Archief - voortdurend popups( wilt iemand dit log checken)

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
v

vegetto

Legacy Member
Een vriend van mij heeft constant last van popups enz. Dit is zijn log:

Logfile of HijackThis v1.99.1
Scan saved at 15:16:57, on 29/12/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\VnJhbmtlbg\command.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\PROGRA~1\REGIST~1\regclean.exe
D:\frederique\Steam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\FREDER~1\LOCALS~1\Temp\Rar$EX00.187\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/fileassoc.asp?LangID=0413&Ext=dll
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RemoveElanIcon] C:\WINDOWS\System32\ELAN.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Mcafee Antivirus Monitoring System8] VSStatmn8.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [AdobeReader] msni.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Windows 32] sayaneger.exe
O4 - HKLM\..\Run: [Microsoft messenger] imsnger.exe
O4 - HKLM\..\Run: [lsass] C:\p1.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunServices: [Mcafee Antivirus Monitoring System8] VSStatmn8.exe
O4 - HKLM\..\RunServices: [AdobeReader] msni.exe
O4 - HKLM\..\RunServices: [Windows 32] sayaneger.exe
O4 - HKLM\..\RunServices: [Microsoft messenger] imsnger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] D:\frederique\\Steam.exe -silent
O4 - HKCU\..\Run: [Windows 32] sayaneger.exe
O4 - HKCU\..\Run: [Microsoft messenger] imsnger.exe
O4 - HKCU\..\Run: [fimf] C:\PROGRA~1\COMMON~1\fimf\fimfm.exe
O4 - HKCU\..\Run: [Registry Cleaner] C:\PROGRA~1\REGIST~1\regclean.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE"
O4 - HKCU\..\RunServices: [Microsoft messenger] imsnger.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = D:\microsoft office xp\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} (CInstall Class) - http://adserver.sharewareonline.com/adserver/Install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6B8EA3BA-E539-4AD3-8875-8B888E6A5B68}: NameServer = 195.238.2.22 195.238.2.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{6B8EA3BA-E539-4AD3-8875-8B888E6A5B68}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\en2ql1f51.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VnJhbmtlbg\command.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: MsHS64 - Unknown owner - C:\WINDOWS\MsHS64.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: sysmgr64 - Unknown owner - C:\WINDOWS\sysmgr64.exe (file missing)
E

Exit

Legacy Member
scan maar eerst eens grondig met virusscanners, adaware, hitman pro ...
J

Jurgenv1

Legacy Member
hitmanpro is brol, nu zeker niet mee scannen of je maakt het erger!

* Download, installeer en update de free trial versie van Ewido anti-malware

  1. Tijdens de installatie, onder "Additional Options", haal je de vinkjes weg bij "Install background guard" en "Install scan via context menu".
  2. Als je Ewido voor de eerste keer runt, zal je een foutmelding krijgen "Database could not be found!". Klik dan op OK. Dit is normaal.
  3. In het hoofdscherm van Ewido, klik je op update in het linker menu, en vervolgens op de Start update knop.
  4. Als de updates gedaan zijn, zal er op de status bar beneden "Update successful" staan.
  5. Sluit Ewido. Laat het nog niet scannen

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm

* Start je computer op in VEILIGE MODUS

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

* Open Ewido Security Suite
  • klik op Scanner
  • Klik op complete system scan
  • Laat het programma je pc scannen
Tijdens de scan zal je gevraagd worden of je gevonden bestanden wil verwijderen. Klik dan op OK
Als de scan beëindigd is, zal je een knop zienBewaar rapport
  • Klik op Bewaar rapport
  • Sla het rapport op op je bureaublad
  • Sluit Ewido af

* start je pc weer normaal en post een nieuw hijackthis logje hier + het rapport van ewido
v

vegetto

Legacy Member
ja hij had al gescant met spyware doctor, windows anti spyware en de gewone versie van ad-aware niet de se. Maar zal hem dit direct is sturen
J

Jurgenv1

Legacy Member
er is geen gewone versie, dit is een verouderde die niet meer ondersteunt word, krijgt dus geen updates :) installeer dus ad-aware SE personal ;)
v

vegetto

Legacy Member
ewido rapport:

C:\Documents and Settings\Charlotte\Cookies\charlotte@burstnet[1].txt -> Spyware.Cookie.Burstnet : Schoongemaakt met een backup
C:\Documents and Settings\Charlotte\Cookies\charlotte@com[2].txt -> Spyware.Cookie.Com : Schoongemaakt met een backup
C:\Documents and Settings\Charlotte\Cookies\[email protected][1].txt -> Spyware.Cookie.Overture : Schoongemaakt met een backup
C:\Documents and Settings\Charlotte\Cookies\charlotte@hypertracker[1].txt -> Spyware.Cookie.Hypertracker : Schoongemaakt met een backup
C:\Documents and Settings\Charlotte\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
C:\Documents and Settings\Charlotte\Cookies\charlotte@paypopup[2].txt -> Spyware.Cookie.Paypopup : Schoongemaakt met een backup
C:\Documents and Settings\Charlotte\Cookies\[email protected][1].txt -> Spyware.Cookie.Adjuggler : Schoongemaakt met een backup
C:\Documents and Settings\Charlotte\Local Settings\Temporary Internet Files\Content.IE5\0DEYC17W\ErrorSafeScannerInstallNL[1].cab/UERSM_0001_N57M0112NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup
C:\Documents and Settings\Charlotte\Local Settings\Temporary Internet Files\Content.IE5\0DEYC17W\ErrorSafeScannerInstall_nl[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup
C:\Documents and Settings\Frederique\Cookies\[email protected][2].txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Frederique\Cookies\frederique@burstnet[2].txt -> Spyware.Cookie.Burstnet : Schoongemaakt met een backup
C:\Documents and Settings\Frederique\Cookies\frederique@com[2].txt -> Spyware.Cookie.Com : Schoongemaakt met een backup
C:\Documents and Settings\Frederique\Cookies\frederique@paypopup[2].txt -> Spyware.Cookie.Paypopup : Schoongemaakt met een backup
C:\Documents and Settings\Frederique\Cookies\frederique@paypopup[4].txt -> Spyware.Cookie.Paypopup : Schoongemaakt met een backup
C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\LocalService\Cookies\system@goldenpalace[2].txt -> Spyware.Cookie.Goldenpalace : Schoongemaakt met een backup
C:\Documents and Settings\Walter\Cookies\[email protected][1].txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Walter\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
C:\Documents and Settings\Walter\Cookies\walter@com[2].txt -> Spyware.Cookie.Com : Schoongemaakt met een backup
C:\Documents and Settings\Walter\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
C:\Documents and Settings\Walter\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
C:\Documents and Settings\Walter\Cookies\walter@paypopup[2].txt -> Spyware.Cookie.Paypopup : Schoongemaakt met een backup
C:\Documents and Settings\Walter\Local Settings\Temporary Internet Files\Content.IE5\2PTIOCHI\WinFixerScannerInstall[1].cab/UWFX5_0001_N57M2811NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\E2C55B9E-DCC7-4D7D-AE1B-1C81A6\1ED520AB-9929-43F1-9659-4F2564 -> Adware.NavExcel : Schoongemaakt met een backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\E2C55B9E-DCC7-4D7D-AE1B-1C81A6\4FC51543-6F5A-4726-B678-0A8867 -> Spyware.NavExcel : Schoongemaakt met een backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\E2C55B9E-DCC7-4D7D-AE1B-1C81A6\528956DF-BBE6-4555-8C00-62000D -> Spyware.NavExcel : Schoongemaakt met een backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\E2C55B9E-DCC7-4D7D-AE1B-1C81A6\542D92E0-C3D4-4A76-9258-3BB94A -> Spyware.NavExcel : Schoongemaakt met een backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N57M2811NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N57M2811NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup
C:\WINDOWS\Downloaded Program Files\UWFX5_0001_N57M2811NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup
C:\WINDOWS\system32\azau07j9e.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\cxiconfg.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\dsvenum.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\dywsock.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\en08l1du1.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\en22l1fo1.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\enj0l11m1.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\ennml1511.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\fp8u03l9e.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\gp2ol3f31.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\gpj2l31o1.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\gpj8l31u1.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\gppml3711.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\h42olef31h2.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\hr0o05d3e.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\i024lafq1d2e.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\iqctl.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\ir04l5dq1.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\iu50_32.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\jt6u07j9e.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\k2260cfsef260.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\k2pmlc711f.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\k6080gdue6080.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\oqbcbcp.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\r8r60i9se8.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\s488lelu1hq8.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\sbsvcs.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\ujrlbva.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\unrv42a.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\upbmon.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\wwhip6.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\system32\wwpencen.dll -> Spyware.Look2Me : Schoongemaakt met een backup
C:\WINDOWS\Temp\ICD1.tmp\UWFX5_0001_N57M2811NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup
C:\WINDOWS\Temp\ICD2.tmp\UWFX5_0001_N57M2811NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup
C:\WINDOWS\Temp\ICD3.tmp\UWFX5_0001_N57M2811NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Schoongemaakt met een backup


::Einde rapport

hijack this:
ogfile of HijackThis v1.99.1
Scan saved at 21:58:42, on 29/12/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\PROGRA~1\REGIST~1\regclean.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\FREDER~1\LOCALS~1\Temp\Rar$EX00.781\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/fileassoc.asp?LangID=0413&Ext=dll
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RemoveElanIcon] C:\WINDOWS\System32\ELAN.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Mcafee Antivirus Monitoring System8] VSStatmn8.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [AdobeReader] msni.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Windows 32] sayaneger.exe
O4 - HKLM\..\Run: [Microsoft messenger] imsnger.exe
O4 - HKLM\..\Run: [lsass] C:\p1.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunServices: [Mcafee Antivirus Monitoring System8] VSStatmn8.exe
O4 - HKLM\..\RunServices: [AdobeReader] msni.exe
O4 - HKLM\..\RunServices: [Windows 32] sayaneger.exe
O4 - HKLM\..\RunServices: [Microsoft messenger] imsnger.exe
O4 - HKLM\..\RunServices: [MCX Update] wisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] D:\frederique\\Steam.exe -silent
O4 - HKCU\..\Run: [Windows 32] sayaneger.exe
O4 - HKCU\..\Run: [Microsoft messenger] imsnger.exe
O4 - HKCU\..\Run: [fimf] C:\PROGRA~1\COMMON~1\fimf\fimfm.exe
O4 - HKCU\..\Run: [Registry Cleaner] C:\PROGRA~1\REGIST~1\regclean.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE"
O4 - HKCU\..\RunServices: [Microsoft messenger] imsnger.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = D:\microsoft office xp\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} (CInstall Class) - http://adserver.sharewareonline.com/adserver/Install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6B8EA3BA-E539-4AD3-8875-8B888E6A5B68}: NameServer = 195.238.2.22 195.238.2.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{6B8EA3BA-E539-4AD3-8875-8B888E6A5B68}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\o8ro0i93e8.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: MsHS64 - Unknown owner - C:\WINDOWS\MsHS64.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: sysmgr64 - Unknown owner - C:\WINDOWS\sysmgr64.exe (file missing)
J

Jurgenv1

Legacy Member
* pak hijackthis.exe uit en plaats die in een vaste map bv C:/hijackthis (belangrijk!!)

Download L2mfix van één van de volgende locaties:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Sla het op je bureaublad op en dubbelklik op l2mfix.exe.
Klik op Accept.
Klik op de Install-knop om de bestanden uit te pakken en volg de aanwijzingen.
Daarna open je de nieuwe l2mfix-map die op je bureaublad staat.
Dubbelklik op l2mfix.bat en kies de optie #1 voor 'Run Find Log' door 1 te typen en daarna op enter te drukken.
Het tooltje zal je computer scannen. (Je zult daar weinig van merken.)
Daarna, na ongeveer 2 minuten, zal Kladblok openen met een log.
Kopieer en plak de inhoud van dat log hier in je volgende bericht.

BELANGRIJK!!: Klik NIET op optie 2 of op andere dingen die in die map staan.. zonder dat er daarvoor instructies gegeven zijn!
v

vegetto

Legacy Member
L2MFIX find log 122705
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\o8ro0i93e8.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{6E5E7219-8502-F654-E8EA-6F3F3853BE3E}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Eigenschappenvenster van multimediabestand"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-scannerbeheer"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Het tabblad Beveiliging"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Eigenschappenblad voor OLE-docbestand"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell-uitbreidingen voor delen"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Beeldschermadapter"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Monitor"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Beeldscherm-panning"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Het tabblad Beveiliging"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibiliteitspagina"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Knipselgegevensverwerker van shell"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Schijfkopieer-uitbreiding"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell-uitbreidingen voor Microsoft Windows Network-objecten"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-monitorbeheer"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-printerbeheer"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell-uitbreidingen voor bestandscompressie"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Shell-uitbreiding voor Web Printer"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Snelmenu Codering"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Werkmap"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal-pictogramuitbreiding"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profiel"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Het tabblad Beveiliging voor printers"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell-uitbreidingen voor delen"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-extensie"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto-handtekeningextensie"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netwerkverbindingen"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Netwerkverbindingen"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners en camera's"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners en camera's"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners en camera's"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners en camera's"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners en camera's"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Uitbreiding voor AutoUpdate-eigenschappenvenster"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell-uitbreidingen voor Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Geplande taken"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taakbalk en menu Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Zoeken"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help en ondersteuning"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help en ondersteuning"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uitvoeren..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Lettertypen"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Systeembeheer"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet-werkbalk"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Downloadstatus"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Uitgebreide shell-map"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Uitgebreide shell-map 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft-browserbalk"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Zoekbalk"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Mediabalk"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Zoeken binnen deelvenster"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Zoeken op het web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Hulpprogramma met opties voor registerboomstructuur"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoAanvullen"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU-lijst voor AutoAanvullen"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Aangepaste MRU-lijst voor AutoAanvullen"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Toegankelijk"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Pop-upbalk Volgen"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Parser voor adresbalk"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lijst voor AutoAanvullen: Microsoft Geschiedenis"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lijst voor AutoAanvullen: Microsoft Shell-map"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft-container met meervoudige lijst voor AutoAanvullen"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Sitemenu van shell-band"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Gebruikersondersteuning"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globale mapinstellingen"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url-geschiedenisservice"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Geschiedenis"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tijdelijke Internet-bestanden"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tijdelijke Internet-bestanden"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url-zoeken Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite-welkomstscherm"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Het Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Cachemap van ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Map met abonnementen"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Toepassingsbeheer"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Programma voor inventarisatie van ge‹nstalleerde toepassingen"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI- en bestandsextractieprogramma voor miniaturen"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informatie over de handler voor miniatuurweergaven (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML-extractie voor miniatuurweergaven"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Wizard Webpublicaties"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Afdrukken via het web bestellen"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell-object voor publicatiewizard"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Wizard Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Gebruikersaccounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanaal-bestand"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Kanaal-snelkoppeling"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Handler-object voor kanalen"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Map Off line bestanden"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Personen..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{46E22146-59C0-4136-9233-52E412E2B428}"="EzCddax extension"
"{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}"=""
"{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}"=""
"{9C9D7A33-260E-4E46-A01E-C038F3920ACA}"=""
"{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}"=""
"{C666B310-ED27-414B-BE5E-072C1194E5E2}"=""
"{F939936B-76B1-4B42-BDB4-F165C40C3617}"=""
"{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}"=""
"{242674D8-35ED-4635-8E6D-B92B2249F43A}"=""
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{90D7C3EF-022E-4564-9439-A3914038265F}"=""
"{6B533084-88AA-4A90-A148-09747EEA5850}"=""
"{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}\InprocServer32]
@="C:\\WINDOWS\\system32\\sbcpack.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}\InprocServer32]
@="C:\\WINDOWS\\system32\\snbiop.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}\InprocServer32]
@="C:\\WINDOWS\\system32\\VCAME.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}\InprocServer32]
@="C:\\WINDOWS\\system32\\czyptdll.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}\InprocServer32]
@="C:\\WINDOWS\\system32\\dywsock.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}\InprocServer32]
@="C:\\WINDOWS\\system32\\unrv42a.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}\InprocServer32]
@="C:\\WINDOWS\\system32\\wep.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
f0j20a~1.dll Thu 29 Dec 2005 21:52:58 ..S.R 236.976 231,42 K
nv4_disp.dll Fri 11 Nov 2005 13:47:00 A.... 3.924.992 3,74 M
nvapi.dll Fri 11 Nov 2005 13:47:00 A.... 86.016 84,00 K
nvcod.dll Fri 11 Nov 2005 13:47:00 A.... 35.328 34,50 K
nvcodins.dll Fri 11 Nov 2005 13:47:00 A.... 35.328 34,50 K
nvcpl.dll Fri 11 Nov 2005 13:47:00 A.... 7.311.360 6,97 M
nvhwvid.dll Fri 11 Nov 2005 13:47:00 A.... 573.440 560,00 K
nview.dll Fri 11 Nov 2005 13:47:00 A.... 1.466.368 1,40 M
nvmccs.dll Fri 11 Nov 2005 13:47:00 A.... 229.376 224,00 K
nvmccsrs.dll Fri 11 Nov 2005 13:47:00 A.... 45.056 44,00 K
nvmctray.dll Fri 11 Nov 2005 13:47:00 A.... 86.016 84,00 K
nvnt4cpl.dll Fri 11 Nov 2005 13:47:00 A.... 286.720 280,00 K
nvoglnt.dll Fri 11 Nov 2005 13:47:00 A.... 5.394.432 5,14 M
nvrsar.dll Fri 11 Nov 2005 13:47:00 A.... 319.488 312,00 K
nvrscs.dll Fri 11 Nov 2005 13:47:00 A.... 241.664 236,00 K
nvrsda.dll Fri 11 Nov 2005 13:47:00 A.... 245.760 240,00 K
nvrsde.dll Fri 11 Nov 2005 13:47:00 A.... 270.336 264,00 K
nvrsel.dll Fri 11 Nov 2005 13:47:00 A.... 274.432 268,00 K
nvrseng.dll Fri 11 Nov 2005 13:47:00 A.... 241.664 236,00 K
nvrses.dll Fri 11 Nov 2005 13:47:00 A.... 274.432 268,00 K
nvrsesm.dll Fri 11 Nov 2005 13:47:00 A.... 266.240 260,00 K
nvrsfi.dll Fri 11 Nov 2005 13:47:00 A.... 241.664 236,00 K
nvrsfr.dll Fri 11 Nov 2005 13:47:00 A.... 278.528 272,00 K
nvrshe.dll Fri 11 Nov 2005 13:47:00 A.... 319.488 312,00 K
nvrshu.dll Fri 11 Nov 2005 13:47:00 A.... 253.952 248,00 K
nvrsit.dll Fri 11 Nov 2005 13:47:00 A.... 274.432 268,00 K
nvrsja.dll Fri 11 Nov 2005 13:47:00 A.... 258.048 252,00 K
nvrsko.dll Fri 11 Nov 2005 13:47:00 A.... 253.952 248,00 K
nvrsnl.dll Fri 11 Nov 2005 13:47:00 A.... 266.240 260,00 K
nvrsno.dll Fri 11 Nov 2005 13:47:00 A.... 249.856 244,00 K
nvrspl.dll Fri 11 Nov 2005 13:47:00 A.... 249.856 244,00 K
nvrspt.dll Fri 11 Nov 2005 13:47:00 A.... 266.240 260,00 K
nvrsptb.dll Fri 11 Nov 2005 13:47:00 A.... 262.144 256,00 K
nvrsru.dll Fri 11 Nov 2005 13:47:00 A.... 262.144 256,00 K
nvrssk.dll Fri 11 Nov 2005 13:47:00 A.... 249.856 244,00 K
nvrssl.dll Fri 11 Nov 2005 13:47:00 A.... 249.856 244,00 K
nvrssv.dll Fri 11 Nov 2005 13:47:00 A.... 245.760 240,00 K
nvrstr.dll Fri 11 Nov 2005 13:47:00 A.... 249.856 244,00 K
nvrszhc.dll Fri 11 Nov 2005 13:47:00 A.... 217.088 212,00 K
nvrszht.dll Fri 11 Nov 2005 13:47:00 A.... 118.784 116,00 K
nvshell.dll Fri 11 Nov 2005 13:47:00 A.... 466.944 456,00 K
nvwddi.dll Fri 11 Nov 2005 13:47:00 A.... 81.920 80,00 K
nvwdmcpl.dll Fri 11 Nov 2005 13:47:00 A.... 1.662.976 1,59 M
nvwimg.dll Fri 11 Nov 2005 13:47:00 A.... 1.019.904 996,00 K
nvwrsar.dll Fri 11 Nov 2005 13:47:00 A.... 282.624 276,00 K
nvwrscs.dll Fri 11 Nov 2005 13:47:00 A.... 286.720 280,00 K
nvwrsda.dll Fri 11 Nov 2005 13:47:00 A.... 294.912 288,00 K
nvwrsde.dll Fri 11 Nov 2005 13:47:00 A.... 311.296 304,00 K
nvwrsel.dll Fri 11 Nov 2005 13:47:00 A.... 335.872 328,00 K
nvwrseng.dll Fri 11 Nov 2005 13:47:00 A.... 286.720 280,00 K
nvwrses.dll Fri 11 Nov 2005 13:47:00 A.... 335.872 328,00 K
nvwrsesm.dll Fri 11 Nov 2005 13:47:00 A.... 327.680 320,00 K
nvwrsfi.dll Fri 11 Nov 2005 13:47:00 A.... 303.104 296,00 K
nvwrsfr.dll Fri 11 Nov 2005 13:47:00 A.... 327.680 320,00 K
nvwrshe.dll Fri 11 Nov 2005 13:47:00 A.... 278.528 272,00 K
nvwrshu.dll Fri 11 Nov 2005 13:47:00 A.... 315.392 308,00 K
nvwrsit.dll Fri 11 Nov 2005 13:47:00 A.... 323.584 316,00 K
nvwrsja.dll Fri 11 Nov 2005 13:47:00 A.... 212.992 208,00 K
nvwrsko.dll Fri 11 Nov 2005 13:47:00 A.... 196.608 192,00 K
nvwrsnl.dll Fri 11 Nov 2005 13:47:00 A.... 319.488 312,00 K
nvwrsno.dll Fri 11 Nov 2005 13:47:00 A.... 299.008 292,00 K
nvwrspl.dll Fri 11 Nov 2005 13:47:00 A.... 294.912 288,00 K
v

vegetto

Legacy Member
nvwrspt.dll Fri 11 Nov 2005 13:47:00 A.... 323.584 316,00 K
nvwrsptb.dll Fri 11 Nov 2005 13:47:00 A.... 319.488 312,00 K
nvwrsru.dll Fri 11 Nov 2005 13:47:00 A.... 315.392 308,00 K
nvwrssk.dll Fri 11 Nov 2005 13:47:00 A.... 299.008 292,00 K
nvwrssl.dll Fri 11 Nov 2005 13:47:00 A.... 303.104 296,00 K
nvwrssv.dll Fri 11 Nov 2005 13:47:00 A.... 294.912 288,00 K
nvwrstr.dll Fri 11 Nov 2005 13:47:00 A.... 303.104 296,00 K
nvwrszhc.dll Fri 11 Nov 2005 13:47:00 A.... 163.840 160,00 K
nvwrszht.dll Fri 11 Nov 2005 13:47:00 A.... 167.936 164,00 K
o8ro0i~1.dll Thu 29 Dec 2005 20:38:18 ..S.R 236.766 231,21 K
sirenacm.dll Thu 13 Oct 2005 0:11:06 A.... 118.784 116,00 K
wep.dll Thu 29 Dec 2005 21:52:58 ..S.R 236.766 231,21 K

74 items found: 74 files (3 H/S), 0 directories.
Total of file sizes: 38.260.588 bytes 36,48 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Het volume in station C heeft geen naam.
Het volumenummer is 88B4-0C2A

Map van C:\WINDOWS\System32

29/12/2005 21:52 236.766 wep.dll
29/12/2005 21:52 236.976 f0j20a1oed.dll
29/12/2005 20:38 236.766 o8ro0i93e8.dll
20/12/2005 21:16 <DIR> dllcache
3 bestand(en) 710.508 bytes
1 map(pen) 13.575.155.712 bytes beschikbaar
J

Jurgenv1

Legacy Member
Sluit alle programma's die open staan af.
Open de l2mfix-map opnieuw.
Dubbelklik op l2mfix.bat en kies nu optie #2 voor 'Run Fix' door 2 te typen en daarna op enter te drukken.
De iconen op je bureaublad zullen verdwijnen en de L2Mfix gaat je computer scannen. Als het scannen klaar is, zal de computer aangeven dat hij opnieuw gaat opstarten.
Druk op Enter en de pc zal automatisch herstarten. Na de reboot zal een kladblokbestand worden geopend.
Kopieer de inhoud van dat bestand en plaats dat hier.
v

vegetto

Legacy Member
L2mfix Beta 122705
Creating Account.
De opdracht is voltooid.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 408 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 488 'winlogon.exe'
Killing PID 488 'winlogon.exe'
Killing PID 488 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1888 'explorer.exe'
Killing PID 1888 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1788 'rundll32.exe'
Killing PID 2040 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
moving: C:\WINDOWS\system32\f0j20a1oed.dll
Successfully Moved: C:\WINDOWS\system32\f0j20a1oed.dll
moving: C:\WINDOWS\system32\o8ro0i93e8.dll
Successfully Moved: C:\WINDOWS\system32\o8ro0i93e8.dll
moving: C:\WINDOWS\system32\wep.dll
Successfully Moved: C:\WINDOWS\system32\wep.dll




Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\o8ro0i93e8.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\f0j20a1oed.dll
C:\WINDOWS\system32\o8ro0i93e8.dll
C:\WINDOWS\system32\wep.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}\InprocServer32]
@="C:\\WINDOWS\\system32\\sbcpack.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}\InprocServer32]
@="C:\\WINDOWS\\system32\\snbiop.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}\InprocServer32]
@="C:\\WINDOWS\\system32\\VCAME.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}\InprocServer32]
@="C:\\WINDOWS\\system32\\czyptdll.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}\InprocServer32]
@="C:\\WINDOWS\\system32\\dywsock.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}\InprocServer32]
@="C:\\WINDOWS\\system32\\unrv42a.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}\InprocServer32]
@="C:\\WINDOWS\\system32\\wep.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}"=-
"{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}"=-
"{9C9D7A33-260E-4E46-A01E-C038F3920ACA}"=-
"{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}"=-
"{C666B310-ED27-414B-BE5E-072C1194E5E2}"=-
"{F939936B-76B1-4B42-BDB4-F165C40C3617}"=-
"{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}"=-
"{242674D8-35ED-4635-8E6D-B92B2249F43A}"=-
"{90D7C3EF-022E-4564-9439-A3914038265F}"=-
"{6B533084-88AA-4A90-A148-09747EEA5850}"=-
"{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}"=-
[-HKEY_CLASSES_ROOT\CLSID\{6B47800A-FF65-4BE7-8A4B-331DF1DAA91B}]
[-HKEY_CLASSES_ROOT\CLSID\{4F5B8888-7B1E-4F6E-A557-4EE37C6C5133}]
[-HKEY_CLASSES_ROOT\CLSID\{9C9D7A33-260E-4E46-A01E-C038F3920ACA}]
[-HKEY_CLASSES_ROOT\CLSID\{D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8}]
[-HKEY_CLASSES_ROOT\CLSID\{C666B310-ED27-414B-BE5E-072C1194E5E2}]
[-HKEY_CLASSES_ROOT\CLSID\{F939936B-76B1-4B42-BDB4-F165C40C3617}]
[-HKEY_CLASSES_ROOT\CLSID\{04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A}]
[-HKEY_CLASSES_ROOT\CLSID\{242674D8-35ED-4635-8E6D-B92B2249F43A}]
[-HKEY_CLASSES_ROOT\CLSID\{90D7C3EF-022E-4564-9439-A3914038265F}]
[-HKEY_CLASSES_ROOT\CLSID\{6B533084-88AA-4A90-A148-09747EEA5850}]
[-HKEY_CLASSES_ROOT\CLSID\{6CCFD56B-F1EC-4BBD-8811-90236E4B6E60}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/f0j20a1oed.dll (148 bytes security) (deflated 6%)
adding: dlls/o8ro0i93e8.dll (148 bytes security) (deflated 6%)
adding: dlls/wep.dll (148 bytes security) (deflated 6%)
adding: backregs/04D2DA94-E305-41F0-BAB6-5CE1B6E3E20A.reg (212 bytes security) (deflated 70%)
adding: backregs/242674D8-35ED-4635-8E6D-B92B2249F43A.reg (212 bytes security) (deflated 70%)
adding: backregs/4F5B8888-7B1E-4F6E-A557-4EE37C6C5133.reg (212 bytes security) (deflated 70%)
adding: backregs/6B47800A-FF65-4BE7-8A4B-331DF1DAA91B.reg (212 bytes security) (deflated 70%)
adding: backregs/6B533084-88AA-4A90-A148-09747EEA5850.reg (212 bytes security) (deflated 70%)
adding: backregs/6CCFD56B-F1EC-4BBD-8811-90236E4B6E60.reg (212 bytes security) (deflated 70%)
adding: backregs/90D7C3EF-022E-4564-9439-A3914038265F.reg (212 bytes security) (deflated 70%)
adding: backregs/9C9D7A33-260E-4E46-A01E-C038F3920ACA.reg (212 bytes security) (deflated 70%)
adding: backregs/C666B310-ED27-414B-BE5E-072C1194E5E2.reg (212 bytes security) (deflated 70%)
adding: backregs/D9CFF0CE-65BA-4D43-A5F7-8376DA9BECD8.reg (212 bytes security) (deflated 70%)
adding: backregs/F939936B-76B1-4B42-BDB4-F165C40C3617.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 72%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)
v

vegetto

Legacy Member
hij heeft juist gezegt dat hij geen pop-ups meer krijgt maar ik zal hem nog een logske late make
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan