Archief - Log

brecko · 10 feb 2006

Logfile of HijackThis v1.99.1
Scan saved at 19:41:01, on 10/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VmVybWVpci1DYWxsZWJhdXQ\command.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\LSASS.EXE
C:\winstall.exe
C:\Program Files\uews\acus.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microsoft Office\Office\1043\OLFSNT40.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\SpySheriff\SpySheriff.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS\TEMP\Rar$EX00.984\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.2020search.com/search/9884/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {EB1C0319-CEA5-9907-D653-BD3EB42B7AC6} - C:\WINDOWS\system32\xdirn.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: Search - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - C:\WINDOWS\system32\azesearch4.ocx
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20010\services.exe
O4 - HKLM\..\Run: [Microsoft Office] C:\WINDOWS\system32\msoff.exe
O4 - HKLM\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe /s
O4 - HKLM\..\Run: [Microsoft Windows Session Manager Subsystem] C:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [WinAntiVirusPro2006] "C:\Program Files\WinAntiVirus Pro 2006\WinAV.exe" /min
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\system32\wwwloader.exe "
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
O4 - HKCU\..\Run: [WindowsUpdateNT] C:\WINDOWS\System\svwhost.exe
O4 - HKCU\..\Run: [Hatu] "C:\Program Files\uews\acus.exe" -vt mt
O4 - HKCU\..\Run: [Klknbp] C:\WINDOWS\system32\??ool32.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Poort voor Symantec Fax Starter Edition.lnk = C:\Program Files\Microsoft Office\Office\1043\OLFSNT40.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://*.reliablestats.com
O15 - Trusted Zone: http://*.winantispyware.com
O15 - Trusted Zone: http://*.winantivirus.com
O15 - Trusted Zone: http://*.winantiviruspro.com
O15 - Trusted Zone: http://*.winfixer.com
O15 - Trusted Zone: http://*.winnanny.com
O15 - Trusted Zone: http://*.winsoftware.com
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=5071
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Hints - C:\WINDOWS\system32\jtjs0717e.dll
O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll
O20 - Winlogon Notify: pppwxp - pppwxp.dll (file missing)
O20 - Winlogon Notify: winyyq32 - C:\WINDOWS\SYSTEM32\winyyq32.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VmVybWVpci1DYWxsZWJhdXQ\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

Jurgenv1 · 10 feb 2006

Download de L2Mfix van een van devolgende locaties:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Plaats het bestand op je bureaublad. Dubbelklik op l2mfix.exe.
Klik op "Install" om het mapje uit te pakken.
Op je bureaublad open je de map l2mfix.
Klik op l2fix.bat.
Kies voor optie #1: Find Log door het cijfer 1 te typen en dan op return te drukken.
Je computer zal nu gescand worden.Dit kan even duren. Na een tijdje wordt er een kladblokbestand geopend.
Kopieer en plak de inhoud van dit bestand in je volgende post.

Let op: Optie #2 mag je voorlopig NIET gebruiken. Gebruik ook geen andere bestanden die zich in de map l2mfix bevinden!

Wanneer je tijdens het runnen van optie #1 een foutmelding krijgt als "C:\windows\systeem32\cmd.exe
C:\windows\systeem32\auto ex.nt

Het systeembestand is niet geschikt voor MS.Dos en Microsoft Windows toepassingen. Kies sluiten om de toepassing af te sluiten. ",
gebruik dan eerst optie #5 of de snelkoppeling in de l2mfix map om deze foutmelding eerst op te lossen. Laat de fix niet lopen vooraleer je dit probleem opgelost is.

brecko · 11 feb 2006

L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Explorer]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\l4n40e5qeh.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msupdate]
"DllName"="msupdate32.dll"
"Startup"="WinlogonStartupEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pppwxp]
"DllName"=hex(2):70,00,70,00,70,00,77,00,78,00,70,00,2e,00,64,00,6c,00,6c,00,\
00,00
"Startup"="pppwxp"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
"MaxWait"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winyyq32]
"Asynchronous"=dword:00000001
"DllName"="winyyq32.dll"
"Impersonate"=dword:00000000
"Startup"="EvtStartup"
"Shutdown"="EvtShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{B60C1919-BC8B-2264-F7F1-7D888E7C83C3}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Eigenschappenvenster van multimediabestand"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-scannerbeheer"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Het tabblad Beveiliging"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Eigenschappenblad voor OLE-docbestand"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell-uitbreidingen voor delen"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Beeldschermadapter"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Monitor"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Beeldscherm-panning"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Het tabblad Beveiliging"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibiliteitspagina"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Knipselgegevensverwerker van shell"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Schijfkopieer-uitbreiding"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell-uitbreidingen voor Microsoft Windows Network-objecten"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-monitorbeheer"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-printerbeheer"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell-uitbreidingen voor bestandscompressie"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Shell-uitbreiding voor Web Printer"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Snelmenu Codering"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Werkmap"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal-pictogramuitbreiding"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profiel"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Het tabblad Beveiliging voor printers"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell-uitbreidingen voor delen"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-extensie"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto-handtekeningextensie"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netwerkverbindingen"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Netwerkverbindingen"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners en camera's"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners en camera's"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners en camera's"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners en camera's"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners en camera's"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell-uitbreidingen voor Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Geplande taken"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taakbalk en menu Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Zoeken"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help en ondersteuning"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help en ondersteuning"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uitvoeren..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Lettertypen"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Systeembeheer"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet-werkbalk"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Downloadstatus"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Uitgebreide shell-map"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Uitgebreide shell-map 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft-browserbalk"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Zoekbalk"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Mediabalk"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Zoeken binnen deelvenster"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Zoeken op het web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Hulpprogramma met opties voor registerboomstructuur"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoAanvullen"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU-lijst voor AutoAanvullen"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Aangepaste MRU-lijst voor AutoAanvullen"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Toegankelijk"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Pop-upbalk Volgen"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Parser voor adresbalk"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lijst voor AutoAanvullen: Microsoft Geschiedenis"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lijst voor AutoAanvullen: Microsoft Shell-map"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft-container met meervoudige lijst voor AutoAanvullen"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Sitemenu van shell-band"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Gebruikersondersteuning"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globale mapinstellingen"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url-geschiedenisservice"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Geschiedenis"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tijdelijke Internet-bestanden"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tijdelijke Internet-bestanden"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url-zoeken Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite-welkomstscherm"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Het Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Cachemap van ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Map met abonnementen"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Toepassingsbeheer"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Programma voor inventarisatie van ge‹nstalleerde toepassingen"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI- en bestandsextractieprogramma voor miniaturen"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informatie over de handler voor miniatuurweergaven (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML-extractie voor miniatuurweergaven"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Wizard Webpublicaties"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Afdrukken via het web bestellen"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell-object voor publicatiewizard"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Wizard Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Gebruikersaccounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanaal-bestand"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Kanaal-snelkoppeling"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Handler-object voor kanalen"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Map Off line bestanden"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Personen..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Binder Unbind"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{D9897883-00EA-412E-8F67-B5A97498D8EA}"=""
"{F28767FF-193B-41F1-9DBC-73C82AD05493}"=""
"{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}"=""
"{32C2AE5D-3484-436B-9C82-23BA024BFAF2}"=""
"{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}"=""
"{26995E25-07C8-452B-AE1C-28D8BE651111}"=""
"{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}"=""
"{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}"=""
"{8AB543C9-12D8-4612-AE89-2E00405EAA96}"=""
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}\InprocServer32]
@="C:\\WINDOWS\\system32\\dsnmpntw.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}\InprocServer32]
@="C:\\WINDOWS\\system32\\mljetoledb40.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}\InprocServer32]
@="C:\\WINDOWS\\system32\\HKZc3212.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}\InprocServer32]
@="C:\\WINDOWS\\system32\\cdfgnt.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}\InprocServer32]
@="C:\\WINDOWS\\system32\\ismon.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}\InprocServer32]
@="C:\\WINDOWS\\system32\\nqtui1.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}\InprocServer32]
@="C:\\WINDOWS\\system32\\aemtd.dll"
"ThreadingModel"="Apartment"

brecko · 11 feb 2006

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
adserv~1.dll Sat 28 Jan 2006 20:26:02 A.... 16.896 16,50 K
aemtd.dll Sat 11 Feb 2006 9:19:40 ..S.R 236.947 231,39 K
atmtd.dll Sat 28 Jan 2006 20:24:42 A.... 687.592 671,48 K
browseui.dll Thu 24 Nov 2005 1:39:20 A.... 1.022.464 998,50 K
gdi32.dll Thu 29 Dec 2005 3:56:06 A.... 280.064 273,50 K
hkzc3212.dll Sat 11 Feb 2006 8:48:40 ..S.R 236.947 231,39 K
imon.dll Fri 10 Feb 2006 19:54:06 A.... 270.336 264,00 K
ktj0l7~1.dll Fri 10 Feb 2006 20:28:52 ..S.R 236.947 231,39 K
l4n40e~1.dll Thu 9 Feb 2006 15:42:48 ..S.R 236.947 231,39 K
l64q0g~1.dll Sat 11 Feb 2006 9:16:40 ..S.R 236.947 231,39 K
mshtml.dll Thu 24 Nov 2005 1:39:22 A.... 3.013.632 2,87 M
msupda~1.dll Sat 28 Jan 2006 20:25:14 A.... 479.744 468,50 K
mswinb32.dll Sat 28 Jan 2006 20:27:02 A.... 53.760 52,50 K
mswinu~1.dll Sat 28 Jan 2006 20:24:26 A.... 268 0,26 K
mswinxml.dll Sat 28 Jan 2006 20:24:26 A.... 9.491 9,27 K
shdocvw.dll Thu 1 Dec 2005 4:33:22 A.... 1.492.480 1,42 M
winlfl32.dll Sat 28 Jan 2006 20:27:00 A.... 265 0,26 K
wrlogo~1.dll Wed 14 Dec 2005 19:29:02 A.... 492.544 481,00 K
wrlzma.dll Wed 14 Dec 2005 19:28:58 A.... 17.920 17,50 K
xdirn.dll Mon 30 Jan 2006 15:20:10 A.... 139.264 136,00 K

20 items found: 20 files (5 H/S), 0 directories.
Total of file sizes: 9.161.455 bytes 8,73 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Het volume in station C heeft geen naam.
Het volumenummer is EC3C-8A15

Map van C:\WINDOWS\System32

11/02/2006 09:19 236.947 aemtd.dll
11/02/2006 09:16 236.947 l64q0gh5e64.dll
11/02/2006 08:48 236.947 HKZc3212.dll
10/02/2006 20:28 236.947 ktj0l71m1.dll
09/02/2006 15:42 236.947 l4n40e5qeh.dll
30/01/2006 15:20 405.504 ??ool32.exe
23/11/2005 17:31 <DIR> Microsoft
03/11/2002 13:01 <DIR> dllcache
6 bestand(en) 1.590.239 bytes
2 map(pen) 64.498.520.064 bytes beschikbaar

Jurgenv1 · 11 feb 2006

Sluit alle openstaande programma's.
Dubbelklik op l2mfix.bat.
Kies voor optie #2: Run Fix door het cijfer 2 te typen.
Druk op Enter.
Het tooltje zal starten.
Gebruik je toetsenbord niet voor dat het tooltje gestopt is!!!
Druk op een toets om de computer opnieuw te starten wanneer dit gevraagd wordt.
Na de reboot verschijnen de ikonen op je desktop. Deze zullen weer verdwijnen. (dat is normaal).
L2mfix gaat je computer scannen.
Wanneer het klaar is wordt er een nieuw kladblokbestand geopend.
Post de inhoud van dit bestand.
Maak een nieuwe Hijackthislog en post deze ook.

Let op: Gebruik GEEN andere bestanden uit de map l2mfix!

brecko · 11 feb 2006

L2mfix 010406
Creating Account.
De opdracht is voltooid.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 540 'smss.exe'
Killing PID 2576 'smss.exe'
Killing PID 2576 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 628 'winlogon.exe'
Killing PID 628 'winlogon.exe'
Killing PID 628 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 800 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 3692 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
1 bestand(en) gekopieerd.
Deleting: C:\WINDOWS\system32\aemtd.dll
Successfully Deleted: C:\WINDOWS\system32\aemtd.dll
Deleting: C:\WINDOWS\system32\fpn0035me.dll
Successfully Deleted: C:\WINDOWS\system32\fpn0035me.dll
Deleting: C:\WINDOWS\system32\HKZc3212.dll
Successfully Deleted: C:\WINDOWS\system32\HKZc3212.dll
Deleting: C:\WINDOWS\system32\i0nmla511d.dll
Successfully Deleted: C:\WINDOWS\system32\i0nmla511d.dll
Deleting: C:\WINDOWS\system32\kqdur.dll
Successfully Deleted: C:\WINDOWS\system32\kqdur.dll
Deleting: C:\WINDOWS\system32\ktj0l71m1.dll
Successfully Deleted: C:\WINDOWS\system32\ktj0l71m1.dll
Deleting: C:\WINDOWS\system32\l4n40e5qeh.dll
Successfully Deleted: C:\WINDOWS\system32\l4n40e5qeh.dll
Deleting: C:\WINDOWS\system32\l64q0gh5e64.dll
Successfully Deleted: C:\WINDOWS\system32\l64q0gh5e64.dll
Deleting: C:\WINDOWS\system32\socurity.dll
Successfully Deleted: C:\WINDOWS\system32\socurity.dll
Deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

msg11?.dll
0 bestand(en) gekopieerd.

Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\msupdate]
"DllName"="msupdate32.dll"
"Startup"="WinlogonStartupEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pppwxp]
"DllName"=hex(2):70,00,70,00,70,00,77,00,78,00,70,00,2e,00,64,00,6c,00,6c,00,\
00,00
"Startup"="pppwxp"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
"MaxWait"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SideBySide]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\l4n40e5qeh.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winyyq32]
"Asynchronous"=dword:00000001
"DllName"="winyyq32.dll"
"Impersonate"=dword:00000000
"Startup"="EvtStartup"
"Shutdown"="EvtShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

The following are the files found:
****************************************************************************
C:\WINDOWS\system32\aemtd.dll
C:\WINDOWS\system32\fpn0035me.dll
C:\WINDOWS\system32\HKZc3212.dll
C:\WINDOWS\system32\i0nmla511d.dll
C:\WINDOWS\system32\kqdur.dll
C:\WINDOWS\system32\ktj0l71m1.dll
C:\WINDOWS\system32\l4n40e5qeh.dll
C:\WINDOWS\system32\l64q0gh5e64.dll
C:\WINDOWS\system32\socurity.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}\InprocServer32]
@="C:\\WINDOWS\\system32\\dsnmpntw.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}\InprocServer32]
@="C:\\WINDOWS\\system32\\mljetoledb40.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}\InprocServer32]
@="C:\\WINDOWS\\system32\\HKZc3212.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}\InprocServer32]
@="C:\\WINDOWS\\system32\\cdfgnt.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}\InprocServer32]
@="C:\\WINDOWS\\system32\\ismon.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}\InprocServer32]
@="C:\\WINDOWS\\system32\\nqtui1.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}\InprocServer32]
@="C:\\WINDOWS\\system32\\kqdur.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4754A32C-1C7A-4A93-9C71-4DA8C1A9C69F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4754A32C-1C7A-4A93-9C71-4DA8C1A9C69F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4754A32C-1C7A-4A93-9C71-4DA8C1A9C69F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4754A32C-1C7A-4A93-9C71-4DA8C1A9C69F}\InprocServer32]
@="C:\\WINDOWS\\system32\\socurity.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{D9897883-00EA-412E-8F67-B5A97498D8EA}"=-
"{F28767FF-193B-41F1-9DBC-73C82AD05493}"=-
"{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}"=-
"{32C2AE5D-3484-436B-9C82-23BA024BFAF2}"=-
"{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}"=-
"{26995E25-07C8-452B-AE1C-28D8BE651111}"=-
"{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}"=-
"{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}"=-
"{8AB543C9-12D8-4612-AE89-2E00405EAA96}"=-
"{4754A32C-1C7A-4A93-9C71-4DA8C1A9C69F}"=-
[-HKEY_CLASSES_ROOT\CLSID\{D9897883-00EA-412E-8F67-B5A97498D8EA}]
[-HKEY_CLASSES_ROOT\CLSID\{F28767FF-193B-41F1-9DBC-73C82AD05493}]
[-HKEY_CLASSES_ROOT\CLSID\{07DF4C37-B258-46ED-A3A0-DAA36BE229F9}]
[-HKEY_CLASSES_ROOT\CLSID\{32C2AE5D-3484-436B-9C82-23BA024BFAF2}]
[-HKEY_CLASSES_ROOT\CLSID\{FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B}]
[-HKEY_CLASSES_ROOT\CLSID\{26995E25-07C8-452B-AE1C-28D8BE651111}]
[-HKEY_CLASSES_ROOT\CLSID\{275384BB-7AC7-43C9-AEB9-6FADCB6BA05F}]
[-HKEY_CLASSES_ROOT\CLSID\{B9FB1D43-A181-4F4F-8BE1-E695936A0D86}]
[-HKEY_CLASSES_ROOT\CLSID\{8AB543C9-12D8-4612-AE89-2E00405EAA96}]
[-HKEY_CLASSES_ROOT\CLSID\{4754A32C-1C7A-4A93-9C71-4DA8C1A9C69F}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/aemtd.dll (164 bytes security) (deflated 5%)
adding: dlls/fpn0035me.dll (164 bytes security) (deflated 5%)
adding: dlls/guard.tmp (164 bytes security) (deflated 5%)
adding: dlls/HKZc3212.dll (164 bytes security) (deflated 5%)
adding: dlls/i0nmla511d.dll (164 bytes security) (deflated 5%)
adding: dlls/kqdur.dll (164 bytes security) (deflated 5%)
adding: dlls/ktj0l71m1.dll (164 bytes security) (deflated 5%)
adding: dlls/l4n40e5qeh.dll (164 bytes security) (deflated 5%)
adding: dlls/l64q0gh5e64.dll (164 bytes security) (deflated 5%)
adding: dlls/socurity.dll (164 bytes security) (deflated 5%)
adding: backregs/07DF4C37-B258-46ED-A3A0-DAA36BE229F9.reg (212 bytes security) (deflated 70%)
adding: backregs/26995E25-07C8-452B-AE1C-28D8BE651111.reg (212 bytes security) (deflated 70%)
adding: backregs/275384BB-7AC7-43C9-AEB9-6FADCB6BA05F.reg (212 bytes security) (deflated 70%)
adding: backregs/32C2AE5D-3484-436B-9C82-23BA024BFAF2.reg (212 bytes security) (deflated 70%)
adding: backregs/4754A32C-1C7A-4A93-9C71-4DA8C1A9C69F.reg (212 bytes security) (deflated 70%)
adding: backregs/8AB543C9-12D8-4612-AE89-2E00405EAA96.reg (212 bytes security) (deflated 70%)
adding: backregs/B9FB1D43-A181-4F4F-8BE1-E695936A0D86.reg (212 bytes security) (deflated 70%)
adding: backregs/D9897883-00EA-412E-8F67-B5A97498D8EA.reg (212 bytes security) (deflated 70%)
adding: backregs/F28767FF-193B-41F1-9DBC-73C82AD05493.reg (212 bytes security) (deflated 70%)
adding: backregs/FAAC779E-1C63-4B6B-AA05-13F7CF9DEC2B.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 88%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

brecko · 11 feb 2006

Logfile of HijackThis v1.99.1
Scan saved at 13:46:39, on 11/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\smss.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\uews\acus.exe
C:\WINDOWS\system32\??ool32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Microsoft Office\Office\1043\OLFSNT40.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Liesl\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.2020search.com/search/9884/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {EB1C0319-CEA5-9907-D653-BD3EB42B7AC6} - C:\WINDOWS\system32\xdirn.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {EB1C0319-CEA5-9907-D653-BD3EB42B7AC6} - C:\WINDOWS\system32\xdirn.dll
O3 - Toolbar: Search - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - C:\WINDOWS\system32\azesearch4.ocx (file missing)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20010\services.exe
O4 - HKLM\..\Run: [Microsoft Windows Session Manager Subsystem] C:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [WinAntiVirusPro2006] "C:\Program Files\WinAntiVirus Pro 2006\WinAV.exe" /min
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\system32\wwwloader.exe "
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
O4 - HKCU\..\Run: [Hatu] "C:\Program Files\uews\acus.exe" -vt mt
O4 - HKCU\..\Run: [Klknbp] C:\WINDOWS\system32\??ool32.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Poort voor Symantec Fax Starter Edition.lnk = C:\Program Files\Microsoft Office\Office\1043\OLFSNT40.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://*.reliablestats.com
O15 - Trusted Zone: http://*.winantispyware.com
O15 - Trusted Zone: http://*.winantivirus.com
O15 - Trusted Zone: http://*.winantiviruspro.com
O15 - Trusted Zone: http://*.winfixer.com
O15 - Trusted Zone: http://*.winnanny.com
O15 - Trusted Zone: http://*.winsoftware.com
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=5071
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll
O20 - Winlogon Notify: pppwxp - pppwxp.dll (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\l4n40e5qeh.dll (file missing)
O20 - Winlogon Notify: winyyq32 - winyyq32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VmVybWVpci1DYWxsZWJhdXQ\command.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Jurgenv1 · 11 feb 2006

Het is zeer belangrijk dat je álle stappen zorgvuldig uitvoert en dat ook in deze volgorde doet. Print de instructies even uit of sla ze op in een tekstbestandje, want als je straks in veilige modus bent kun je deze site niet raadplegen (want dan heb je geen internetverbinding).

1. Download smitRem.exe en sla dit op op het Bureaublad.
Dubbelklik op het bestand om het uit te pakken naar zijn eigen map op het Bureaublad.

2. Download, installeer en update de gratis trial versie van Ewido anti-malware

Tijdens de installatie, onder "Additional Options", haal je de vinkjes weg bij "Install background guard" en "Install scan via context menu".
Als je Ewido voor de eerste keer runt, zul je een foutmelding krijgen "Database could not be found!". Klik dan op OK. Dit is normaal.
In het hoofdscherm van Ewido, klik je op update in het linker menu, en vervolgens op de Start update knop.
Als de updates gedaan zijn, zal er op de statusbalk beneden "Update successful" staan.
Sluit Ewido. Laat het nog niet scannen

3. Start de computer in veilige modus.
(Kijk hier eventueel voor uitleg.)

De stappen 4 t/m 6 nu in veilige modus uitvoeren!

4. Open de SmitRem map, die op je bureaublad staat.

Dubbelklik op RunThis.bat om het programma uit te voeren.
Volg de instructies op het scherm. Wacht tot het helemaal klaar is - dit kan een poosje duren, wees geduldig.
(Schrik niet als je taakbalk e.d. even verdwijnen, dat is normaal.)

5. Open Ewido Security Suite

klik op Scanner
Klik op complete system scan
Laat het programma je pc scannen (NB: de scan kan lang duren!)

Tijdens de scan zal je gevraagd worden of je gevonden bestanden wilt verwijderen. Klik dan op OK
Als de scan beëindigd is, zul je een knop zien: Bewaar rapport

Klik op Bewaar rapport
Sla het rapport op op je bureaublad
Sluit Ewido af

6. Ga naar Start -> configuratiescherm -> vormgeving en thema's (als dat er niet staat moet je even op "Categorieweergave" klikken) -> bureaublad -> bureaublad aanpassen -> Website -> verwijder alles wat daar eventueel staat (behalve "Mijn huidige pagina").

7. Herstart de computer in 'normale modus'.

8. Plaats hier in je volgende bericht

het log van SmitRem (dat is C:\smitfiles.txt);
het rapport van de Ewido scan;
een nieuw HijackThis-log.

brecko · 11 feb 2006

smitRem © log file
version 2.8

by noahdfear

Microsoft Windows XP [versie 5.1.2600]

Running from
C:\Documents and Settings\Liesl\Bureaublad\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"
"{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}"="OutPost FireWall"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key

PSGuard.com key not present!

checking for WinHound.com key

WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files

~~~ Program Files ~~~

SpySheriff

~~~ Shortcuts ~~~

SpySheriff
SpySheriff.lnk
Install.dat

~~~ Favorites ~~~

~~~ system32 folder ~~~

atmtd.dll
atmtd.dll._
logfiles

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 868 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"
"{4F141CBA-1457-6CCA-03A7-7AA21B61EA0F}"="OutPost FireWall"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~ Wininet.dll ~~~

CLEAN!

brecko · 11 feb 2006

---------------------------------------------------------
ewido anti-malware - Scan rapport
---------------------------------------------------------

+ Gemaakt op: 16:11:42, 11/02/2006
+ Rapport samenvatting: C64417AF

+ Scan resultaten:

HKLM\SOFTWARE\AZESearchCo -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\AZESearchCo\AZESearch -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE083} -> Logger.Agent.io : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{1E6CE4CD-161B-4847-B8BF-E2EF72299D69} -> Logger.Sters : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{2178F3FB-2560-458f-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{a19ef336-01d4-48e6-926a-fe7e1c747aed} -> Adware.MWSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{da7ff3f8-08be-4cac-bc00-94d91c6ae7f4} -> Adware.MWSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{f65b197f-8260-4d52-909a-f70118e646eb} -> Adware.MWSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\MEDIATICKETSINSTALLER.MediaTicketsInstallerCtrl.1 -> Adware.PurityScan : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Replace.HBO -> Adware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Replace.HBO\CLSID -> Adware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Replace.HBO\CurVer -> Adware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Replace.HBO.1 -> Adware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\WinRes.WindowsResources -> Adware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\WinRes.WindowsResources\CLSID -> Adware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\WinRes.WindowsResources\CurVer -> Adware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\WinRes.WindowsResources.1 -> Adware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.activator -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.activator\CLSID -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.activator\CurVer -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.activator.1 -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.ParamWr -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.ParamWr\CLSID -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.ParamWr\CurVer -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.ParamWr.1 -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.StockBar -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.StockBar\CLSID -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.StockBar\CurVer -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\ZToolbar.StockBar.1 -> Adware.Azsearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Effective-i -> Adware.EffectiveBrandToolbar : Schoongemaakt met een backup
HKLM\SOFTWARE\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : Schoongemaakt met een backup
HKLM\SOFTWARE\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{a19ef336-01d4-48e6-926a-fe7e1c747aed} -> Adware.MWSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaTickets -> Adware.PurityScan : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveNow -> Adware.SaveNow : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spy Sheriff -> Adware.SpySheriff : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UCmore - The Search Accelerator -> Adware.UCmore : Schoongemaakt met een backup
HKLM\SOFTWARE\WhenUSave -> Adware.SaveNow : Schoongemaakt met een backup
HKLM\SOFTWARE\WhenUSave\Partners -> Adware.SaveNow : Schoongemaakt met een backup
HKLM\SOFTWARE\WhenUSave\Partners\WUSV -> Adware.SaveNow : Schoongemaakt met een backup
HKU\S-1-5-21-2025429265-117609710-682003330-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178F3FB-2560-458F-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Schoongemaakt met een backup
HKU\S-1-5-21-2025429265-117609710-682003330-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A19EF336-01D4-48E6-926A-FE7E1C747AED} -> Adware.MWSearch : Schoongemaakt met een backup
[260] C:\WINDOWS\system32\msupdate32.dll -> Proxy.Agent.ij : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/aemtd.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/fpn0035me.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/guard.tmp -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/HKZc3212.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/i0nmla511d.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/kqdur.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/ktj0l71m1.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/l4n40e5qeh.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/l64q0gh5e64.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\backup.zip/dlls/socurity.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\aemtd.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\fpn0035me.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\guard.tmp -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\HKZc3212.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\i0nmla511d.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\kqdur.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\ktj0l71m1.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\l4n40e5qeh.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\l64q0gh5e64.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Bureaublad\l2mfix\dlls\socurity.dll -> Adware.Look2Me : Schoongemaakt met een backup
C:\Documents and Settings\Liesl\Mijn documenten\psychologische modellen in de hv\WinAntiVirusPro2006Installer.exe -> Not-A-Virus.Downloader.Win32.WinFixer.c : Schoongemaakt met een backup
C:\Documents and Settings\Mams\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Mams\Cookies\mams@atdmt[2].txt -> TrackingCookie.Atdmt : Schoongemaakt met een backup
C:\Documents and Settings\Mams\Cookies\mams@doubleclick[1].txt -> TrackingCookie.Doubleclick : Schoongemaakt met een backup
C:\Documents and Settings\Mams\Cookies\mams@statcounter[1].txt -> TrackingCookie.Statcounter : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Cookies\[email protected][1].txt -> TrackingCookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Cookies\niesl@doubleclick[1].txt -> TrackingCookie.Doubleclick : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Cookies\[email protected][2].txt -> TrackingCookie.Starware : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Cookies\niesl@mediaplex[1].txt -> TrackingCookie.Mediaplex : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Menu Start\Programma's\SpySheriff -> Adware.SpySheriff : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Menu Start\Programma's\SpySheriff\SpySheriff.lnk -> Adware.SpySheriff : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Menu Start\Programma's\WhenU -> Adware.SaveNow : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Menu Start\Programma's\WhenU\Learn More About WhenU Save.url -> Adware.SaveNow : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Menu Start\Programma's\WhenU\Learn More About WhenU SaveNow.url -> Adware.SaveNow : Schoongemaakt met een backup
C:\Documents and Settings\Niesl\Menu Start\Programma's\WhenU\WhenU.com Website.url -> Adware.SaveNow : Schoongemaakt met een backup
C:\Documents and Settings\VERMEIR\Menu Start\Programma's\SpySheriff -> Adware.SpySheriff : Schoongemaakt met een backup
C:\Documents and Settings\VERMEIR\Menu Start\Programma's\SpySheriff\SpySheriff.lnk -> Adware.SpySheriff : Schoongemaakt met een backup
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Schoongemaakt met een backup
C:\Program Files\Save -> Adware.SaveNow : Schoongemaakt met een backup
C:\Program Files\Save\ACM.dll -> Adware.SaveNow : Schoongemaakt met een backup
C:\Program Files\Save\save.db -> Adware.SaveNow : Schoongemaakt met een backup
C:\Program Files\Save\Save.exe -> Adware.SaveNow : Schoongemaakt met een backup
C:\Program Files\Save\save.htm -> Adware.SaveNow : Schoongemaakt met een backup
C:\Program Files\Save\store.db -> Adware.SaveNow : Schoongemaakt met een backup
C:\Program Files\TheSearchAccelerator -> Adware.UCmore : Schoongemaakt met een backup
C:\Program Files\TheSearchAccelerator\INSTALL.LOG -> Adware.UCmore : Schoongemaakt met een backup
C:\Program Files\TheSearchAccelerator\logo.ico -> Adware.UCmore : Schoongemaakt met een backup
C:\Program Files\TheSearchAccelerator\toolbar.cfg -> Adware.UCmore : Schoongemaakt met een backup
C:\Program Files\TheSearchAccelerator\UNWISE.EXE -> Adware.UCmore : Schoongemaakt met een backup
C:\Program Files\uews\acus.exe -> Downloader.PurityScan.br : Schoongemaakt met een backup
C:\WINDOWS\azesearch.bmp -> Adware.Azesearch : Schoongemaakt met een backup
C:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.ocx -> Adware.MediaTickets : Schoongemaakt met een backup
C:\WINDOWS\inet20010\mm4.exe -> Logger.Delf.ig : Schoongemaakt met een backup
C:\WINDOWS\loadadv728.exe -> Downloader.Harnig.bb : Schoongemaakt met een backup
C:\WINDOWS\loader138.exe -> Downloader.VB.vs : Schoongemaakt met een backup
C:\WINDOWS\smss.exe -> Heuristic.Win32.HostFile : Schoongemaakt met een backup
C:\WINDOWS\system32\AdService.dll -> Trojan.Agent.og : Schoongemaakt met een backup
C:\WINDOWS\system32\drivers\sysbus32.sys -> Trojan.Agent.of : Schoongemaakt met een backup
C:\WINDOWS\system32\intxt.exe -> Adware.CashDeluxe : Schoongemaakt met een backup
C:\WINDOWS\system32\kernels64.exe -> Downloader.Tibs.cc : Schoongemaakt met een backup
C:\WINDOWS\system32\msupdate32.dll -> Proxy.Agent.ij : Schoongemaakt met een backup
C:\WINDOWS\system32\mswinb32.dll -> Adware.CashDeluxe : Schoongemaakt met een backup
C:\WINDOWS\system32\mswinb32.exe -> Adware.CashDeluxe : Schoongemaakt met een backup
C:\WINDOWS\system32\xdirn.dll -> Adware.PurityScan : Schoongemaakt met een backup
C:\WINDOWS\temp.000.exe -> Adware.CashDeluxe : Schoongemaakt met een backup
C:\WINDOWS\tool3.exe -> Downloader.Small.arj : Schoongemaakt met een backup
C:\WINDOWS\VmVybWVpci1DYWxsZWJhdXQ\asappsrv.Vdll -> Adware.CommAd : Schoongemaakt met een backup
C:\WINDOWS\VmVybWVpci1DYWxsZWJhdXQ\command.Vexe -> Adware.CommAd : Schoongemaakt met een backup
C:\winstall.Vexe -> Not-A-Virus.Hoax.Win32.Renos.az : Schoongemaakt met een backup

::Einde rapport

brecko · 11 feb 2006

Logfile of HijackThis v1.99.1
Scan saved at 16:34:54, on 11/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\??ool32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microsoft Office\Office\1043\OLFSNT40.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\uews\acus.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Liesl\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {EB1C0319-CEA5-9907-D653-BD3EB42B7AC6} - C:\WINDOWS\system32\xdirn.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {EB1C0319-CEA5-9907-D653-BD3EB42B7AC6} - C:\WINDOWS\system32\xdirn.dll (file missing)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20010\services.exe
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [WinAntiVirusPro2006] "C:\Program Files\WinAntiVirus Pro 2006\WinAV.exe" /min
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\system32\wwwloader.exe "
O4 - HKCU\..\Run: [Klknbp] C:\WINDOWS\system32\??ool32.exe
O4 - HKCU\..\Run: [Hatu] "C:\Program Files\uews\acus.exe" -vt ndrv
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Poort voor Symantec Fax Starter Edition.lnk = C:\Program Files\Microsoft Office\Office\1043\OLFSNT40.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://*.reliablestats.com
O15 - Trusted Zone: http://*.winantispyware.com
O15 - Trusted Zone: http://*.winantivirus.com
O15 - Trusted Zone: http://*.winantiviruspro.com
O15 - Trusted Zone: http://*.winfixer.com
O15 - Trusted Zone: http://*.winnanny.com
O15 - Trusted Zone: http://*.winsoftware.com
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=5071
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: msupdate - msupdate32.dll (file missing)
O20 - Winlogon Notify: pppwxp - pppwxp.dll (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\l4n40e5qeh.dll (file missing)
O20 - Winlogon Notify: winyyq32 - winyyq32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Jurgenv1 · 11 feb 2006

* download en installeer ccleaner:
www.ccleaner.com
maar nog niet gebruiken!

* open hijackthis en vink volgende regels aan:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R3 - URLSearchHook: (no name) - {EB1C0319-CEA5-9907-D653-BD3EB42B7AC6} - C:\WINDOWS\system32\xdirn.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {EB1C0319-CEA5-9907-D653-BD3EB42B7AC6} - C:\WINDOWS\system32\xdirn.dll (file missing)
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll (file missing)
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20010\services.exe
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [WinAntiVirusPro2006] "C:\Program Files\WinAntiVirus Pro 2006\WinAV.exe" /min
O4 - HKCU\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKCU\..\Run: [WinMedia] "C:\WINDOWS\system32\wwwloader.exe "
O4 - HKCU\..\Run: [Klknbp] C:\WINDOWS\system32\??ool32.exe
O4 - HKCU\..\Run: [Hatu] "C:\Program Files\uews\acus.exe" -vt ndrv
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://*.reliablestats.com
O15 - Trusted Zone: http://*.winantispyware.com
O15 - Trusted Zone: http://*.winantivirus.com
O15 - Trusted Zone: http://*.winantiviruspro.com
O15 - Trusted Zone: http://*.winfixer.com
O15 - Trusted Zone: http://*.winnanny.com
O15 - Trusted Zone: http://*.winsoftware.com
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTick...cab?refid=5071
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab
O20 - Winlogon Notify: msupdate - msupdate32.dll (file missing)
O20 - Winlogon Notify: pppwxp - pppwxp.dll (file missing)
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\l4n40e5qeh.dll (file missing)
O20 - Winlogon Notify: winyyq32 - winyyq32.dll (file missing)

* sluit dan alle vensters behalve hijakthis en klik op 'fix checked'

* start je pc in veilige modus

* verwijder volgende indien aanwezig:

c:\secure32.html
C:\Program Files\TheSearchAccelerator <== deze map
C:\WINDOWS\inet20010 <== deze map
C:\Program Files\WinAntiVirus Pro 2006 <== deze map
C:\WINDOWS\system32\wwwloader.exe
C:\Program Files\uews <== deze map

* open ccleaner en klik rechtsonderaan op 'opschonen'

* start je pc weer normaal en post een nieuw hijackthis logje hier

brecko · 11 feb 2006

Logfile of HijackThis v1.99.1
Scan saved at 17:22:44, on 11/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Microsoft Office\Office\1043\OLFSNT40.EXE
C:\Documents and Settings\Liesl\Bureaublad\HijackThis.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Poort voor Symantec Fax Starter Edition.lnk = C:\Program Files\Microsoft Office\Office\1043\OLFSNT40.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Jurgenv1 · 11 feb 2006

* ga naar start==>configuratiescherm==>software en de-installeer indien aanwezig:
bearshare <==dubieus p2p progje, installeert malware om goed te kunnen werken, zie hier voor meer info:
http://www.spywareinfo.com/articles/p2p/

* ik zie dat je 3 AV's hebt staanin real-time (AVG, NOD32 en norton antivirus)
de-installeer 2 van de drie of schakel van de drie uit of anders zal je systeem vertragen en er zullen conflicten onstaan

* open hijackthis en vink volgende regels aan indien aanwezig:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* verwijder volgende map indien aanwezig:

C:\Program Files\BearShare

* schoon alles nog eens op met ccleaner

* herstart je pc en post een nieuw hijackthis logje hier

Archief - Log

brecko

Legacy Member

Jurgenv1

Legacy Member

brecko

Legacy Member

brecko

Legacy Member

Jurgenv1

Legacy Member

brecko

Legacy Member

brecko

Legacy Member

Jurgenv1

Legacy Member

brecko

Legacy Member

brecko

Legacy Member

brecko

Legacy Member

Jurgenv1

Legacy Member

brecko

Legacy Member

Jurgenv1

Legacy Member