Archief - hardnekkige spyware

een vrij lastig spyware probleem op de laptop van m'n pa. 't is wel één van z'n werk en er staat veel software daarvan op (novell, oracle, webdrive en nog wat dingen) en 't is wat moeilijk om die te onderscheiden tussen de spyware

probleem bestaat uit: twee icoontjes in startbalk, waarvan er één altijd meldingen geeft over virussen/malware/... met daarbij links voor te downloaden, maar het is overduidelijk niet de virusscanner (symantec jammer genoeg, maar 't is van het werk...) want die vindt niets bij een scan
ze zijn ook aanwezig in veilige modus, maar 'k vind niet meteen hoe ze opgestart worden

verder stonden er ook nog wat dubieuze programma's bij software, maar die heb ik gede-installeerd, maar geen verschil zichtbaar
verder nog pop-ups (altijd over virusinfecties e.d.) en startpagina die verandert

al gescand met symantec en spybot s&d, beiden niets gevonden

HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 22:49:35, on 29/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\System32\Novell\XTAgent.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINXP\system32\spoolsv.exe
c:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Novell\ZENworks\nalntsrv.exe
c:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
c:\Program Files\Symantec AntiVirus\SavRoam.exe
c:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\WebDrive\wdservice.exe
c:\Program Files\Novell\ZENworks\wm.exe
C:\WINXP\Explorer.EXE
C:\Program Files\Security Tools\iesmn.exe
C:\Program Files\Security Tools\imsmain.exe
C:\Program Files\Security Tools\iesmin.exe
C:\WINXP\system32\hkcmd.exe
C:\Program Files\Security Tools\imsmn.exe
C:\WINXP\system32\igfxpers.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINXP\stsystra.exe
C:\WINXP\system32\igfxsrvc.exe
C:\WINXP\system32\dpmw32.exe
C:\WINXP\system32\iprntlgn.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINXP\system32\NWTRAY.EXE
C:\Program Files\WebDrive\webdrive.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINXP\system32\ctfmon.exe
c:\Program Files\Novell\ZENworks\NalAgent.exe
c:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINXP\system32\rundll32.exe
C:\WINXP\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\GDMULDER\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www1.vdab.be/NSearch/SearchServlet?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = intranet.vdab.be
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by VDAB
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = intproxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = secured.vdab.be;10.200.1.*;ifolder.vdab.be;vdab-w*.vdab.be;webacc.vdab.be;amiwf1.vdab.be;amiwf2.vdab.be;amiwf3.vdab.be;amiwf4.vdab.be;amiwf5.vdab.be;amiweb.vdab.be;vdab.be;www.vdab.be;intranet.vdab.be;dm-cvs.vdab.be;clientvolgsysteem.vdab.be;bibliotheek.vdab.be;lmsdev.vdab.be;lmsprod.vdab.be;finlog.vdab.be;finlog89.vdab.be;finlogtrn.vdab.be;huiz*bm.vdab.be;communities.vdab.be;eadvantage.siemens.com;intproxy.vdab.be;<local>
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Security Tools\iesplg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINXP\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINXP\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINXP\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NDPS] C:\WINXP\system32\dpmw32.exe
O4 - HKLM\..\Run: [iPrint Event Monitor] C:\WINXP\system32\iprntlgn.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] c:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] c:\WINXP\system32\zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [QTrustLogout] C:\Program Files\VDAB iNetInfo\qtrust.exe LOGOUT
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WebDriveTray] "C:\Program Files\WebDrive\webdrive.exe" /trayicon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [SecurityUpdate] rundll32.exe C:\WINXP\system32\kaxjqct.dll,TurnOn2
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Application Explorer.lnk = C:\Program Files\Novell\ZENworks\NalView.exe
O4 - Global Startup: LaptopLogin.lnk = C:\Program Files\VDAB Tools\LaptopLogin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - c:\Program Files\Novell\ZENworks\AxNalServer.dll
O14 - IERESET.INF: START_PAGE_URL=intranet.vdab.be
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://communities.vdab.be/qp2.cab
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINXP\msxml4.cab
O16 - DPF: {CAFECAFE-0013-0001-0014-ABCDEFABCDEF} (JInitiator 1.3.1.14) -
O16 - DPF: {CAFECAFE-0013-0001-0017-ABCDEFABCDEF} (JInitiator 1.3.1.17) -
O16 - DPF: {CAFECAFE-0013-0001-0018-ABCDEFABCDEF} (JInitiator 1.3.1.18) -
O20 - Winlogon Notify: igfxcui - C:\WINXP\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - c:\WINXP\system32\NavLogon.dll
O20 - Winlogon Notify: NetIdentity Notification - C:\WINXP\system32\Novell\XtNotify.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINXP\system32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - c:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - c:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Oracle%ORACLE_HOME_SERVICE%ClientCache80 - Unknown owner - c:\ORANT\BIN\ONRSD80.EXE
O23 - Service: OracleClientCache80 - Unknown owner - c:\ORANT\BIN\ONRSD80.EXE
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - c:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - c:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - c:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINXP\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - c:\Program Files\Novell\ZENworks\wm.exe


edit: 'k was hitman pro helemaal vergeten, eerst nog eens dat laten lopen

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

logje van combofix (je moet trouwens "1" intikken om verder te gaan, niet Y):

"GDMULDER" - 2007-06-30 9:11:57 - ComboFix 07-06-27.7 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\PopsMedia Site Adviser
C:\Program Files\security tools
C:\Program Files\security tools\iesbunst.exe
C:\Program Files\security tools\iesmin.exe
C:\Program Files\security tools\iesmn.exe
C:\Program Files\security tools\iesplg.dll
C:\Program Files\security tools\iesunst.exe
C:\Program Files\security tools\imsmain.exe
C:\Program Files\security tools\imsmn.exe
C:\Program Files\security tools\imsunst.exe
C:\Program Files\security tools\ot.ico
C:\Program Files\security tools\ts.ico


((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-30 )))))))))))))))))))))))))))))))


2007-06-30 09:11 49,152 --a------ C:\WINXP\nircmd.exe
2007-06-29 23:23 <DIR> d-------- C:\DOCUME~1\GDMULDER\APPLIC~1\Lavasoft
2007-06-29 23:18 83,024 --a------ C:\WINXP\system32\drivers\iksyssec.sys
2007-06-29 23:18 626,688 --a------ C:\WINXP\system32\msvcr80.dll
2007-06-29 23:18 57,424 --a------ C:\WINXP\system32\drivers\iksysflt.sys
2007-06-29 23:18 53,840 --a------ C:\WINXP\system32\drivers\ikfilesec.sys
2007-06-29 23:18 39,376 --a------ C:\WINXP\system32\drivers\ikfileflt.sys
2007-06-29 23:18 29,264 --a------ C:\WINXP\system32\drivers\kcom.sys
2007-06-29 23:18 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-06-29 23:18 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-06-29 23:18 <DIR> d-------- C:\DOCUME~1\GDMULDER\APPLIC~1\PC Tools
2007-06-29 23:17 22,080 --a------ C:\WINXP\system32\drivers\sshrmd.sys
2007-06-29 23:17 21,056 --a------ C:\WINXP\system32\drivers\sskbfd.sys
2007-06-29 23:17 20,544 --a------ C:\WINXP\system32\drivers\SSFS0509.sys
2007-06-29 23:17 164 --a------ C:\install.dat
2007-06-29 23:17 144,960 --a------ C:\WINXP\system32\drivers\ssidrv.sys
2007-06-29 23:17 <DIR> d-------- C:\Program Files\Webroot
2007-06-29 23:17 <DIR> d-------- C:\Program Files\Lavasoft
2007-06-29 23:17 <DIR> d-------- C:\DOCUME~1\GDMULDER\APPLIC~1\Webroot
2007-06-29 23:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-06-29 23:16 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-06-29 23:03 <DIR> d-------- C:\Program Files\Hitman Pro
2007-06-29 19:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-29 19:54 <DIR> d-------- C:\WINXP\pss
2007-06-13 16:10 <DIR> d-------- C:\DOCUME~1\GDMULDER\APPLIC~1\Help
2007-06-13 14:59 <DIR> d-------- C:\Zenworks
2007-06-13 14:18 <DIR> d---s---- C:\DOCUME~1\GDMULDER\UserData
2007-06-13 13:39 <DIR> d-------- C:\Gegevens
2007-06-13 11:56 <DIR> d-------- C:\data
2007-06-13 11:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SAS
2007-06-13 11:37 <DIR> d-------- C:\DOCUME~1\GDMULDER\APPLIC~1\SAS
2007-06-13 11:32 13,600 --------- C:\WINXP\system32\sasperf.dll
2007-06-13 11:24 974,848 --a------ C:\WINXP\system32\mfc70.dll
2007-06-13 11:24 964,608 --a------ C:\WINXP\system32\mfc70u.dll
2007-06-13 11:24 84,992 --a------ C:\WINXP\system32\atl70.dll
2007-06-13 11:24 54,784 --a------ C:\WINXP\system32\msvci70.dll
2007-06-13 11:24 487,424 --a------ C:\WINXP\system32\msvcp70.dll
2007-06-13 11:24 344,064 --a------ C:\WINXP\system32\msvcr70.dll
2007-06-13 11:24 1,700,352 --a------ C:\WINXP\system32\gdiplus.dll
2007-06-13 11:20 <DIR> d-------- C:\Program Files\SAS
2007-06-13 11:06 151,552 --a------ C:\WINXP\system32\igfxres.dll
2007-06-13 11:00 9,600 --a------ C:\WINXP\system32\drivers\hidusb.sys
2007-06-13 11:00 14,848 --a------ C:\WINXP\system32\drivers\kbdhid.sys
2007-06-13 11:00 12,160 --a------ C:\WINXP\system32\drivers\mouhid.sys
2007-06-13 10:54 8,192 --a------ C:\DOCUME~1\GDMULDER\netcache.dat
2007-06-13 10:35 <DIR> d-------- C:\DOCUME~1\GDMULDER\Oracle Jar Cache
2007-06-13 10:20 36,943 --------- C:\WINXP\system32\ActPanel.dll
2007-06-13 10:20 303,104 --a------ C:\WINXP\enableWOL.exe
2007-06-13 10:20 <DIR> d-------- C:\Program Files\Dell
2007-06-13 10:20 <DIR> d-------- C:\DOCUME~1\GDMULDER\.jinit
2007-06-13 10:19 815,104 --a------ C:\WINXP\system32\wdcl32.dll
2007-06-13 10:19 491,520 --a------ C:\WINXP\system32\RFHelper.dll
2007-06-13 10:19 49,152 --a------ C:\WINXP\system32\rfshres.dll
2007-06-13 10:19 36,864 --a------ C:\WINXP\system32\rfhres.dll
2007-06-13 10:19 249,856 --a------ C:\WINXP\system32\rfshext.dll
2007-06-13 10:19 24,576 --a------ C:\WINXP\system32\rfstrres.dll
2007-06-13 10:19 217,088 --a------ C:\WINXP\system32\rfwdres.dll
2007-06-13 10:19 16,384 --a------ C:\WINXP\system32\rfwdui.dll
2007-06-13 10:19 159,744 --a------ C:\WINXP\system32\RFNP32.dll
2007-06-13 10:19 131,072 --a------ C:\WINXP\system32\wdResDll.dll
2007-06-13 10:19 125 --a------ C:\WINXP\system32\chgshr.cmd
2007-06-13 10:19 <DIR> d-------- C:\Program Files\WebDrive
2007-06-13 10:19 <DIR> d-------- C:\DOCUME~1\GDMULDER\webdrive
2007-06-13 10:18 77,824 --a------ C:\WINXP\system32\Lffax10n.dll
2007-06-13 10:18 56,320 --a------ C:\WINXP\system32\Lfpsd10n.dll
2007-06-13 10:18 46,592 --a------ C:\WINXP\system32\Lfica10n.dll
2007-06-13 10:18 41,472 --a------ C:\WINXP\system32\Lfgif10n.dll
2007-06-13 10:18 397,856 --a------ C:\WINXP\system32\XceedZip.dll
2007-06-13 10:18 34,304 --a------ C:\WINXP\system32\Lfbmp10n.dll
2007-06-13 10:18 338,944 --a------ C:\WINXP\system32\Lffpx7.dll
2007-06-13 10:18 33,280 --a------ C:\WINXP\system32\Lfpcx10n.dll
2007-06-13 10:18 31,744 --a------ C:\WINXP\system32\Lflmb10n.dll
2007-06-13 10:18 31,232 --a------ C:\WINXP\system32\Lfpct10n.dll
2007-06-13 10:18 297,472 --a------ C:\WINXP\system32\Ltkrn10n.dll
2007-06-13 10:18 27,648 --a------ C:\WINXP\system32\Lftga10n.dll
2007-06-13 10:18 27,136 --a------ C:\WINXP\system32\Lfwfx10n.dll
2007-06-13 10:18 27,136 --a------ C:\WINXP\system32\Lfimg10n.dll
2007-06-13 10:18 27,136 --a------ C:\WINXP\system32\Lfcal10n.dll
2007-06-13 10:18 266,752 --a------ C:\WINXP\system32\Lfcmp10n.dll
2007-06-13 10:18 26,112 --a------ C:\WINXP\system32\Lfras10n.dll
2007-06-13 10:18 26,112 --a------ C:\WINXP\system32\Lfpcd10n.dll
2007-06-13 10:18 26,112 --a------ C:\WINXP\system32\Lfmsp10n.dll
2007-06-13 10:18 257,024 --a------ C:\WINXP\system32\Ltann10n.dll
2007-06-13 10:18 25,600 --a------ C:\WINXP\system32\Lfmac10n.dll
2007-06-13 10:18 231,424 --a------ C:\WINXP\system32\Ltdis10n.dll
2007-06-13 10:18 212,480 --a------ C:\WINXP\system32\PcdLib32.dll
2007-06-13 10:18 134,144 --a------ C:\WINXP\system32\Lfpng10n.dll
2007-06-13 10:18 122,880 --a------ C:\WINXP\system32\Lfkodak.dll
2007-06-13 10:18 122,368 --a------ C:\WINXP\system32\Lftif10n.dll
2007-06-13 10:18 114,176 --a------ C:\WINXP\system32\Ltimg10n.dll
2007-06-13 10:18 103,424 --a------ C:\WINXP\system32\Ltfil10n.dll
2007-06-13 10:18 100,352 --a------ C:\WINXP\system32\Lffpx10n.dll
2007-06-13 10:18 <DIR> d-------- C:\Program Files\iGrafx
2007-06-13 10:18 <DIR> d-------- C:\Program Files\Common Files\iGrafx
2007-06-13 10:18 <DIR> d-------- C:\Office10
2007-06-13 10:18 <DIR> d-------- C:\DOCUME~1\GDMULDER\APPLIC~1\iGrafx
2007-06-13 10:17 86,016 --a------ C:\WINXP\system32\pxwma.dll
2007-06-13 10:17 49,152 --a------ C:\WINXP\system32\umloader.dll
2007-06-13 10:17 17,168 --a------ C:\WINXP\system32\drivers\pxhelp20.sys
2007-06-13 10:17 <DIR> d-------- C:\Program Files\Sonic


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-30 07:09:46 -------- d-----w C:\Program Files\Symantec AntiVirus
2007-06-29 13:23:09 8,704 --s-a-w C:\WINXP\system32\rxqcpn.dll
2007-06-22 09:45:57 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-13 09:47:12 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-13 09:18:06 -------- d-----w C:\Program Files\SAS Institute
2007-06-13 08:23:12 -------- d-----w C:\Program Files\VDAB Tools
2007-06-13 08:20:15 -------- d-----w C:\Program Files\VDAB iNetInfo
2007-06-13 08:20:00 -------- d-----w C:\Program Files\Oracle
2007-04-06 10:47:20 53,248 ----a-w C:\WINXP\system32\GWABS1NL.Dll
2007-04-06 10:47:20 53,248 ----a-w C:\WINXP\system32\GWABP1NL.Dll
2007-04-06 10:47:16 57,344 ----a-w C:\WINXP\system32\GWABL1NL.Dll
2007-04-06 10:08:06 24,576 ----a-w C:\WINXP\system32\GWSHL1NL.Dll
2007-04-06 09:45:56 16,384 ----a-w C:\WINXP\system32\GWODMNL.Dll
2007-04-06 09:24:32 290,816 ----a-w C:\WINXP\system32\GWMSP1NL.Dll
2007-04-06 09:24:30 282,624 ----a-w C:\WINXP\system32\GWXPP1NL.Dll
2007-04-06 08:10:36 258,048 ----a-w C:\WINXP\system32\GWENL1NL.Dll
2007-04-05 23:55:48 974,902 ----a-w C:\WINXP\system32\GWMSP132.DLL
2007-04-05 23:55:10 208,950 ----a-w C:\WINXP\system32\GWXPP132.DLL
2007-04-05 23:51:22 757,818 ----a-w C:\WINXP\system32\GWADD1.dll
2007-04-05 23:49:36 16,384 ----a-w C:\WINXP\system32\gwodmUS.dll
2007-04-05 23:49:34 303,166 ----a-w C:\WINXP\system32\GWODM132.DLL
2007-04-05 23:48:14 24,576 ----a-w C:\WINXP\system32\GWSHL1US.dll
2007-04-05 23:48:12 32,836 ----a-w C:\WINXP\system32\Gwshlimp.exe
2007-04-05 23:48:12 28,740 ----a-w C:\WINXP\system32\gwshlsnd.exe
2007-04-05 23:48:10 45,124 ----a-w C:\WINXP\system32\GWSHLEXT.DLL
2007-04-05 23:48:08 36,932 ----a-w C:\WINXP\system32\gwcnndll.dll
2007-04-05 23:21:38 57,344 ----a-w C:\WINXP\system32\GWABL1US.DLL
2007-04-05 23:21:38 245,810 ----a-w C:\WINXP\system32\GWABL132.DLL
2007-04-05 23:21:14 98,354 ----a-w C:\WINXP\system32\GWLDO132.DLL
2007-04-05 23:21:06 53,248 ----a-w C:\WINXP\system32\GWABS1US.DLL
2007-04-05 23:21:06 311,345 ----a-w C:\WINXP\system32\GWABS132.dll
2007-04-05 23:20:44 53,248 ----a-w C:\WINXP\system32\GWABP1US.DLL
2007-04-05 23:20:42 307,249 ----a-w C:\WINXP\system32\GWABP132.dll
2007-04-05 22:28:42 274,503 ----a-w C:\WINXP\system32\xgcal10.DLL
2007-04-05 22:28:16 1,728,583 ----a-w C:\WINXP\system32\xgmsg10.DLL
2007-04-05 22:26:58 581,701 ----a-w C:\WINXP\system32\xgdm10.DLL
2007-04-05 22:26:30 553,029 ----a-w C:\WINXP\system32\xgab10.DLL
2007-04-05 22:20:52 1,331,264 ----a-w C:\WINXP\system32\GWWWW1.dll
2007-04-05 22:16:42 6,344,757 ----a-w C:\WINXP\system32\gwenv1.DLL
2007-04-05 22:16:26 835,655 ----a-w C:\WINXP\system32\xgbas10.DLL
2007-04-05 21:00:28 286,720 ----a-w C:\WINXP\system32\gwmsp1US.dll
2007-04-05 21:00:28 282,624 ----a-w C:\WINXP\system32\gwxpp1US.dll
2007-04-05 21:00:10 225,280 ----a-w C:\WINXP\system32\GWENL1US.DLL


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 03:25]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 00:13]
"SigmatelSysTrayApp"="stsystra.exe" [2006-01-09 05:33 C:\WINXP\stsystra.exe]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 13:02]
"vptray"="c:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-05-27 03:01]
"NWTRAY"="NWTRAY.EXE" [2002-03-12 11:37 C:\WINXP\system32\nwtray.exe]
"QTrustLogout"="C:\Program Files\VDAB iNetInfo\qtrust.exe" [2006-05-22 10:43]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 01:01]
"WebDriveTray"="C:\Program Files\WebDrive\webdrive.exe" [2003-10-08 23:00]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINXP\system32\ctfmon.exe" [2004-08-03 18:56]
"Sonic RecordNow!"="" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"CompatibleRUPSecurity"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"=1 (0x1)
"NoStartMenuMorePrograms"=1 (0x1)
"NoAutoUpdate"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}"="C:\WINXP\system32\rxqcpn.dll" [2007-06-29 15:23]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{763370C4-268E-4308-A60C-D8DA0342BE32}"="c:\Program Files\Novell\ZENworks\NalShell.dll" [2006-06-28 14:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="ziswin.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NetIdentity Notification]
C:\WINXP\system32\Novell\XtNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages msv1_0 nwv1_0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService]

*Newly Created Service* - RFNP32
*Newly Created Service* - WEBDRIVEFSD
*Newly Created Service* - WEBDRIVESERVICE

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-30 09:13:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-30 9:14:06
C:\ComboFix-quarantined-files.txt ... 2007-06-30 09:14

--- E O F ---


nieuwe hjt (daar moest toch geen reboot tussen, ofwel?)

Logfile of HijackThis v1.99.1
Scan saved at 9:15:31, on 30/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\System32\Novell\XTAgent.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINXP\system32\spoolsv.exe
c:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Novell\ZENworks\nalntsrv.exe
c:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
c:\Program Files\Symantec AntiVirus\SavRoam.exe
c:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\WebDrive\wdservice.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
c:\Program Files\Novell\ZENworks\wm.exe
C:\WINXP\system32\hkcmd.exe
C:\WINXP\system32\igfxpers.exe
C:\WINXP\system32\igfxsrvc.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINXP\stsystra.exe
C:\WINXP\system32\dpmw32.exe
C:\WINXP\system32\iprntlgn.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINXP\system32\NWTRAY.EXE
C:\Program Files\WebDrive\webdrive.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINXP\system32\ctfmon.exe
c:\Program Files\Novell\ZENworks\NalAgent.exe
c:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINXP\explorer.exe
C:\Documents and Settings\GDMULDER\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = intranet.vdab.be
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = intproxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = secured.vdab.be;10.200.1.*;ifolder.vdab.be;vdab-w*.vdab.be;webacc.vdab.be;amiwf1.vdab.be;amiwf2.vdab.be;amiwf3.vdab.be;amiwf4.vdab.be;amiwf5.vdab.be;amiweb.vdab.be;vdab.be;www.vdab.be;intranet.vdab.be;dm-cvs.vdab.be;clientvolgsysteem.vdab.be;bibliotheek.vdab.be;lmsdev.vdab.be;lmsprod.vdab.be;finlog.vdab.be;finlog89.vdab.be;finlogtrn.vdab.be;huiz*bm.vdab.be;communities.vdab.be;eadvantage.siemens.com;intproxy.vdab.be;<local>
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] c:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [QTrustLogout] C:\Program Files\VDAB iNetInfo\qtrust.exe LOGOUT
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WebDriveTray] "C:\Program Files\WebDrive\webdrive.exe" /trayicon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Application Explorer.lnk = C:\Program Files\Novell\ZENworks\NalView.exe
O4 - Global Startup: LaptopLogin.lnk = C:\Program Files\VDAB Tools\LaptopLogin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - c:\Program Files\Novell\ZENworks\AxNalServer.dll
O14 - IERESET.INF: START_PAGE_URL=intranet.vdab.be
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://communities.vdab.be/qp2.cab
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINXP\msxml4.cab
O16 - DPF: {CAFECAFE-0013-0001-0014-ABCDEFABCDEF} (JInitiator 1.3.1.14) -
O16 - DPF: {CAFECAFE-0013-0001-0017-ABCDEFABCDEF} (JInitiator 1.3.1.17) -
O16 - DPF: {CAFECAFE-0013-0001-0018-ABCDEFABCDEF} (JInitiator 1.3.1.18) -
O20 - Winlogon Notify: igfxcui - C:\WINXP\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - c:\WINXP\system32\NavLogon.dll
O20 - Winlogon Notify: NetIdentity Notification - C:\WINXP\system32\Novell\XtNotify.dll
O20 - Winlogon Notify: WRNotifier - C:\WINXP\SYSTEM32\WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINXP\system32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - c:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - c:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Oracle%ORACLE_HOME_SERVICE%ClientCache80 - Unknown owner - c:\ORANT\BIN\ONRSD80.EXE
O23 - Service: OracleClientCache80 - Unknown owner - c:\ORANT\BIN\ONRSD80.EXE
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - c:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - c:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - c:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINXP\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - c:\Program Files\Novell\ZENworks\wm.exe

en alvast bedankt!

Download roguescanfix_setup.

Dubbelklik op roguescanfix_setup om het te installeren.

Na de installatie krijg je de vraag om het programma te laten opstarten. Kies dan JA/YES.

Nota: Deze tool heeft internet connectie nodig zodat het een extra bestand kan downloaden om deze tool te laten werken.
Indien je Firewall een alert geeft, sta het toe en blokkeer het niet
Indien je daarna nog steeds de melding krijgt dat BFU.exe niet aanwezig is, download BFU.exe van hier.
Unzip het en plaats BFU.exe in de c:\PROGRAM FILES\Roguescanfix-map. Dubbelklik daarna opnieuw op Roguescanfix.bat

Er zal een dosvenster openen met een keuzemenu.
Kies hier optie #1: Run roguescanfix

Deze tool zal sommige ongewenste programma's deïnstalleren en gerelateerde bestanden en registersleutels verwijderen.
Indien sommige bestanden niet kunnen verwijderd worden, zal deze tool vragen of je je pc opnieuw wilt opstarten.
Zorg er wel eerst voor dat het deïnstalleren van de ongewenste programma's voltooid is vooraleer je op 'Yes' klikt om je pc opnieuw te laten opstarten.

Er zal een kladblokbestandje openen. Plaats de inhoud van dat bestandje in je volgende antwoord, samen met een nieuw logje van Hijackthis.
(Het bestandje vind je ook in c:\program files\roguescanfix\task.txt)

Export SharedTaskScheduler key
------------------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}"="coenosarc"


sharedtaskkey: 68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3
---------------------------------------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}\InProcServer32]
@="C:\\WINXP\\system32\\rxqcpn.dll"
"ThreadingModel"="Apartment"


Logfile of HijackThis v1.99.1
Scan saved at 11:14:11, on 1/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\System32\Novell\XTAgent.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINXP\system32\spoolsv.exe
c:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Novell\ZENworks\nalntsrv.exe
c:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
c:\Program Files\Symantec AntiVirus\SavRoam.exe
c:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\WebDrive\wdservice.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
c:\Program Files\Novell\ZENworks\wm.exe
c:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINXP\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINXP\system32\NWTRAY.EXE
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\WebDrive\webdrive.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINXP\system32\ctfmon.exe
c:\Program Files\Novell\ZENworks\NalAgent.exe
C:\WINXP\Explorer.exe
C:\Documents and Settings\GDMULDER\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www1.vdab.be/NSearch/SearchServlet?
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.vdab.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = intranet.vdab.be
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by VDAB
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = intproxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = secured.vdab.be;10.200.1.*;ifolder.vdab.be;vdab-w*.vdab.be;webacc.vdab.be;amiwf1.vdab.be;amiwf2.vdab.be;amiwf3.vdab.be;amiwf4.vdab.be;amiwf5.vdab.be;amiweb.vdab.be;vdab.be;www.vdab.be;intranet.vdab.be;dm-cvs.vdab.be;clientvolgsysteem.vdab.be;bibliotheek.vdab.be;lmsdev.vdab.be;lmsprod.vdab.be;finlog.vdab.be;finlog89.vdab.be;finlogtrn.vdab.be;huiz*bm.vdab.be;communities.vdab.be;eadvantage.siemens.com;intproxy.vdab.be;<local>
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] c:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [QTrustLogout] "C:\Program Files\VDAB iNetInfo\qtrust.exe" LOGOUT
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WebDriveTray] "C:\Program Files\WebDrive\webdrive.exe" /trayicon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Application Explorer.lnk = C:\Program Files\Novell\ZENworks\NalView.exe
O4 - Global Startup: LaptopLogin.lnk = C:\Program Files\VDAB Tools\LaptopLogin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - c:\Program Files\Novell\ZENworks\AxNalServer.dll
O14 - IERESET.INF: START_PAGE_URL=intranet.vdab.be
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://communities.vdab.be/qp2.cab
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINXP\msxml4.cab
O16 - DPF: {CAFECAFE-0013-0001-0014-ABCDEFABCDEF} (JInitiator 1.3.1.14) -
O16 - DPF: {CAFECAFE-0013-0001-0017-ABCDEFABCDEF} (JInitiator 1.3.1.17) -
O16 - DPF: {CAFECAFE-0013-0001-0018-ABCDEFABCDEF} (JInitiator 1.3.1.18) -
O20 - Winlogon Notify: igfxcui - C:\WINXP\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - c:\WINXP\system32\NavLogon.dll
O20 - Winlogon Notify: NetIdentity Notification - C:\WINXP\system32\Novell\XtNotify.dll
O20 - Winlogon Notify: WRNotifier - C:\WINXP\SYSTEM32\WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINXP\system32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - c:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - c:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Oracle%ORACLE_HOME_SERVICE%ClientCache80 - Unknown owner - c:\ORANT\BIN\ONRSD80.EXE
O23 - Service: OracleClientCache80 - Unknown owner - c:\ORANT\BIN\ONRSD80.EXE
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - c:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - c:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - c:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINXP\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - c:\Program Files\Novell\ZENworks\wm.exe

Start roguescanfix opnieuw, en kies nu voor optie #2: Run sharedtasksrem.
Er zal een kladblokbestandje openen. Plaats de inhoud van dat bestandje in je volgende antwoord.

ROGUESCANFIX LOGFILE


--- Export SharedTaskScheduler key ---

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}"="coenosarc"



--- Export SSODL key ---

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"



--- sharedtaskkey (1): 68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3 ---

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68c7f143-f9ea-4ee0-a06a-ad4ff3dbe8c3}\InProcServer32]
@="C:\\WINXP\\system32\\rxqcpn.dll"
"ThreadingModel"="Apartment"

checking for files:
rxqcpn.dll found
rxqcpn.dll deleted!


--- Cleaning process finished! ---



--- Export SharedTaskScheduler key after cleaning process ---

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"




--- Export SSODL key ---


REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"


Finished!

Ok, post eens een nieuw hijackthis logje hier en vertel hoe alles verder werkt.

Logfile of HijackThis v1.99.1
Scan saved at 14:40:54, on 1/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\System32\Novell\XTAgent.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINXP\system32\spoolsv.exe
c:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Novell\ZENworks\nalntsrv.exe
c:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
c:\Program Files\Symantec AntiVirus\SavRoam.exe
c:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\WebDrive\wdservice.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
c:\Program Files\Novell\ZENworks\wm.exe
c:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\WINXP\system32\wuauclt.exe
C:\WINXP\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINXP\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINXP\system32\NWTRAY.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
c:\Program Files\Symantec AntiVirus\DoScan.exe
C:\Program Files\WebDrive\webdrive.exe
C:\Program Files\VDAB Tools\LaptopLogin.exe
c:\Program Files\Novell\ZENworks\NalAgent.exe
C:\Documents and Settings\GDMULDER\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www1.vdab.be/NSearch/SearchServlet?
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.vdab.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = intranet.vdab.be
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by VDAB
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = intproxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = secured.vdab.be;10.200.1.*;ifolder.vdab.be;vdab-w*.vdab.be;webacc.vdab.be;amiwf1.vdab.be;amiwf2.vdab.be;amiwf3.vdab.be;amiwf4.vdab.be;amiwf5.vdab.be;amiweb.vdab.be;vdab.be;www.vdab.be;intranet.vdab.be;dm-cvs.vdab.be;clientvolgsysteem.vdab.be;bibliotheek.vdab.be;lmsdev.vdab.be;lmsprod.vdab.be;finlog.vdab.be;finlog89.vdab.be;finlogtrn.vdab.be;huiz*bm.vdab.be;communities.vdab.be;eadvantage.siemens.com;intproxy.vdab.be;<local>
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] c:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [QTrustLogout] "C:\Program Files\VDAB iNetInfo\qtrust.exe" LOGOUT
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WebDriveTray] "C:\Program Files\WebDrive\webdrive.exe" /trayicon
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Application Explorer.lnk = C:\Program Files\Novell\ZENworks\NalView.exe
O4 - Global Startup: LaptopLogin.lnk = C:\Program Files\VDAB Tools\LaptopLogin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - c:\Program Files\Novell\ZENworks\AxNalServer.dll
O14 - IERESET.INF: START_PAGE_URL=intranet.vdab.be
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://communities.vdab.be/qp2.cab
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINXP\msxml4.cab
O16 - DPF: {CAFECAFE-0013-0001-0014-ABCDEFABCDEF} (JInitiator 1.3.1.14) -
O16 - DPF: {CAFECAFE-0013-0001-0017-ABCDEFABCDEF} (JInitiator 1.3.1.17) -
O16 - DPF: {CAFECAFE-0013-0001-0018-ABCDEFABCDEF} (JInitiator 1.3.1.18) -
O20 - Winlogon Notify: igfxcui - C:\WINXP\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - c:\WINXP\system32\NavLogon.dll
O20 - Winlogon Notify: NetIdentity Notification - C:\WINXP\system32\Novell\XtNotify.dll
O20 - Winlogon Notify: WRNotifier - C:\WINXP\SYSTEM32\WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINXP\system32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - c:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - c:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Oracle%ORACLE_HOME_SERVICE%ClientCache80 - Unknown owner - c:\ORANT\BIN\ONRSD80.EXE
O23 - Service: OracleClientCache80 - Unknown owner - c:\ORANT\BIN\ONRSD80.EXE
O23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - c:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - c:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - c:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\WebDrive\wdservice.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINXP\System32\Novell\XTAgent.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - c:\Program Files\Novell\ZENworks\wm.exe

nu lijkt alles weer normaal, icoontjes in de startbalk zijn weg, op eerste zicht geen pop-ups meer en startpagina is ook weer normaal, dus ik vermoed dat alles weer goed is, enorm bedankt!

* Je Java software is verouderd.
Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.
Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

Download Java Runtime Environment (JRE) 6u1.

• Scroll omlaag naar : "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Klik op de "Download" knop aan de rechterkant.
• Vink aan: "Accept License Agreement".
• De pagina zal herladen.
• Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen, en bewaar het naar je Bureaublad.
• Sluit alle programma's die eventueel open zijn - Zeker je web browser!
• Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.
• Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
• Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
• Herhaal dit tot alle oudere versies verdwenen zijn.
• Na het verwijderen van alle oudere versies, herstart je pc.
• Dubbelklik vervolgens op jre-6u1-windows-i586-p.exe op je Bureaublad om de nieuwste versie van Java te installeren.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Voor de rest ziet het er goed uit.