] "C:\WINDOWS\system32\rdpwsx.exe"
O4 - HKCU\..\Run: [dgrpsetu] "C:\WINDOWS\system32\dgrpsetu.exe"
O4 - HKCU\..\Run: [licwmi] "C:\WINDOWS\system32\licwmi.exe"
O4 - HKCU\..\Run: [tapi] "C:\WINDOWS\system32\tapi.exe"
O4 - HKCU\..\Run: [hypertrm] "C:\WINDOWS\system32\hypertrm.exe"
O4 - HKCU\..\Run: [wshrm] "C:\WINDOWS\system32\wshrm.exe"
O4 - HKCU\..\Run: [xenroll] "C:\WINDOWS\system32\xenroll.exe"
O4 - HKCU\..\Run: [racpldlg] "C:\WINDOWS\system32\racpldlg.exe"
O4 - HKCU\..\Run: [ipxpromn] "C:\WINDOWS\system32\ipxpromn.exe"
O4 - HKCU\..\Run: [nvrssl] "C:\WINDOWS\system32\nvrssl.exe"
O4 - HKCU\..\Run: [certmgr] "C:\WINDOWS\system32\certmgr.exe"
O4 - HKCU\..\Run: [kbdhe319] "C:\WINDOWS\system32\kbdhe319.exe"
O4 - HKCU\..\Run: [wmpcore] "C:\WINDOWS\system32\wmpcore.exe"
O4 - HKCU\..\Run: [scrrnnl] "C:\WINDOWS\system32\scrrnnl.exe"
O4 - HKCU\..\Run: [ceutil] "C:\WINDOWS\system32\ceutil.exe"
O4 - HKCU\..\Run: [icmp] "C:\WINDOWS\system32\icmp.exe"
O4 - HKCU\..\Run: [colbact] "C:\WINDOWS\system32\colbact.exe"
O4 - HKCU\..\Run: [kbdusl] "C:\WINDOWS\system32\kbdusl.exe"
O4 - HKCU\..\Run: [ipmontr] "C:\WINDOWS\system32\ipmontr.exe"
O4 - HKCU\..\Run: [duser] "C:\WINDOWS\system32\duser.exe"
O4 - HKCU\..\Run: [javaprxy] "C:\WINDOWS\system32\javaprxy.exe"
O4 - HKCU\..\Run: [polstore] "C:\WINDOWS\system32\polstore.exe"
O4 - HKCU\..\Run: [webclnt] "C:\WINDOWS\system32\webclnt.exe"
O4 - HKCU\..\Run: [vcdex] "C:\WINDOWS\system32\vcdex.exe"
O4 - HKCU\..\Run: [asferror] "C:\WINDOWS\system32\asferror.exe"
O4 - HKCU\..\Run: [dpnet] "C:\WINDOWS\system32\dpnet.exe"
O4 - HKCU\..\Run: [msvfw32] "C:\WINDOWS\system32\msvfw32.exe"
O4 - HKCU\..\Run: [d3d8] "C:\WINDOWS\system32\d3d8.exe"
O4 - HKCU\..\Run: [spmsg] "C:\WINDOWS\system32\spmsg.exe"
O4 - HKCU\..\Run: [wmpdxm] "C:\WINDOWS\system32\wmpdxm.exe"
O4 - HKCU\..\Run: [wldap32] "C:\WINDOWS\system32\wldap32.exe"
O4 - HKCU\..\Run: [sens] "C:\WINDOWS\system32\sens.exe"
O4 - HKCU\..\Run: [winsysmwappio5] "C:\WINDOWS\system32\winsysmwappio5.exe"
O4 - HKCU\..\Run: [odbccr32] "C:\WINDOWS\system32\odbccr32.exe"
O4 - HKCU\..\Run: [dpnlobby] "C:\WINDOWS\system32\dpnlobby.exe"
O4 - HKCU\..\Run: [xpsp1res] "C:\WINDOWS\system32\xpsp1res.exe"
O4 - HKCU\..\Run: [nwprovau] "C:\WINDOWS\system32\nwprovau.exe"
O4 - HKCU\..\Run: [termsrv] "C:\WINDOWS\system32\termsrv.exe"
O4 - HKCU\..\Run: [encdec] "C:\WINDOWS\system32\encdec.exe"
O4 - HKCU\..\Run: [rapi] "C:\WINDOWS\system32\rapi.exe"
O4 - HKCU\..\Run: [kbdukx] "C:\WINDOWS\system32\kbdukx.exe"
O4 - HKCU\..\Run: [ils] "C:\WINDOWS\system32\ils.exe"
O4 - HKCU\..\Run: [kbdmac] "C:\WINDOWS\system32\kbdmac.exe"
O4 - HKCU\..\Run: [xpsp2res] "C:\WINDOWS\system32\xpsp2res.exe"
O4 - HKCU\..\Run: [extmgr] "C:\WINDOWS\system32\extmgr.exe"
O4 - HKCU\..\Run: [icmui] "C:\WINDOWS\system32\icmui.exe"
O4 - HKCU\..\Run: [odbctrac] "C:\WINDOWS\system32\odbctrac.exe"
O4 - HKCU\..\Run: [rasapi32] "C:\WINDOWS\system32\rasapi32.exe"
O4 - HKCU\..\Run: [shsvcs] "C:\WINDOWS\system32\shsvcs.exe"
O4 - HKCU\..\Run: [nvwrshe] "C:\WINDOWS\system32\nvwrshe.exe"
O4 - HKCU\..\Run: [jgsh400] "C:\WINDOWS\system32\jgsh400.exe"
O4 - HKCU\..\Run: [ntlanui2] "C:\WINDOWS\system32\ntlanui2.exe"
O4 - HKCU\..\Run: [dssenh] "C:\WINDOWS\system32\dssenh.exe"
O4 - HKCU\..\Run: [ciadmin] "C:\WINDOWS\system32\ciadmin.exe"
O4 - HKCU\..\Run: [senscfg] "C:\WINDOWS\system32\senscfg.exe"
O4 - HKCU\..\Run: [olecnv32] "C:\WINDOWS\system32\olecnv32.exe"
O4 - HKCU\..\Run: [rdpdd] "C:\WINDOWS\system32\rdpdd.exe"
O4 - HKCU\..\Run: [wpdtrace] "C:\WINDOWS\system32\wpdtrace.exe"
O4 - HKCU\..\Run: [iyvu9_32] "C:\WINDOWS\system32\iyvu9_32.exe"
O4 - HKCU\..\Run: [mmdrv] "C:\WINDOWS\system32\mmdrv.exe"
O4 - HKCU\..\Run: [cnetcfg] "C:\WINDOWS\system32\cnetcfg.exe"
O4 - HKCU\..\Run: [qdvd] "C:\WINDOWS\system32\qdvd.exe"
O4 - HKCU\..\Run: [mpg4dmod] "C:\WINDOWS\system32\mpg4dmod.exe"
O4 - HKCU\..\Run: [kbdmon] "C:\WINDOWS\system32\kbdmon.exe"
O4 - HKCU\..\Run: [htui] "C:\WINDOWS\system32\htui.exe"
O4 - HKCU\..\Run: [winscard] "C:\WINDOWS\system32\winscard.exe"
O4 - HKCU\..\Run: [msdart] "C:\WINDOWS\system32\msdart.exe"
O4 - HKCU\..\Run: [fwcfg] "C:\WINDOWS\system32\fwcfg.exe"
O4 - HKCU\..\Run: [hccoin] "C:\WINDOWS\system32\hccoin.exe"
O4 - HKCU\..\Run: [cdm] "C:\WINDOWS\system32\cdm.exe"
O4 - HKCU\..\Run: [lpk] "C:\WINDOWS\system32\lpk.exe"
O4 - HKCU\..\Run: [jit] "C:\WINDOWS\system32\jit.exe"
O4 - HKCU\..\Run: [shmedia] "C:\WINDOWS\system32\shmedia.exe"
O4 - HKCU\..\Run: [mcicda] "C:\WINDOWS\system32\mcicda.exe"
O4 - HKCU\..\Run: [jscript] "C:\WINDOWS\system32\jscript.exe"
O4 - HKCU\..\Run: [comcat] "C:\WINDOWS\system32\comcat.exe"
O4 - HKCU\..\Run: [vjoy] "C:\WINDOWS\system32\vjoy.exe"
O4 - HKCU\..\Run: [msapsspc] "C:\WINDOWS\system32\msapsspc.exe"
O4 - HKCU\..\Run: [winsta] "C:\WINDOWS\system32\winsta.exe"
O4 - HKCU\..\Run: [msacm32] "C:\WINDOWS\system32\msacm32.exe"
O4 - HKCU\..\Run: [batmeter] "C:\WINDOWS\system32\batmeter.exe"
O4 - HKCU\..\Run: [asfsipc] "C:\WINDOWS\system32\asfsipc.exe"
O4 - HKCU\..\Run: [nvwimg] "C:\WINDOWS\system32\nvwimg.exe"
O4 - HKCU\..\Run: [wpd_ci] "C:\WINDOWS\system32\wpd_ci.exe"
O4 - HKCU\..\Run: [nvrspt] "C:\WINDOWS\system32\nvrspt.exe"
O4 - HKCU\..\Run: [upnpui] "C:\WINDOWS\system32\upnpui.exe"
O4 - HKCU\..\Run: [wups] "C:\WINDOWS\system32\wups.exe"
O4 - HKCU\..\Run: [nvcod] "C:\WINDOWS\system32\nvcod.exe"
O4 - HKCU\..\Run: [dnsrslvr] "C:\WINDOWS\system32\dnsrslvr.exe"
O4 - HKCU\..\Run: [mspmsnsv] "C:\WINDOWS\system32\mspmsnsv.exe"
O4 - HKCU\..\Run: [wrap_oal] "C:\WINDOWS\system32\wrap_oal.exe"
O4 - HKCU\..\Run: [netman] "C:\WINDOWS\system32\netman.exe"
O4 - HKCU\..\Run: [newdev] "C:\WINDOWS\system32\newdev.exe"
O4 - HKCU\..\Run: [cmpbk32] "C:\WINDOWS\system32\cmpbk32.exe"
O4 - HKCU\..\Run: [jsnl] "C:\WINDOWS\system32\jsnl.exe"
O4 - HKCU\..\Run: [pmailext] "C:\WINDOWS\system32\pmailext.exe"
O4 - HKCU\..\Run: [txflog] "C:\WINDOWS\system32\txflog.exe"
O4 - HKCU\..\Run: [icfgnt5] "C:\WINDOWS\system32\icfgnt5.exe"
O4 - HKCU\..\Run: [bitsprx3] "C:\WINDOWS\system32\bitsprx3.exe"
O4 - HKCU\..\Run: [vbame] "C:\WINDOWS\system32\vbame.exe"
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [vdmredir] "C:\WINDOWS\system32\vdmredir.exe"
O4 - HKCU\..\Run: [wifeman] "C:\WINDOWS\system32\wifeman.exe"
O4 - HKCU\..\Run: [mdmxsdk] "C:\WINDOWS\system32\mdmxsdk.exe"
O4 - HKCU\..\Run: [spxcoins] "C:\WINDOWS\system32\spxcoins.exe"
O4 - HKCU\..\Run: [wmv8dmoe] "C:\WINDOWS\system32\wmv8dmoe.exe"
O4 - HKCU\..\Run: [wuapi] "C:\WINDOWS\system32\wuapi.exe"
O4 - HKCU\..\Run: [clb] "C:\WINDOWS\system32\clb.exe"
O4 - HKCU\..\Run: [msswch] "C:\WINDOWS\system32\msswch.exe"
O4 - HKCU\..\Run: [wiafbdrv] "C:\WINDOWS\system32\wiafbdrv.exe"
O4 - HKCU\..\Run: [sqlsrv32] "C:\WINDOWS\system32\sqlsrv32.exe"
O4 - HKCU\..\Run: [itiimg3] "C:\WINDOWS\system32\itiimg3.exe"
O4 - HKCU\..\Run: [nlhtml] "C:\WINDOWS\system32\nlhtml.exe"
O4 - HKCU\..\Run: [cewmdm] "C:\WINDOWS\system32\cewmdm.exe"
O4 - HKCU\..\Run: [nvrsko] "C:\WINDOWS\system32\nvrsko.exe"
O4 - HKCU\..\Run: [msimg32] "C:\WINDOWS\system32\msimg32.exe"
O4 - HKCU\..\Run: [adsmsext] "C:\WINDOWS\system32\adsmsext.exe"
O4 - HKCU\..\Run: [tapi32] "C:\WINDOWS\system32\tapi32.exe"
O4 - HKCU\..\Run: [kbdusr] "C:\WINDOWS\system32\kbdusr.exe"
O4 - HKCU\..\Run: [moricons] "C:\WINDOWS\system32\moricons.exe"
O4 - HKCU\..\Run: [inetmib1] "C:\WINDOWS\system32\inetmib1.exe"
O4 - HKCU\..\Run: [msratelc] "C:\WINDOWS\system32\msratelc.exe"
O4 - HKCU\..\Run: [pdh] "C:\WINDOWS\system32\pdh.exe"
O4 - HKCU\..\Run: [shimeng] "C:\WINDOWS\system32\shimeng.exe"
O4 - HKCU\..\Run: [vmmanager] C:\WINDOWS\SYSTEM32\VMMANAGER.EXE
O4 - HKCU\..\Run: [vwmanager] C:\WINDOWS\system32\vwmanager.exe
O4 - HKCU\..\Run: [kbdbene] C:\WINDOWS\system32\kbdbene.exe
O4 - HKCU\..\Run: [imagxpr5] C:\WINDOWS\system32\imagxpr5.exe
O4 - HKCU\..\Run: [wucltui] C:\WINDOWS\system32\wucltui.exe
O4 - HKCU\..\Run: [wiaservc] C:\WINDOWS\system32\wiaservc.exe
O4 - HKCU\..\Run: [kbdycc] C:\WINDOWS\system32\kbdycc.exe
O4 - HKCU\..\Run: [6to4svc] C:\WINDOWS\system32\6to4svc.exe
O4 - HKCU\..\Run: [Xjtzjb] C:\Documents and Settings\Paul Ysebaert\Application Data\s?curity\j?vaw.exe
O4 - HKCU\..\Run: [Fdoyeac] C:\Program Files\Common Files\??sks\?ttrib.exe
O4 - HKCU\..\Run: [cic] C:\WINDOWS\system32\cic.exe
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [wowfax] C:\WINDOWS\system32\wowfax.exe
O4 - HKCU\..\Run: [Pamu] "C:\WINDOWS\SSTEM3~1\services.exe" -vt yazb
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - HKCU\..\Run: [msidle] C:\WINDOWS\system32\msidle.exe
O4 - HKCU\..\Run: [msjtes40] C:\WINDOWS\system32\msjtes40.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O10 - Broken Internet access because of LSP provider 'xfire_lsp_10650.dll' missing
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120240216328
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://exent.planet.nl/AoDSite/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136384588343
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://gameadvisor.futuremark.com/global/msc37.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\ntvdm.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Jurgenv1 · 31 jul 2006

* Laat deze uninstaller runnen:
http://www.outerinfo.com/OiUninstaller.exe

* Download en installeer Ewido Anti-Spyware 4.0.

Na de installatie, open Ewido Anti-Spyware 4.0:
* onder "Status", klik op Change state naast "Resident shield".
* onder "Update", klik op de Start update knop.
* onder "Scanner", tab "Settings":
- - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine.
  - onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
Sluit Ewido. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm

* Start je computer op in VEILIGE MODUS

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

open ewido en klik op de Scanner tab bovenaan en klik dan op Complete System Scan. Deze scan zal heel je systeem afcannen dus dit kan een tijdje duren
Ewido zal alle geïnfecteerde objecten aan de linkerkant tonen. Waneer de scan gedaan is, zal het alles naar de 'Quarantine' optie zetten. klik dan op de Apply all actions knop. Ewido zal dan het volgend bericht tonen aan de rechterkant: "All actions have been applied"
Klik dan op "Save Report", en dan op "Save Report As". dit zal een rapport maken Wees zeker dat je het rapport makkelijk kunt terugvinden (ijvoorbeeld op je bureaublad).

* Start je pc weer normaal

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* post een nieuw hijackthis logje hier met het rapport van ewido

math · 1 aug 2006

Logfile of HijackThis v1.99.1
Scan saved at 0:23:29, on 1/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRAM FILES\IPWINS\IPWINS.EXE
C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\MSJTES40.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\PROGRAM FILES\TCLOCK\TCLOCK.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\WINDOWS\system32\UAService7.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.telenet.be
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {12BC3DD7-D410-AFEC-3727-FB6A16DE8DEE} - C:\WINDOWS\system32\dnpmhaf.dll (file missing)
F2 - REG

ystem.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: Antifraudewerkbalk van Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12BC3DD7-D410-AFEC-3727-FB6A16DE8DEE} - C:\WINDOWS\system32\dnpmhaf.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: Antifraudewerkbalk van Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [nwkbula] c:\windows\system32\sfuobmb.exe r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [!ewido] "C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [clbcatq] "C:\WINDOWS\system32\clbcatq.exe"
O4 - HKCU\..\Run: [mfc42u] "C:\WINDOWS\system32\mfc42u.exe"
O4 - HKCU\..\Run: [webcheck] "C:\WINDOWS\system32\webcheck.exe"
O4 - HKCU\..\Run: [wshatm] "C:\WINDOWS\system32\wshatm.exe"
O4 - HKCU\..\Run: [rasmontr] "C:\WINDOWS\system32\rasmontr.exe"
O4 - HKCU\..\Run: [mciavi32] "C:\WINDOWS\system32\mciavi32.exe"
O4 - HKCU\..\Run: [perfnet] "C:\WINDOWS\system32\perfnet.exe"
O4 - HKCU\..\Run: [comaddin] "C:\WINDOWS\system32\comaddin.exe"
O4 - HKCU\..\Run: [xfire_lsp_10650] "C:\WINDOWS\system32\xfire_lsp_10650.exe"
O4 - HKCU\..\Run: [vtdisp] "C:\WINDOWS\system32\vtdisp.exe"
O4 - HKCU\..\Run: [msls31] "C:\WINDOWS\system32\msls31.exe"
O4 - HKCU\..\Run: [atl71] "C:\WINDOWS\system32\atl71.exe"
O4 - HKCU\..\Run: [adsldpc] "C:\WINDOWS\system32\adsldpc.exe"
O4 - HKCU\..\Run: [lz32] "C:\WINDOWS\system32\lz32.exe"
O4 - HKCU\..\Run: [browsewm] "C:\WINDOWS\system32\browsewm.exe"
O4 - HKCU\..\Run: [odbccp32] "C:\WINDOWS\system32\odbccp32.exe"
O4 - HKCU\..\Run: [termmgr] "C:\WINDOWS\system32\termmgr.exe"
O4 - HKCU\..\Run: [netrap] "C:\WINDOWS\system32\netrap.exe"
O4 - HKCU\..\Run: [mag_hook] "C:\WINDOWS\system32\mag_hook.exe"
O4 - HKCU\..\Run: [sxs] "C:\WINDOWS\system32\sxs.exe"
O4 - HKCU\..\Run: [rasauto] "C:\WINDOWS\system32\rasauto.exe"
O4 - HKCU\..\Run: [umandlg] "C:\WINDOWS\system32\umandlg.exe"
O4 - HKCU\..\Run: [odbcint] "C:\WINDOWS\system32\odbcint.exe"
O4 - HKCU\..\Run: [ati2dvaa] "C:\WINDOWS\system32\ati2dvaa.exe"
O4 - HKCU\..\Run: [winsrv] "C:\WINDOWS\system32\winsrv.exe"
O4 - HKCU\..\Run: [pstorec] "C:\WINDOWS\system32\pstorec.exe"
O4 - HKCU\..\Run: [sqlwid] "C:\WINDOWS\system32\sqlwid.exe"
O4 - HKCU\..\Run: [mssign32] "C:\WINDOWS\system32\mssign32.exe"
O4 - HKCU\..\Run: [mfc70] "C:\WINDOWS\system32\mfc70.exe"
O4 - HKCU\..\Run: [olepro32] "C:\WINDOWS\system32\olepro32.exe"
O4 - HKCU\..\Run: [webvw] "C:\WINDOWS\system32\webvw.exe"
O4 - HKCU\..\Run: [powrprof] "C:\WINDOWS\system32\powrprof.exe"
O4 - HKCU\..\Run: [msrecr40] "C:\WINDOWS\system32\msrecr40.exe"
O4 - HKCU\..\Run: [kbdfc] "C:\WINDOWS\system32\kbdfc.exe"
O4 - HKCU\..\Run: [nddeapi] "C:\WINDOWS\system32\nddeapi.exe"
O4 - HKCU\..\Run: [certcli] "C:\WINDOWS\system32\certcli.exe"
O4 - HKCU\..\Run: [shimgvw] "C:\WINDOWS\system32\shimgvw.exe"
O4 - HKCU\..\Run: [kbdtuf] "C:\WINDOWS\system32\kbdtuf.exe"
O4 - HKCU\..\Run: [danim] "C:\WINDOWS\system32\danim.exe"
O4 - HKCU\..\Run: [secur32] "C:\WINDOWS\system32\secur32.exe"
O4 - HKCU\..\Run: [mscories] "C:\WINDOWS\system32\mscories.exe"
O4 - HKCU\..\Run: [fxsperf] "C:\WINDOWS\system32\fxsperf.exe"
O4 - HKCU\..\Run: [kbdus] "C:\WINDOWS\system32\kbdus.exe"
O4 - HKCU\..\Run: [symredir] "C:\WINDOWS\system32\symredir.exe"
O4 - HKCU\..\Run: [ulib] "C:\WINDOWS\system32\ulib.exe"
O4 - HKCU\..\Run: [shlwapi] "C:\WINDOWS\system32\shlwapi.exe"
O4 - HKCU\..\Run: [mswebdvd] "C:\WINDOWS\system32\mswebdvd.exe"
O4 - HKCU\..\Run: [msnetobj] "C:\WINDOWS\system32\msnetobj.exe"
O4 - HKCU\..\Run: [wuaueng1] "C:\WINDOWS\system32\wuaueng1.exe"
O4 - HKCU\..\Run: [licmgr10] "C:\WINDOWS\system32\licmgr10.exe"
O4 - HKCU\..\Run: [vticd] "C:\WINDOWS\system32\vticd.exe"
O4 - HKCU\..\Run: [wmadmod] "C:\WINDOWS\system32\wmadmod.exe"
O4 - HKCU\..\Run: [mciole16] "C:\WINDOWS\system32\mciole16.exe"
O4 - HKCU\..\Run: [wuauserv] "C:\WINDOWS\system32\wuauserv.exe"
O4 - HKCU\..\Run: [olesvr] "C:\WINDOWS\system32\olesvr.exe"
O4 - HKCU\..\Run: [shdoclc] "C:\WINDOWS\system32\shdoclc.exe"
O4 - HKCU\..\Run: [mtxlegih] "C:\WINDOWS\system32\mtxlegih.exe"
O4 - HKCU\..\Run: [usrdpa] "C:\WINDOWS\system32\usrdpa.exe"
O4 - HKCU\..\Run: [mswmdm] "C:\WINDOWS\system32\mswmdm.exe"
O4 - HKCU\..\Run: [wmvdmoe] "C:\WINDOWS\system32\wmvdmoe.exe"
O4 - HKCU\..\Run: [jobexec] "C:\WINDOWS\system32\jobexec.exe"
O4 - HKCU\..\Run: [xgate] "C:\WINDOWS\system32\xgate.exe"
O4 - HKCU\..\Run: [icm32] "C:\WINDOWS\system32\icm32.exe"
O4 - HKCU\..\Run: [wmerrnld] "C:\WINDOWS\system32\wmerrnld.exe"
O4 - HKCU\..\Run: [wdigest] "C:\WINDOWS\system32\wdigest.exe"
O4 - HKCU\..\Run: [wmspdmod] "C:\WINDOWS\system32\wmspdmod.exe"
O4 - HKCU\..\Run: [eax] "C:\WINDOWS\system32\eax.exe"
O4 - HKCU\..\Run: [catsrvps] "C:\WINDOWS\system32\catsrvps.exe"
O4 - HKCU\..\Run: [dplayx] "C:\WINDOWS\system32\dplayx.exe"
O4 - HKCU\..\Run: [usrvpa] "C:\WINDOWS\system32\usrvpa.exe"
O4 - HKCU\..\Run: [legitcheckcontrol] "C:\WINDOWS\system32\legitcheckcontrol.exe"
O4 - HKCU\..\Run: [umpnpmgr] "C:\WINDOWS\system32\umpnpmgr.exe"
O4 - HKCU\..\Run: [ptpusd] "C:\WINDOWS\system32\ptpusd.exe"
O4 - HKCU\..\Run: [mindex] "C:\WINDOWS\system32\mindex.exe"
O4 - HKCU\..\Run: [tsd32] "C:\WINDOWS\system32\tsd32.exe"
O4 - HKCU\..\Run: [ntmsapi] "C:\WINDOWS\system32\ntmsapi.exe"
O4 - HKCU\..\Run: [dpvvox] "C:\WINDOWS\system32\dpvvox.exe"
O4 - HKCU\..\Run: [scrobj] "C:\WINDOWS\system32\scrobj.exe"
O4 - HKCU\..\Run: [msvcrt20] "C:\WINDOWS\system32\msvcrt20.exe"
O4 - HKCU\..\Run: [msimtf] "C:\WINDOWS\system32\msimtf.exe"
O4 - HKCU\..\Run: [dpnhupnp] "C:\WINDOWS\system32\dpnhupnp.exe"
O4 - HKCU\..\Run: [rasrad] "C:\WINDOWS\system32\rasrad.exe"
O4 - HKCU\..\Run: [msdtcprx] "C:\WINDOWS\system32\msdtcprx.exe"
O4 - HKCU\..\Run: [usrdtea] "C:\WINDOWS\system32\usrdtea.exe"
O4 - HKCU\..\Run: [msltus40] "C:\WINDOWS\system32\msltus40.exe"
O4 - HKCU\..\Run: [msisip] "C:\WINDOWS\system32\msisip.exe"
O4 - HKCU\..\Run: [dpwsock] "C:\WINDOWS\system32\dpwsock.exe"
O4 - HKCU\..\Run: [dpwsockx] "C:\WINDOWS\system32\dpwsockx.exe"
O4 - HKCU\..\Run: [dbnmpntw] "C:\WINDOWS\system32\dbnmpntw.exe"
O4 - HKCU\..\Run: [mucltui] "C:\WINDOWS\system32\mucltui.exe"
O4 - HKCU\..\Run: [lmhsvc] "C:\WINDOWS\system32\lmhsvc.exe"
O4 - HKCU\..\Run: [qcap] "C:\WINDOWS\system32\qcap.exe"
O4 - HKCU\..\Run: [rdpwsx] "C:\WINDOWS\system32\rdpwsx.exe"
O4 - HKCU\..\Run: [dgrpsetu] "C:\WINDOWS\system32\dgrpsetu.exe"
O4 - HKCU\..\Run: [licwmi] "C:\WINDOWS\system32\licwmi.exe"
O4 - HKCU\..\Run: [tapi] "C:\WINDOWS\system32\tapi.exe"
O4 - HKCU\..\Run: [hypertrm] "C:\WINDOWS\system32\hypertrm.exe"
O4 - HKCU\..\Run: [wshrm] "C:\WINDOWS\system32\wshrm.exe"
O4 - HKCU\..\Run: [xenroll] "C:\WINDOWS\system32\xenroll.exe"
O4 - HKCU\..\Run: [racpldlg] "C:\WINDOWS\system32\racpldlg.exe"
O4 - HKCU\..\Run: [ipxpromn] "C:\WINDOWS\system32\ipxpromn.exe"
O4 - HKCU\..\Run: [nvrssl] "C:\WINDOWS\system32\nvrssl.exe"
O4 - HKCU\..\Run: [certmgr] "C:\WINDOWS\system32\certmgr.exe"
O4 - HKCU\..\Run: [kbdhe319] "C:\WINDOWS\system32\kbdhe319.exe"
O4 - HKCU\..\Run: [wmpcore] "C:\WINDOWS\system32\wmpcore.exe"
O4 - HKCU\..\Run: [scrrnnl] "C:\WINDOWS\system32\scrrnnl.exe"
O4 - HKCU\..\Run: [ceutil] "C:\WINDOWS\system32\ceutil.exe"
O4 - HKCU\..\Run: [icmp] "C:\WINDOWS\system32\icmp.exe"
O4 - HKCU\..\Run: [colbact] "C:\WINDOWS\system32\colbact.exe"
O4 - HKCU\..\Run: [kbdusl] "C:\WINDOWS\system32\kbdusl.exe"
O4 - HKCU\..\Run: [ipmontr] "C:\WINDOWS\system32\ipmontr.exe"
O4 - HKCU\..\Run: [duser] "C:\WINDOWS\system32\duser.exe"
O4 - HKCU\..\Run: [javaprxy] "C:\WINDOWS\system32\javaprxy.exe"
O4 - HKCU\..\Run: [polstore] "C:\WINDOWS\system32\polstore.exe"
O4 - HKCU\..\Run: [webclnt] "C:\WINDOWS\system32\webclnt.exe"
O4 - HKCU\..\Run: [vcdex] "C:\WINDOWS\system32\vcdex.exe"
O4 - HKCU\..\Run: [asferror] "C:\WINDOWS\system32\asferror.exe"
O4 - HKCU\..\Run: [dpnet] "C:\WINDOWS\system32\dpnet.exe"
O4 - HKCU\..\Run: [msvfw32] "C:\WINDOWS\system32\msvfw32.exe"
O4 - HKCU\..\Run: [d3d8] "C:\WINDOWS\system32\d3d8.exe"
O4 - HKCU\..\Run: [spmsg] "C:\WINDOWS\system32\spmsg.exe"
O4 - HKCU\..\Run: [wmpdxm] "C:\WINDOWS\system32\wmpdxm.exe"
O4 - HKCU\..\Run: [wldap32] "C:\WINDOWS\system32\wldap32.exe"
O4 - HKCU\..\Run: [sens] "C:\WINDOWS\system32\sens.exe"
O4 - HKCU\..\Run: [winsysmwappio5] "C:\WINDOWS\system32\winsysmwappio5.exe"

math · 1 aug 2006

O4 - HKCU\..\Run: [odbccr32] "C:\WINDOWS\system32\odbccr32.exe"
O4 - HKCU\..\Run: [dpnlobby] "C:\WINDOWS\system32\dpnlobby.exe"
O4 - HKCU\..\Run: [xpsp1res] "C:\WINDOWS\system32\xpsp1res.exe"
O4 - HKCU\..\Run: [nwprovau] "C:\WINDOWS\system32\nwprovau.exe"
O4 - HKCU\..\Run: [termsrv] "C:\WINDOWS\system32\termsrv.exe"
O4 - HKCU\..\Run: [encdec] "C:\WINDOWS\system32\encdec.exe"
O4 - HKCU\..\Run: [rapi] "C:\WINDOWS\system32\rapi.exe"
O4 - HKCU\..\Run: [kbdukx] "C:\WINDOWS\system32\kbdukx.exe"
O4 - HKCU\..\Run: [ils] "C:\WINDOWS\system32\ils.exe"
O4 - HKCU\..\Run: [kbdmac] "C:\WINDOWS\system32\kbdmac.exe"
O4 - HKCU\..\Run: [xpsp2res] "C:\WINDOWS\system32\xpsp2res.exe"
O4 - HKCU\..\Run: [extmgr] "C:\WINDOWS\system32\extmgr.exe"
O4 - HKCU\..\Run: [icmui] "C:\WINDOWS\system32\icmui.exe"
O4 - HKCU\..\Run: [odbctrac] "C:\WINDOWS\system32\odbctrac.exe"
O4 - HKCU\..\Run: [rasapi32] "C:\WINDOWS\system32\rasapi32.exe"
O4 - HKCU\..\Run: [shsvcs] "C:\WINDOWS\system32\shsvcs.exe"
O4 - HKCU\..\Run: [nvwrshe] "C:\WINDOWS\system32\nvwrshe.exe"
O4 - HKCU\..\Run: [jgsh400] "C:\WINDOWS\system32\jgsh400.exe"
O4 - HKCU\..\Run: [ntlanui2] "C:\WINDOWS\system32\ntlanui2.exe"
O4 - HKCU\..\Run: [dssenh] "C:\WINDOWS\system32\dssenh.exe"
O4 - HKCU\..\Run: [ciadmin] "C:\WINDOWS\system32\ciadmin.exe"
O4 - HKCU\..\Run: [senscfg] "C:\WINDOWS\system32\senscfg.exe"
O4 - HKCU\..\Run: [olecnv32] "C:\WINDOWS\system32\olecnv32.exe"
O4 - HKCU\..\Run: [rdpdd] "C:\WINDOWS\system32\rdpdd.exe"
O4 - HKCU\..\Run: [wpdtrace] "C:\WINDOWS\system32\wpdtrace.exe"
O4 - HKCU\..\Run: [iyvu9_32] "C:\WINDOWS\system32\iyvu9_32.exe"
O4 - HKCU\..\Run: [mmdrv] "C:\WINDOWS\system32\mmdrv.exe"
O4 - HKCU\..\Run: [cnetcfg] "C:\WINDOWS\system32\cnetcfg.exe"
O4 - HKCU\..\Run: [qdvd] "C:\WINDOWS\system32\qdvd.exe"
O4 - HKCU\..\Run: [mpg4dmod] "C:\WINDOWS\system32\mpg4dmod.exe"
O4 - HKCU\..\Run: [kbdmon] "C:\WINDOWS\system32\kbdmon.exe"
O4 - HKCU\..\Run: [htui] "C:\WINDOWS\system32\htui.exe"
O4 - HKCU\..\Run: [winscard] "C:\WINDOWS\system32\winscard.exe"
O4 - HKCU\..\Run: [msdart] "C:\WINDOWS\system32\msdart.exe"
O4 - HKCU\..\Run: [fwcfg] "C:\WINDOWS\system32\fwcfg.exe"
O4 - HKCU\..\Run: [hccoin] "C:\WINDOWS\system32\hccoin.exe"
O4 - HKCU\..\Run: [cdm] "C:\WINDOWS\system32\cdm.exe"
O4 - HKCU\..\Run: [lpk] "C:\WINDOWS\system32\lpk.exe"
O4 - HKCU\..\Run: [jit] "C:\WINDOWS\system32\jit.exe"
O4 - HKCU\..\Run: [shmedia] "C:\WINDOWS\system32\shmedia.exe"
O4 - HKCU\..\Run: [mcicda] "C:\WINDOWS\system32\mcicda.exe"
O4 - HKCU\..\Run: [jscript] "C:\WINDOWS\system32\jscript.exe"
O4 - HKCU\..\Run: [comcat] "C:\WINDOWS\system32\comcat.exe"
O4 - HKCU\..\Run: [vjoy] "C:\WINDOWS\system32\vjoy.exe"
O4 - HKCU\..\Run: [msapsspc] "C:\WINDOWS\system32\msapsspc.exe"
O4 - HKCU\..\Run: [winsta] "C:\WINDOWS\system32\winsta.exe"
O4 - HKCU\..\Run: [msacm32] "C:\WINDOWS\system32\msacm32.exe"
O4 - HKCU\..\Run: [batmeter] "C:\WINDOWS\system32\batmeter.exe"
O4 - HKCU\..\Run: [asfsipc] "C:\WINDOWS\system32\asfsipc.exe"
O4 - HKCU\..\Run: [nvwimg] "C:\WINDOWS\system32\nvwimg.exe"
O4 - HKCU\..\Run: [wpd_ci] "C:\WINDOWS\system32\wpd_ci.exe"
O4 - HKCU\..\Run: [nvrspt] "C:\WINDOWS\system32\nvrspt.exe"
O4 - HKCU\..\Run: [upnpui] "C:\WINDOWS\system32\upnpui.exe"
O4 - HKCU\..\Run: [wups] "C:\WINDOWS\system32\wups.exe"
O4 - HKCU\..\Run: [nvcod] "C:\WINDOWS\system32\nvcod.exe"
O4 - HKCU\..\Run: [dnsrslvr] "C:\WINDOWS\system32\dnsrslvr.exe"
O4 - HKCU\..\Run: [mspmsnsv] "C:\WINDOWS\system32\mspmsnsv.exe"
O4 - HKCU\..\Run: [wrap_oal] "C:\WINDOWS\system32\wrap_oal.exe"
O4 - HKCU\..\Run: [netman] "C:\WINDOWS\system32\netman.exe"
O4 - HKCU\..\Run: [newdev] "C:\WINDOWS\system32\newdev.exe"
O4 - HKCU\..\Run: [cmpbk32] "C:\WINDOWS\system32\cmpbk32.exe"
O4 - HKCU\..\Run: [jsnl] "C:\WINDOWS\system32\jsnl.exe"
O4 - HKCU\..\Run: [pmailext] "C:\WINDOWS\system32\pmailext.exe"
O4 - HKCU\..\Run: [txflog] "C:\WINDOWS\system32\txflog.exe"
O4 - HKCU\..\Run: [icfgnt5] "C:\WINDOWS\system32\icfgnt5.exe"
O4 - HKCU\..\Run: [bitsprx3] "C:\WINDOWS\system32\bitsprx3.exe"
O4 - HKCU\..\Run: [vbame] "C:\WINDOWS\system32\vbame.exe"
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [vdmredir] "C:\WINDOWS\system32\vdmredir.exe"
O4 - HKCU\..\Run: [wifeman] "C:\WINDOWS\system32\wifeman.exe"
O4 - HKCU\..\Run: [mdmxsdk] "C:\WINDOWS\system32\mdmxsdk.exe"
O4 - HKCU\..\Run: [spxcoins] "C:\WINDOWS\system32\spxcoins.exe"
O4 - HKCU\..\Run: [wmv8dmoe] "C:\WINDOWS\system32\wmv8dmoe.exe"
O4 - HKCU\..\Run: [wuapi] "C:\WINDOWS\system32\wuapi.exe"
O4 - HKCU\..\Run: [clb] "C:\WINDOWS\system32\clb.exe"
O4 - HKCU\..\Run: [msswch] "C:\WINDOWS\system32\msswch.exe"
O4 - HKCU\..\Run: [wiafbdrv] "C:\WINDOWS\system32\wiafbdrv.exe"
O4 - HKCU\..\Run: [sqlsrv32] "C:\WINDOWS\system32\sqlsrv32.exe"
O4 - HKCU\..\Run: [itiimg3] "C:\WINDOWS\system32\itiimg3.exe"
O4 - HKCU\..\Run: [nlhtml] "C:\WINDOWS\system32\nlhtml.exe"
O4 - HKCU\..\Run: [cewmdm] "C:\WINDOWS\system32\cewmdm.exe"
O4 - HKCU\..\Run: [nvrsko] "C:\WINDOWS\system32\nvrsko.exe"
O4 - HKCU\..\Run: [msimg32] "C:\WINDOWS\system32\msimg32.exe"
O4 - HKCU\..\Run: [adsmsext] "C:\WINDOWS\system32\adsmsext.exe"
O4 - HKCU\..\Run: [tapi32] "C:\WINDOWS\system32\tapi32.exe"
O4 - HKCU\..\Run: [kbdusr] "C:\WINDOWS\system32\kbdusr.exe"
O4 - HKCU\..\Run: [moricons] "C:\WINDOWS\system32\moricons.exe"
O4 - HKCU\..\Run: [inetmib1] "C:\WINDOWS\system32\inetmib1.exe"
O4 - HKCU\..\Run: [msratelc] "C:\WINDOWS\system32\msratelc.exe"
O4 - HKCU\..\Run: [pdh] "C:\WINDOWS\system32\pdh.exe"
O4 - HKCU\..\Run: [shimeng] "C:\WINDOWS\system32\shimeng.exe"
O4 - HKCU\..\Run: [vmmanager] C:\WINDOWS\SYSTEM32\VMMANAGER.EXE
O4 - HKCU\..\Run: [vwmanager] C:\WINDOWS\system32\vwmanager.exe
O4 - HKCU\..\Run: [kbdbene] C:\WINDOWS\system32\kbdbene.exe
O4 - HKCU\..\Run: [wiaservc] C:\WINDOWS\system32\wiaservc.exe
O4 - HKCU\..\Run: [Xjtzjb] C:\Documents and Settings\Paul Ysebaert\Application Data\s?curity\j?vaw.exe
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [wowfax] C:\WINDOWS\system32\wowfax.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - HKCU\..\Run: [msidle] C:\WINDOWS\system32\msidle.exe
O4 - HKCU\..\Run: [msjtes40] C:\WINDOWS\system32\msjtes40.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O10 - Broken Internet access because of LSP provider 'xfire_lsp_10650.dll' missing
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120240216328
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://exent.planet.nl/AoDSite/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136384588343
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://gameadvisor.futuremark.com/global/msc37.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

dit is het report van ewido

HKLM\SOFTWARE\saap -> Adware.180Solutions : Cleaned with backup (quarantined).
HKU\S-1-5-21-3516954290-3748425455-2125014042-1009\Software\saap -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\unebmm350 -> Adware.MoneyMaker : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Application Data\sеcurity\jаvaw.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc\Enum -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc\Enum -> Adware.WebSearch : Error during cleaning.
C:\Documents and Settings\Paul Ysebaert\Local Settings\Temp\gtermddo.sys -> Backdoor.Genlot.DX : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\VacPro.belgio_ver3 -> Dialer.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\VacPro.belgio_ver3\Clsid -> Dialer.Generic : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\!update.exe -> Downloader.PurityScan.co : Error during cleaning.
C:\Documents and Settings\Paul Ysebaert\Local Settings\Temporary Internet Files\Content.IE5\HXIN9TQI\popup[1].htm -> Hijacker.Agent.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Local Settings\Temporary Internet Files\Content.IE5\HXIN9TQI\popup[2].htm -> Hijacker.Agent.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Local Settings\Temporary Internet Files\Content.IE5\LUA1B6HZ\popup[1].htm -> Hijacker.Agent.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Local Settings\Temporary Internet Files\Content.IE5\M5O1EFU5\popup[2].htm -> Hijacker.Agent.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Local Settings\Temporary Internet Files\Content.IE5\M5O1EFU5\popup[3].htm -> Hijacker.Agent.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Local Settings\Temporary Internet Files\Content.IE5\M5O1EFU5\popup[4].htm -> Hijacker.Agent.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@addcontrol[1].txt -> TrackingCookie.Addcontrol : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Adition : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Adtrak : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Clickhype : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@webstat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\WINDOWS\system32\imagxpr5.exe -> Trojan.Agent.um : Cleaned with backup (quarantined).
C:\WINDOWS\system32\wucltui.exe -> Trojan.Agent.um : Cleaned with backup (quarantined).
C:\WINDOWS\system32\6to4svc.exe -> Trojan.Popuper : Cleaned with backup (quarantined).
C:\WINDOWS\system32\cic.exe -> Trojan.Popuper : Cleaned with backup (quarantined).
C:\WINDOWS\system32\kbdycc.exe -> Trojan.Popuper : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe -> Trojan.Scapur.k : Cleaned with backup (quarantined).

Jurgenv1 · 1 aug 2006

* Download LSPFix.
Start het programma.
Plaats een vinkje bij I know what I am doing.
Zorg dat in het rechtse venster (remove venster) alle verwijzingen staan van: xfire_lsp_10650.dll.
(Let op enkel deze mogen in het remove-venster staan, geen anderen!!!)
Klik op Finish en start de computer opnieuw.

* Download Alcanshorty, en plaats het op je bureaublad.

Dubbelklik op alcanshorty_nl om het te installeren.

Open daarna de map alcanshorty_nl , en dubbelklik op run.bat

De ikoontjes op je bureaublad zullen verdwijen en daarna terug verschijnen. Dit is normaal.

Wacht op de "Completed script execution"-boodschap en klik op "OK"

Sluit BFU af door op "EXIT" te klikken.

* Open hijackthis en vink volgende regels aan:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R3 - URLSearchHook: (no name) - {12BC3DD7-D410-AFEC-3727-FB6A16DE8DEE} - C:\WINDOWS\system32\dnpmhaf.dll (file missing)
O2 - BHO: (no name) - {12BC3DD7-D410-AFEC-3727-FB6A16DE8DEE} - C:\WINDOWS\system32\dnpmhaf.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [nwkbula] c:\windows\system32\sfuobmb.exe r
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKCU\..\Run: [clbcatq] "C:\WINDOWS\system32\clbcatq.exe"
O4 - HKCU\..\Run: [mfc42u] "C:\WINDOWS\system32\mfc42u.exe"
O4 - HKCU\..\Run: [webcheck] "C:\WINDOWS\system32\webcheck.exe"
O4 - HKCU\..\Run: [wshatm] "C:\WINDOWS\system32\wshatm.exe"
O4 - HKCU\..\Run: [rasmontr] "C:\WINDOWS\system32\rasmontr.exe"
O4 - HKCU\..\Run: [mciavi32] "C:\WINDOWS\system32\mciavi32.exe"
O4 - HKCU\..\Run: [perfnet] "C:\WINDOWS\system32\perfnet.exe"
O4 - HKCU\..\Run: [comaddin] "C:\WINDOWS\system32\comaddin.exe"
O4 - HKCU\..\Run: [xfire_lsp_10650] "C:\WINDOWS\system32\xfire_lsp_10650.exe"
O4 - HKCU\..\Run: [vtdisp] "C:\WINDOWS\system32\vtdisp.exe"
O4 - HKCU\..\Run: [msls31] "C:\WINDOWS\system32\msls31.exe"
O4 - HKCU\..\Run: [atl71] "C:\WINDOWS\system32\atl71.exe"
O4 - HKCU\..\Run: [adsldpc] "C:\WINDOWS\system32\adsldpc.exe"
O4 - HKCU\..\Run: [lz32] "C:\WINDOWS\system32\lz32.exe"
O4 - HKCU\..\Run: [browsewm] "C:\WINDOWS\system32\browsewm.exe"
O4 - HKCU\..\Run: [odbccp32] "C:\WINDOWS\system32\odbccp32.exe"
O4 - HKCU\..\Run: [termmgr] "C:\WINDOWS\system32\termmgr.exe"
O4 - HKCU\..\Run: [netrap] "C:\WINDOWS\system32\netrap.exe"
O4 - HKCU\..\Run: [mag_hook] "C:\WINDOWS\system32\mag_hook.exe"
O4 - HKCU\..\Run: [sxs] "C:\WINDOWS\system32\sxs.exe"
O4 - HKCU\..\Run: [rasauto] "C:\WINDOWS\system32\rasauto.exe"
O4 - HKCU\..\Run: [umandlg] "C:\WINDOWS\system32\umandlg.exe"
O4 - HKCU\..\Run: [odbcint] "C:\WINDOWS\system32\odbcint.exe"
O4 - HKCU\..\Run: [ati2dvaa] "C:\WINDOWS\system32\ati2dvaa.exe"
O4 - HKCU\..\Run: [winsrv] "C:\WINDOWS\system32\winsrv.exe"
O4 - HKCU\..\Run: [pstorec] "C:\WINDOWS\system32\pstorec.exe"
O4 - HKCU\..\Run: [sqlwid] "C:\WINDOWS\system32\sqlwid.exe"
O4 - HKCU\..\Run: [mssign32] "C:\WINDOWS\system32\mssign32.exe"
O4 - HKCU\..\Run: [mfc70] "C:\WINDOWS\system32\mfc70.exe"
O4 - HKCU\..\Run: [olepro32] "C:\WINDOWS\system32\olepro32.exe"
O4 - HKCU\..\Run: [webvw] "C:\WINDOWS\system32\webvw.exe"
O4 - HKCU\..\Run: [powrprof] "C:\WINDOWS\system32\powrprof.exe"
O4 - HKCU\..\Run: [msrecr40] "C:\WINDOWS\system32\msrecr40.exe"
O4 - HKCU\..\Run: [kbdfc] "C:\WINDOWS\system32\kbdfc.exe"
O4 - HKCU\..\Run: [nddeapi] "C:\WINDOWS\system32\nddeapi.exe"
O4 - HKCU\..\Run: [certcli] "C:\WINDOWS\system32\certcli.exe"
O4 - HKCU\..\Run: [shimgvw] "C:\WINDOWS\system32\shimgvw.exe"
O4 - HKCU\..\Run: [kbdtuf] "C:\WINDOWS\system32\kbdtuf.exe"
O4 - HKCU\..\Run: [danim] "C:\WINDOWS\system32\danim.exe"
O4 - HKCU\..\Run: [secur32] "C:\WINDOWS\system32\secur32.exe"
O4 - HKCU\..\Run: [mscories] "C:\WINDOWS\system32\mscories.exe"
O4 - HKCU\..\Run: [fxsperf] "C:\WINDOWS\system32\fxsperf.exe"
O4 - HKCU\..\Run: [kbdus] "C:\WINDOWS\system32\kbdus.exe"
O4 - HKCU\..\Run: [symredir] "C:\WINDOWS\system32\symredir.exe"
O4 - HKCU\..\Run: [ulib] "C:\WINDOWS\system32\ulib.exe"
O4 - HKCU\..\Run: [shlwapi] "C:\WINDOWS\system32\shlwapi.exe"
O4 - HKCU\..\Run: [mswebdvd] "C:\WINDOWS\system32\mswebdvd.exe"
O4 - HKCU\..\Run: [msnetobj] "C:\WINDOWS\system32\msnetobj.exe"
O4 - HKCU\..\Run: [wuaueng1] "C:\WINDOWS\system32\wuaueng1.exe"
O4 - HKCU\..\Run: [licmgr10] "C:\WINDOWS\system32\licmgr10.exe"
O4 - HKCU\..\Run: [vticd] "C:\WINDOWS\system32\vticd.exe"
O4 - HKCU\..\Run: [wmadmod] "C:\WINDOWS\system32\wmadmod.exe"
O4 - HKCU\..\Run: [mciole16] "C:\WINDOWS\system32\mciole16.exe"
O4 - HKCU\..\Run: [wuauserv] "C:\WINDOWS\system32\wuauserv.exe"
O4 - HKCU\..\Run: [olesvr] "C:\WINDOWS\system32\olesvr.exe"
O4 - HKCU\..\Run: [shdoclc] "C:\WINDOWS\system32\shdoclc.exe"
O4 - HKCU\..\Run: [mtxlegih] "C:\WINDOWS\system32\mtxlegih.exe"
O4 - HKCU\..\Run: [usrdpa] "C:\WINDOWS\system32\usrdpa.exe"
O4 - HKCU\..\Run: [mswmdm] "C:\WINDOWS\system32\mswmdm.exe"
O4 - HKCU\..\Run: [wmvdmoe] "C:\WINDOWS\system32\wmvdmoe.exe"
O4 - HKCU\..\Run: [jobexec] "C:\WINDOWS\system32\jobexec.exe"
O4 - HKCU\..\Run: [xgate] "C:\WINDOWS\system32\xgate.exe"
O4 - HKCU\..\Run: [icm32] "C:\WINDOWS\system32\icm32.exe"
O4 - HKCU\..\Run: [wmerrnld] "C:\WINDOWS\system32\wmerrnld.exe"
O4 - HKCU\..\Run: [wdigest] "C:\WINDOWS\system32\wdigest.exe"
O4 - HKCU\..\Run: [wmspdmod] "C:\WINDOWS\system32\wmspdmod.exe"
O4 - HKCU\..\Run: [eax] "C:\WINDOWS\system32\eax.exe"
O4 - HKCU\..\Run: [catsrvps] "C:\WINDOWS\system32\catsrvps.exe"
O4 - HKCU\..\Run: [dplayx] "C:\WINDOWS\system32\dplayx.exe"
O4 - HKCU\..\Run: [usrvpa] "C:\WINDOWS\system32\usrvpa.exe"
O4 - HKCU\..\Run: [legitcheckcontrol] "C:\WINDOWS\system32\legitcheckcontrol.exe"
O4 - HKCU\..\Run: [umpnpmgr] "C:\WINDOWS\system32\umpnpmgr.exe"
O4 - HKCU\..\Run: [ptpusd] "C:\WINDOWS\system32\ptpusd.exe"
O4 - HKCU\..\Run: [mindex] "C:\WINDOWS\system32\mindex.exe"
O4 - HKCU\..\Run: [tsd32] "C:\WINDOWS\system32\tsd32.exe"
O4 - HKCU\..\Run: [ntmsapi] "C:\WINDOWS\system32\ntmsapi.exe"
O4 - HKCU\..\Run: [dpvvox] "C:\WINDOWS\system32\dpvvox.exe"
O4 - HKCU\..\Run: [scrobj] "C:\WINDOWS\system32\scrobj.exe"
O4 - HKCU\..\Run: [msvcrt20] "C:\WINDOWS\system32\msvcrt20.exe"
O4 - HKCU\..\Run: [msimtf] "C:\WINDOWS\system32\msimtf.exe"
O4 - HKCU\..\Run: [dpnhupnp] "C:\WINDOWS\system32\dpnhupnp.exe"
O4 - HKCU\..\Run: [rasrad] "C:\WINDOWS\system32\rasrad.exe"
O4 - HKCU\..\Run: [msdtcprx] "C:\WINDOWS\system32\msdtcprx.exe"
O4 - HKCU\..\Run: [usrdtea] "C:\WINDOWS\system32\usrdtea.exe"
O4 - HKCU\..\Run: [msltus40] "C:\WINDOWS\system32\msltus40.exe"
O4 - HKCU\..\Run: [msisip] "C:\WINDOWS\system32\msisip.exe"
O4 - HKCU\..\Run: [dpwsock] "C:\WINDOWS\system32\dpwsock.exe"
O4 - HKCU\..\Run: [dpwsockx] "C:\WINDOWS\system32\dpwsockx.exe"
O4 - HKCU\..\Run: [dbnmpntw] "C:\WINDOWS\system32\dbnmpntw.exe"
O4 - HKCU\..\Run: [mucltui] "C:\WINDOWS\system32\mucltui.exe"
O4 - HKCU\..\Run: [lmhsvc] "C:\WINDOWS\system32\lmhsvc.exe"
O4 - HKCU\..\Run: [qcap] "C:\WINDOWS\system32\qcap.exe"
O4 - HKCU\..\Run: [rdpwsx] "C:\WINDOWS\system32\rdpwsx.exe"
O4 - HKCU\..\Run: [dgrpsetu] "C:\WINDOWS\system32\dgrpsetu.exe"
O4 - HKCU\..\Run: [licwmi] "C:\WINDOWS\system32\licwmi.exe"
O4 - HKCU\..\Run: [tapi] "C:\WINDOWS\system32\tapi.exe"
O4 - HKCU\..\Run: [hypertrm] "C:\WINDOWS\system32\hypertrm.exe"
O4 - HKCU\..\Run: [wshrm] "C:\WINDOWS\system32\wshrm.exe"
O4 - HKCU\..\Run: [xenroll] "C:\WINDOWS\system32\xenroll.exe"
O4 - HKCU\..\Run: [racpldlg] "C:\WINDOWS\system32\racpldlg.exe"
O4 - HKCU\..\Run: [ipxpromn] "C:\WINDOWS\system32\ipxpromn.exe"
O4 - HKCU\..\Run: [nvrssl] "C:\WINDOWS\system32\nvrssl.exe"
O4 - HKCU\..\Run: [certmgr] "C:\WINDOWS\system32\certmgr.exe"
O4 - HKCU\..\Run: [kbdhe319] "C:\WINDOWS\system32\kbdhe319.exe"
O4 - HKCU\..\Run: [wmpcore] "C:\WINDOWS\system32\wmpcore.exe"
O4 - HKCU\..\Run: [scrrnnl] "C:\WINDOWS\system32\scrrnnl.exe"
O4 - HKCU\..\Run: [ceutil] "C:\WINDOWS\system32\ceutil.exe"
O4 - HKCU\..\Run: [icmp] "C:\WINDOWS\system32\icmp.exe"
O4 - HKCU\..\Run: [colbact] "C:\WINDOWS\system32\colbact.exe"
O4 - HKCU\..\Run: [kbdusl] "C:\WINDOWS\system32\kbdusl.exe"
O4 - HKCU\..\Run: [ipmontr] "C:\WINDOWS\system32\ipmontr.exe"
O4 - HKCU\..\Run: [duser] "C:\WINDOWS\system32\duser.exe"
O4 - HKCU\..\Run: [javaprxy] "C:\WINDOWS\system32\javaprxy.exe"
O4 - HKCU\..\Run: [polstore] "C:\WINDOWS\system32\polstore.exe"
O4 - HKCU\..\Run: [webclnt] "C:\WINDOWS\system32\webclnt.exe"
O4 - HKCU\..\Run: [vcdex] "C:\WINDOWS\system32\vcdex.exe"
O4 - HKCU\..\Run: [asferror] "C:\WINDOWS\system32\asferror.exe"
O4 - HKCU\..\Run: [dpnet] "C:\WINDOWS\system32\dpnet.exe"
O4 - HKCU\..\Run: [msvfw32] "C:\WINDOWS\system32\msvfw32.exe"
O4 - HKCU\..\Run: [d3d8] "C:\WINDOWS\system32\d3d8.exe"
O4 - HKCU\..\Run: [spmsg] "C:\WINDOWS\system32\spmsg.exe"
O4 - HKCU\..\Run: [wmpdxm] "C:\WINDOWS\system32\wmpdxm.exe"
O4 - HKCU\..\Run: [wldap32] "C:\WINDOWS\system32\wldap32.exe"
O4 - HKCU\..\Run: [sens] "C:\WINDOWS\system32\sens.exe"
O4 - HKCU\..\Run: [winsysmwappio5] "C:\WINDOWS\system32\winsysmwappio5.exe"
Gisteren 20:59
O4 - HKCU\..\Run: [odbccr32] "C:\WINDOWS\system32\odbccr32.exe"
O4 - HKCU\..\Run: [dpnlobby] "C:\WINDOWS\system32\dpnlobby.exe"
O4 - HKCU\..\Run: [xpsp1res] "C:\WINDOWS\system32\xpsp1res.exe"
O4 - HKCU\..\Run: [nwprovau] "C:\WINDOWS\system32\nwprovau.exe"
O4 - HKCU\..\Run: [termsrv] "C:\WINDOWS\system32\termsrv.exe"
O4 - HKCU\..\Run: [encdec] "C:\WINDOWS\system32\encdec.exe"
O4 - HKCU\..\Run: [rapi] "C:\WINDOWS\system32\rapi.exe"
O4 - HKCU\..\Run: [kbdukx] "C:\WINDOWS\system32\kbdukx.exe"
O4 - HKCU\..\Run: [ils] "C:\WINDOWS\system32\ils.exe"
O4 - HKCU\..\Run: [kbdmac] "C:\WINDOWS\system32\kbdmac.exe"
O4 - HKCU\..\Run: [xpsp2res] "C:\WINDOWS\system32\xpsp2res.exe"
O4 - HKCU\..\Run: [extmgr] "C:\WINDOWS\system32\extmgr.exe"
O4 - HKCU\..\Run: [icmui] "C:\WINDOWS\system32\icmui.exe"
O4 - HKCU\..\Run: [odbctrac] "C:\WINDOWS\system32\odbctrac.exe"
O4 - HKCU\..\Run: [rasapi32] "C:\WINDOWS\system32\rasapi32.exe"
O4 - HKCU\..\Run: [shsvcs] "C:\WINDOWS\system32\shsvcs.exe"
O4 - HKCU\..\Run: [nvwrshe] "C:\WINDOWS\system32\nvwrshe.exe"
O4 - HKCU\..\Run: [jgsh400] "C:\WINDOWS\system32\jgsh400.exe"
O4 - HKCU\..\Run: [ntlanui2] "C:\WINDOWS\system32\ntlanui2.exe"
O4 - HKCU\..\Run: [dssenh] "C:\WINDOWS\system32\dssenh.exe"
O4 - HKCU\..\Run: [ciadmin] "C:\WINDOWS\system32\ciadmin.exe"
O4 - HKCU\..\Run: [senscfg] "C:\WINDOWS\system32\senscfg.exe"
O4 - HKCU\..\Run: [olecnv32] "C:\WINDOWS\system32\olecnv32.exe"
O4 - HKCU\..\Run: [rdpdd] "C:\WINDOWS\system32\rdpdd.exe"
O4 - HKCU\..\Run: [wpdtrace] "C:\WINDOWS\system32\wpdtrace.exe"
O4 - HKCU\..\Run: [iyvu9_32] "C:\WINDOWS\system32\iyvu9_32.exe"
O4 - HKCU\..\Run: [mmdrv] "C:\WINDOWS\system32\mmdrv.exe"
O4 - HKCU\..\Run: [cnetcfg] "C:\WINDOWS\system32\cnetcfg.exe"
O4 - HKCU\..\Run: [qdvd] "C:\WINDOWS\system32\qdvd.exe"
O4 - HKCU\..\Run: [mpg4dmod] "C:\WINDOWS\system32\mpg4dmod.exe"
O4 - HKCU\..\Run: [kbdmon] "C:\WINDOWS\system32\kbdmon.exe"
O4 - HKCU\..\Run: [htui] "C:\WINDOWS\system32\htui.exe"
O4 - HKCU\..\Run: [winscard] "C:\WINDOWS\system32\winscard.exe"
O4 - HKCU\..\Run: [msdart] "C:\WINDOWS\system32\msdart.exe"
O4 - HKCU\..\Run: [fwcfg] "C:\WINDOWS\system32\fwcfg.exe"
O4 - HKCU\..\Run: [hccoin] "C:\WINDOWS\system32\hccoin.exe"
O4 - HKCU\..\Run: [cdm] "C:\WINDOWS\system32\cdm.exe"
O4 - HKCU\..\Run: [lpk] "C:\WINDOWS\system32\lpk.exe"
O4 - HKCU\..\Run: [jit] "C:\WINDOWS\system32\jit.exe"
O4 - HKCU\..\Run: [shmedia] "C:\WINDOWS\system32\shmedia.exe"
O4 - HKCU\..\Run: [mcicda] "C:\WINDOWS\system32\mcicda.exe"
O4 - HKCU\..\Run: [jscript] "C:\WINDOWS\system32\jscript.exe"
O4 - HKCU\..\Run: [comcat] "C:\WINDOWS\system32\comcat.exe"
O4 - HKCU\..\Run: [vjoy] "C:\WINDOWS\system32\vjoy.exe"
O4 - HKCU\..\Run: [msapsspc] "C:\WINDOWS\system32\msapsspc.exe"
O4 - HKCU\..\Run: [winsta] "C:\WINDOWS\system32\winsta.exe"
O4 - HKCU\..\Run: [msacm32] "C:\WINDOWS\system32\msacm32.exe"
O4 - HKCU\..\Run: [batmeter] "C:\WINDOWS\system32\batmeter.exe"
O4 - HKCU\..\Run: [asfsipc] "C:\WINDOWS\system32\asfsipc.exe"
O4 - HKCU\..\Run: [nvwimg] "C:\WINDOWS\system32\nvwimg.exe"
O4 - HKCU\..\Run: [wpd_ci] "C:\WINDOWS\system32\wpd_ci.exe"
O4 - HKCU\..\Run: [nvrspt] "C:\WINDOWS\system32\nvrspt.exe"
O4 - HKCU\..\Run: [upnpui] "C:\WINDOWS\system32\upnpui.exe"
O4 - HKCU\..\Run: [wups] "C:\WINDOWS\system32\wups.exe"
O4 - HKCU\..\Run: [nvcod] "C:\WINDOWS\system32\nvcod.exe"
O4 - HKCU\..\Run: [dnsrslvr] "C:\WINDOWS\system32\dnsrslvr.exe"
O4 - HKCU\..\Run: [mspmsnsv] "C:\WINDOWS\system32\mspmsnsv.exe"
O4 - HKCU\..\Run: [wrap_oal] "C:\WINDOWS\system32\wrap_oal.exe"
O4 - HKCU\..\Run: [netman] "C:\WINDOWS\system32\netman.exe"
O4 - HKCU\..\Run: [newdev] "C:\WINDOWS\system32\newdev.exe"
O4 - HKCU\..\Run: [cmpbk32] "C:\WINDOWS\system32\cmpbk32.exe"
O4 - HKCU\..\Run: [jsnl] "C:\WINDOWS\system32\jsnl.exe"
O4 - HKCU\..\Run: [pmailext] "C:\WINDOWS\system32\pmailext.exe"
O4 - HKCU\..\Run: [txflog] "C:\WINDOWS\system32\txflog.exe"
O4 - HKCU\..\Run: [icfgnt5] "C:\WINDOWS\system32\icfgnt5.exe"
O4 - HKCU\..\Run: [bitsprx3] "C:\WINDOWS\system32\bitsprx3.exe"
O4 - HKCU\..\Run: [vbame] "C:\WINDOWS\system32\vbame.exe"
O4 - HKCU\..\Run: [vdmredir] "C:\WINDOWS\system32\vdmredir.exe"
O4 - HKCU\..\Run: [wifeman] "C:\WINDOWS\system32\wifeman.exe"
O4 - HKCU\..\Run: [mdmxsdk] "C:\WINDOWS\system32\mdmxsdk.exe"
O4 - HKCU\..\Run: [spxcoins] "C:\WINDOWS\system32\spxcoins.exe"
O4 - HKCU\..\Run: [wmv8dmoe] "C:\WINDOWS\system32\wmv8dmoe.exe"
O4 - HKCU\..\Run: [wuapi] "C:\WINDOWS\system32\wuapi.exe"
O4 - HKCU\..\Run: [clb] "C:\WINDOWS\system32\clb.exe"
O4 - HKCU\..\Run: [msswch] "C:\WINDOWS\system32\msswch.exe"
O4 - HKCU\..\Run: [wiafbdrv] "C:\WINDOWS\system32\wiafbdrv.exe"
O4 - HKCU\..\Run: [sqlsrv32] "C:\WINDOWS\system32\sqlsrv32.exe"
O4 - HKCU\..\Run: [itiimg3] "C:\WINDOWS\system32\itiimg3.exe"
O4 - HKCU\..\Run: [nlhtml] "C:\WINDOWS\system32\nlhtml.exe"
O4 - HKCU\..\Run: [cewmdm] "C:\WINDOWS\system32\cewmdm.exe"
O4 - HKCU\..\Run: [nvrsko] "C:\WINDOWS\system32\nvrsko.exe"
O4 - HKCU\..\Run: [msimg32] "C:\WINDOWS\system32\msimg32.exe"
O4 - HKCU\..\Run: [adsmsext] "C:\WINDOWS\system32\adsmsext.exe"
O4 - HKCU\..\Run: [tapi32] "C:\WINDOWS\system32\tapi32.exe"
O4 - HKCU\..\Run: [kbdusr] "C:\WINDOWS\system32\kbdusr.exe"
O4 - HKCU\..\Run: [moricons] "C:\WINDOWS\system32\moricons.exe"
O4 - HKCU\..\Run: [inetmib1] "C:\WINDOWS\system32\inetmib1.exe"
O4 - HKCU\..\Run: [msratelc] "C:\WINDOWS\system32\msratelc.exe"
O4 - HKCU\..\Run: [pdh] "C:\WINDOWS\system32\pdh.exe"
O4 - HKCU\..\Run: [shimeng] "C:\WINDOWS\system32\shimeng.exe"
O4 - HKCU\..\Run: [vmmanager] C:\WINDOWS\SYSTEM32\VMMANAGER.EXE
O4 - HKCU\..\Run: [vwmanager] C:\WINDOWS\system32\vwmanager.exe
O4 - HKCU\..\Run: [kbdbene] C:\WINDOWS\system32\kbdbene.exe
O4 - HKCU\..\Run: [wiaservc] C:\WINDOWS\system32\wiaservc.exe
O4 - HKCU\..\Run: [Xjtzjb] C:\Documents and Settings\Paul Ysebaert\Application Data\s?curity\j?vaw.exe
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [wowfax] C:\WINDOWS\system32\wowfax.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - HKCU\..\Run: [msidle] C:\WINDOWS\system32\msidle.exe
O4 - HKCU\..\Run: [msjtes40] C:\WINDOWS\system32\msjtes40.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.ht m (file missing) (HKCU)

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* start je pc in veilige modus!

* Open Kladblok.
Kopieer de onderstaande vetgedrukte tekst en plak deze in een nieuw document.

Code:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TBPSSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TBPSSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TBPSSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TBPSSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\TBPSSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TBPSSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TBPSSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TBPSSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WinToolsSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinToolsSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WinToolsSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinToolsSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WinToolsSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinToolsSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WinToolsSvc]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinToolsSvc]

Kies Bestand -> Opslaan
Selecteer bij "Opslaan in": Bureaublad
Vul bij "Bestandsnaam" in: servicefix.reg
Selecteer bij "Opslaan als type": Alle bestanden
Klik op "Opslaan".

Dubbelklik op servicefix.reg, dat nu op je bureaublad staat.
Ga ermee akkoord dat deze gegevens aan het register worden toegevoegd.

* Doe opnieuw een scan met ewido en verwijder alles dat gevonden wordt, en waar terug het rapport!

* Start de pc opnieuw op en post een nieuw hijackthis logje hier met het rapport van ewido

math · 1 aug 2006

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXE
C:\WINDOWS\system32\UAService7.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.telenet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG

ystem.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: Antifraudewerkbalk van Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: Antifraudewerkbalk van Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [!ewido] "C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120240216328
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://exent.planet.nl/AoDSite/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136384588343
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://gameadvisor.futuremark.com/global/msc37.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

report van ewido

HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc\Enum -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc\Enum -> Adware.WebSearch : Error during cleaning.
C:\Mendoza1.exe -> Downloader.Agent.aru : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Local Settings\Temporary Internet Files\Content.IE5\M5O1EFU5\popup[1].htm -> Hijacker.Agent.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul [email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

Jurgenv1 · 1 aug 2006

* Open kladblok en kopieer en plak het volgende erin:

Code:

sc stop TBPSSvc
sc delete TBPSSvc
sc stop WinToolsSvc
sc delete WinToolsSvc

Sla dit op als remjobs.bat , kies voor opslaan als alle bestanden en plaats het op je bureaublad.
Dubbelklik op remjobs.bat. Een dosvenster zal vlug openen en sluiten. Dit is normaal.

* Doe dan opnieuw een scan met ewido in veilige modus en verwijder alles wat er gevonden wordt, bewaar terug het rapport

* start je pc weer normaal en post een nieuw hijackthis logje hier met het rapport van ewido

math · 1 aug 2006

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXE
C:\WINDOWS\system32\UAService7.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPFW.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.telenet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG

ystem.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: Antifraudewerkbalk van Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: Antifraudewerkbalk van Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [!ewido] "C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE" /minimized
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120240216328
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://exent.planet.nl/AoDSite/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136384588343
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://gameadvisor.futuremark.com/global/msc37.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 16:10:35 1/08/2006

+ Scan result:

HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc\Enum -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc\Enum -> Adware.WebSearch : Error during cleaning.
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

::Report end

Jurgenv1 · 1 aug 2006

1. Download The Avenger by Swandog46 naar je Bureaublad.

Klik op Avenger.zip om het uit te pakken naar je bureaublad

2. Nu, start The Avenger door op het icoontje met het zwaard te dubbelklikken.

Onder "Script file to execute" kies "Input Script Manually".
Klik op het vergrootglas icoontje die een niew venster zal openen met de naam "View/edit script"

Kopieer en plak volgend volledig vetgedrukt erin:

Code:

Registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TBPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TBPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TBPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TBPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\TBPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TBPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TBPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TBPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WinToolsSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinToolsSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WinToolsSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinToolsSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WinToolsSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinToolsSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WinToolsSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinToolsSvc

Opgelet: Bovenstaande code werd enkel gemaakt voor deze computer/situatie/user. Indien je deze code op een andere computer gebruikt kan het schade toebrengen!

Klik Done
Daarna klik op het Groen verkeerslicht om het script uit te voeren
Antwoord "Yes/Ja" wanneer daarnaar gevraagd wordt.

3. The Avenger zal daarna het volgende doen:

Uw computer herstarten. ( In gevallen waar het script een code bevat met "Drivers to Unload", dan zal The Avenger tweemaal uw systeem herstarten)
Na herstart, zal het vlug een zwart command window openen. Dit is normaal.
Na herstart, zal het een log maken die zal openen met de resultaten van The Avenger. Deze log zal te vinden zijn op C:\avenger.txt
The Avenger maakt ook backups aan met alle bestanden, etc., die eerder werden verwijderd door The Avenger, deze backups bevinden zich op volgende plaats: C:\avenger\backup.zip.

4. Kopieer en plak de inhoud van avenger.txt in je volgende post samen met een nieuw hijackthislog.

math · 1 aug 2006

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ytrpkgdq

*******************

Script file located at: \??\C:\Program Files\^ujnappe.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TBPSSvc deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TBPSSvc deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TBPSSvc not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TBPSSvc failed!

Could not process line:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TBPSSvc
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TBPSSvc not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TBPSSvc failed!

Could not process line:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TBPSSvc
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\TBPSSvc not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\TBPSSvc failed!

Could not process line:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\TBPSSvc
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TBPSSvc not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TBPSSvc failed!

Could not process line:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TBPSSvc
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_TBPSSvc deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TBPSSvc deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WinToolsSvc deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinToolsSvc deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WinToolsSvc not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WinToolsSvc failed!

Could not process line:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WinToolsSvc
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinToolsSvc not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinToolsSvc failed!

Could not process line:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinToolsSvc
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WinToolsSvc not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WinToolsSvc failed!

Could not process line:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WinToolsSvc
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinToolsSvc not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinToolsSvc failed!

Could not process line:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinToolsSvc
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WinToolsSvc deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinToolsSvc deleted successfully.

Completed script processing.

Logfile of HijackThis v1.99.1
Scan saved at 19:05:12, on 1/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXE
C:\WINDOWS\system32\UAService7.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.telenet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG

ystem.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: Antifraudewerkbalk van Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: Antifraudewerkbalk van Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [!ewido] "C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120240216328
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://exent.planet.nl/AoDSite/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136384588343
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://gameadvisor.futuremark.com/global/msc37.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Jurgenv1 · 2 aug 2006

Fix volgende regel in hijackthis:

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)

* Doe dan opnieuw een scan met ewido in veilige modus en verwijder alles wat er gevonden wordt, bewaar ook terug het rapport

* Start je pc weer normaal en post een nieuw hijackthis logje hier met het rapport van ewido

math · 2 aug 2006

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 16:10:35 1/08/2006

+ Scan result:

HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc\Enum -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc -> Adware.WebSearch : Error during cleaning.
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc\Enum -> Adware.WebSearch : Error during cleaning.
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Paul Ysebaert\Cookies\paul ysebaert@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

::Report end

Logfile of HijackThis v1.99.1
Scan saved at 22:25:15, on 2/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXE
C:\WINDOWS\system32\UAService7.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPFW.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis\HijackThis.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TSC.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.telenet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenet Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG

ystem.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: Antifraudewerkbalk van Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O3 - Toolbar: Antifraudewerkbalk van Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [!ewido] "C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120240216328
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://exent.planet.nl/AoDSite/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136384588343
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://gameadvisor.futuremark.com/global/msc37.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Jurgenv1 · 2 aug 2006

Probeer eens volgend script in avenger en meld het resultaat terug hier:

Code:

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc

math · 3 aug 2006

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\gyylmyks

*******************

Script file located at: \??\C:\WINDOWS\system32\jhidbsst.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Registry key HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\TBPSSvc
Status: 0xc0000034

Registry key HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\WinToolsSvc
Status: 0xc0000034

Completed script processing.

Jurgenv1 · 3 aug 2006

Download en unzip Service.bat naar je bureaublad:
http://users.telenet.be/marcvn/tools/service.zip
Dubbelklik op service.bat en wacht eventjes geduldig af. Post dan de inhoud dat je in kladblok krijgt hier.

math · 4 aug 2006

SERVICES
--------
ALCXWDM
aswTdi
atksgt
dtscsi
ENTECH
ewido anti-spyware 4.0 driver
ewido anti-spyware 4.0 guard
gafwload
gameenum
gtermddo
itchfltr
L8042PRT
lirsgt
LSERMOUS
MCSTRM
ms_mpu401
nm
PcCtlCom
prodrv06
prohlp02
ScsiPort
Sentinel
sfdrv01
sfhlp01
sfhlp02
sfvfs02
Sntnlusb
sptd
SPTISRV
StillCam
swwd
Tmfilter
Tmntsrv
TmPfw
Tmpreflt
tmproxy
tmtdi
tm_cfw
usb
usbccgp
usbprint
usbscan
UserAccess7
vaxscsi
viasraid
Vsapint
VXD
wanusb
wceusbsh
Wmi
WpdUsb
XPROTECTOR
{6982C228-6F56-4FAA-9062-B061EB232147}
{7DFE3A19-342B-463D-B6C2-7458CB2D7829}
{BC6BC694-22BA-4799-BF86-44889F80A808}

SAFEBOOT MINIMAL SERVICES
-------------------------
vds
{533C5B84-EC70-11D2-9505-00C04F79DEAF}

SAFEBOOT NETWORK SERVICES
-------------------------
nm
nm.sys
UploadMgr

Finished

Jurgenv1 · 4 aug 2006

Vreemd...Kan je ewido eens updaten en dan nog eens een scan doen met ewido in veilige modus en terug hier het rapport posten?

Archief - purityscan

math

Legacy Member

math

Legacy Member

Jurgenv1

Legacy Member

math

Legacy Member

math

Legacy Member

Jurgenv1

Legacy Member

math

Legacy Member

Jurgenv1

Legacy Member

math

Legacy Member

Jurgenv1

Legacy Member

math

Legacy Member

Jurgenv1

Legacy Member

math

Legacy Member

Jurgenv1

Legacy Member

math

Legacy Member

Jurgenv1

Legacy Member

math

Legacy Member

Jurgenv1

Legacy Member