Archief - Spyware Invasie

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
m

mtm

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 17:06:56, on 22/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\AVG\avgamsvr.exe
D:\AVG\avgupsvc.exe
D:\AVG\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
D:\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Zen Micro\Detector\CTDetect.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
D:\Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Gebruiker\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Class - {185DCEDA-ED4A-7500-BE99-C1C02D7802FC} - C:\WINDOWS\lyemq1.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Creative Detector] D:\Zen Micro\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B460F607-2A6E-48BC-A165-DBCDE095E5E5}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\AVG\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
m

mtm

Legacy Member
HKLM\S-1-5-21-1708537768-2111687655-1060284298-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{814A3436-3E2C-1506-EC61-D851ADB55F0D}* 16/04/2006 16:31 0 bytes Key name contains embedded nulls (*)
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg 4/04/2006 9:59 0 bytes Access is denied.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\01\12-{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}-v1- 5/08/2006 19:44 8 bytes Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\11\16-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v11 5/08/2006 20:20 36.52 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\11\16-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v11 5/08/2006 20:20 2.65 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\11\16-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v11 5/08/2006 20:20 4.00 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\12\12-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v12 5/08/2006 20:04 7.91 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\12\12-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v12 5/08/2006 20:25 3.05 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v13 5/08/2006 20:20 84.42 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v13 5/08/2006 20:20 5.81 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v13 5/08/2006 20:20 9.31 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\01\11-{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}-v1 7/08/2006 12:55 8 bytes Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\12\12-{E71F62DB-4D5B-4AC1-923A-2F9B37E45055}-v1 8/08/2006 17:09 67.05 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\12\12-{E71F62DB-4D5B-4AC1-923A-2F9B37E45055}-v1 8/08/2006 17:09 4.83 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\12\12-{E71F62DB-4D5B-4AC1-923A-2F9B37E45055}-v1 8/08/2006 17:09 9.41 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\14\14-{E71F62DB-4D5B-4AC1-923A-2F9B37E45055}-v1 8/08/2006 19:24 113.79 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\14\14-{E71F62DB-4D5B-4AC1-923A-2F9B37E45055}-v1 8/08/2006 19:24 8.10 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\14\14-{E71F62DB-4D5B-4AC1-923A-2F9B37E45055}-v1 8/08/2006 19:24 12.69 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\15\30-{E71F62DB-4D5B-4AC1-923A-2F9B37E45055}-v1 15/08/2006 18:08 42.06 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\15\30-{E71F62DB-4D5B-4AC1-923A-2F9B37E45055}-v1 15/08/2006 18:08 4.66 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\19\19-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v1 8/08/2006 17:24 6.78 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{757B7F3A-623C-042B-3C77-52C577BE4401}\01\10-{757B7F3A-623C-042B-3C77-52C577BE4401}-v1- 4/07/2006 14:56 8 bytes Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\22CD42FBd01 20/08/2006 15:19 120.98 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\4F8795DEd01 23/08/2006 14:53 16.35 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\64E4F4ADd01 20/08/2006 15:14 87.78 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\64FD2797d01 20/08/2006 15:19 95.44 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\6913F6DFd01 23/08/2006 14:55 50.69 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\782CC03Ad01 23/08/2006 14:54 118.90 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\A41A4703d01 23/08/2006 14:56 40.74 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\AACAE2EEd01 20/08/2006 15:14 164.45 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Gebruiker\Local Settings\Application Data\Mozilla\Firefox\Profiles\9nkuul9w.default\Cache\BE0D7D6Fd01 23/08/2006 14:52 31.20 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\C1ER4HI7\allservices[1].xml 23/08/2006 14:52 737 bytes Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\C1ER4HI7\GetMDRCDPOSTURL[14].aspx 23/08/2006 15:01 167 bytes Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\W9AB0123\allservices[2].xml 23/08/2006 14:22 737 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\W9AB0123\GetMDRCD[13].xml 23/08/2006 14:53 7.15 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\W9AB0123\GetMDRCD[14].xml 23/08/2006 14:53 95 bytes Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\W9AB0123\getmdrcd[15].xml 23/08/2006 15:01 6.65 KB Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\Y1EVK7O5\GetMDRCDPOSTURL[12].aspx 23/08/2006 14:53 167 bytes Hidden from Windows API.
C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\YNU1676T\getmdrcd[20].xml 23/08/2006 14:53 6.65 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\01\11-{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}-v1-{F2 23/07/2006 13:43 8 bytes Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\11\11-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v11-{3 23/07/2006 13:51 4.00 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\12\12-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v12-{3 23/07/2006 14:05 7.91 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\12\12-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v12-{F 23/07/2006 13:51 27.47 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\12\12-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v12-{F 23/07/2006 13:51 2.07 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\12\12-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v12-{F 23/07/2006 13:51 3.05 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v13-{3 23/07/2006 14:21 84.42 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v13-{3 23/07/2006 14:21 5.81 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v13-{3 23/07/2006 14:21 9.31 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v13-{F 24/07/2006 13:24 44.29 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v13-{F 24/07/2006 13:24 3.12 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\13\13-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v13-{F 24/07/2006 13:24 4.88 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\15\15-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v15-{F 5/08/2006 13:11 110.00 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\15\15-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v15-{F 5/08/2006 13:11 7.68 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\15\15-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v15-{F 5/08/2006 13:11 12.22 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\16\16-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v16-{F 10/08/2006 13:09 35.33 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\16\16-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v16-{F 10/08/2006 13:09 2.42 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\16\16-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v16-{F 10/08/2006 13:09 3.93 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\17\17-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v17-{3 10/08/2006 12:40 6.78 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\18\18-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v18-{F 11/08/2006 18:35 116.13 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\18\18-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v18-{F 11/08/2006 18:35 8.20 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\18\18-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v18-{F 11/08/2006 18:35 12.79 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\19\19-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v19-{F 15/08/2006 13:58 100.08 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\19\19-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v19-{F 15/08/2006 13:58 6.92 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\19\19-{F2D353DD-C8A4-4F1A-9A59-54172039FB5D}-v19-{F 15/08/2006 13:58 11.22 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\22\20-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v22-{F 21/08/2006 17:24 90.73 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\22\20-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v22-{F 21/08/2006 17:24 6.48 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\22\20-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v22-{F 21/08/2006 17:24 10.04 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{EC5E2FEC-4634-AA64-3452-B08FBBBA945F}\23\23-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v23-{3 13/08/2006 17:04 13.91 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{4C6A5869-232C-E1D4-5FD4-FB3D64A894FF}\01\14-{4C6A5869-232C-E1D4-5FD4-FB3D64A894FF}-v1-{F 4/08/2006 18:11 8 bytes Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{4C6A5869-232C-E1D4-5FD4-FB3D64A894FF}\19\19-{6196ED16-E075-42D0-8EC6-3246E7443058}-v19-{ 4/08/2006 18:28 13.02 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\01\12-{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}-v1-{E 14/08/2006 13:23 8 bytes Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{F42C790B-E9B6-8C97-430B-EDBE026BA8D9}\19\19-{30D68B65-76A3-438E-B7E9-BCF9CE0EF339}-v19-{ 14/08/2006 13:33 6.78 KB Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{757B7F3A-623C-042B-3C77-52C577BE4401}\01\11-{757B7F3A-623C-042B-3C77-52C577BE4401}-v1-{EB 12/07/2006 14:24 8 bytes Hidden from Windows API.
C:\Documents and Settings\Pieter\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\[email protected]\DFSR\Staging\CS{A10D19D4-866F-91F6-4BB9-85622DD265EB}\01\10-{A10D19D4-866F-91F6-4BB9-85622DD265EB}-v1-{EB27E21D-162 12/07/2006 14:24 8 bytes Hidden from Windows API.
J

Jurgenv1

Legacy Member
Fix volgende regel in hijackthis en post dan een nieuw hijackthis logje hier en vertel hoe alles verder werkt:

O2 - BHO: Class - {185DCEDA-ED4A-7500-BE99-C1C02D7802FC} - C:\WINDOWS\lyemq1.dll (file missing)
m

mtm

Legacy Member
Ik denk wel dat bij de volgende reboot van mijn pc het er terug zal staan


Logfile of HijackThis v1.99.1
Scan saved at 17:19:53, on 23/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\AVG\avgamsvr.exe
D:\AVG\avgupsvc.exe
D:\AVG\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
D:\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Zen Micro\Detector\CTDetect.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Xfire\Xfire.exe
D:\Enemy Territory\ETmin.exe
D:\Firefox\firefox.exe
C:\Documents and Settings\Gebruiker\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Creative Detector] D:\Zen Micro\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B460F607-2A6E-48BC-A165-DBCDE095E5E5}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\AVG\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
m

mtm

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 15:07:12, on 24/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\AVG\avgamsvr.exe
D:\AVG\avgupsvc.exe
D:\AVG\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
D:\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Zen Micro\Detector\CTDetect.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Firefox\firefox.exe
C:\Documents and Settings\Gebruiker\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Creative Detector] D:\Zen Micro\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B460F607-2A6E-48BC-A165-DBCDE095E5E5}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\AVG\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
J

Jurgenv1

Legacy Member
* Fix nog volgende regel en post dan een nieuw hijackthis logje hier:

R3 - Default URLSearchHook is missing
m

mtm

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 19:15:51, on 24/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\AVG\avgamsvr.exe
D:\AVG\avgupsvc.exe
D:\AVG\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
D:\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Zen Micro\Detector\CTDetect.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Media Player\wmplayer.exe
D:\Firefox\firefox.exe
D:\Xfire\Xfire.exe
C:\Documents and Settings\Gebruiker\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Creative Detector] D:\Zen Micro\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: symsupportutil - https://www-secure.symantec.com/region/reg_eu/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B460F607-2A6E-48BC-A165-DBCDE095E5E5}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\AVG\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
J

Jurgenv1

Legacy Member
No prob. ;)



Nog een paar tips om problemen te voorkomen in de toekomst:

Installeer alvast volgende GRATIS programmatjes indien je ze nog niet hebt:

Spywareblaster
Adaware se
Spybot s&d


Tijdens het surfen, klik niet overal klakkeloos op ja als je dit gevraagd wordt... doe dit enkel wanneer je het volledig vertrouwt.

En kies eventueel een alternatieve browser zoals Opera of Firefox.

En ik raad je ook aan om af en toe een online virusscan uit te voeren. housecall en/of Bitdefender. Want, wat de ene scanner niet kan vinden, kan een andere misschien wel.
Zorg er ook voor dat je virusscanner die op je systeem geïnstalleerd is altijd up to date is!!

En... geregeld eens een bezoekje brengen aan: http://windowsupdate.microsoft.com/

Bekijk ook eens deze 2 filmpjes.. Heel interessant:
http://www2.trosradar.nl/mediaplayer/player.php?videoID=524&mode=dossier#
http://www.benedelman.org/spyware/security-111804.wmv


Meer preventietips zijn ook op volgende sites te vinden:

http://www.bluemedicine.be
http://users.telenet.be/marcvn/spyware
How did I get infected in the first place (article by TonyKlein)
Het voorkomen van spyware-infecties en browserhijacking
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan