Archief - Zou er iemand zo vriendelijk willen zijn om deze log eens te checken.

Logfile of HijackThis v1.99.1
Scan saved at 15:58:12, on 28-1-06
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\TWAIN_32\A4CIS\WATCH.EXE
C:\PROGRAM FILES\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 4.0 MY CUSTOM EDITION\CALCHECK.EXE
C:\WINDOWS\WINIPCFG.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\DESKTOP\NIEUWE MAP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\ejupi.dll/sp.html#66987
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\ejupi.dll/sp.html#66987
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\ejupi.dll/sp.html#66987
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\ejupi.dll/sp.html#66987
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\ejupi.dll/sp.html#66987
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\ejupi.dll/sp.html#66987
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\ejupi.dll/sp.html#66987
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://ybxolw.t.muxa.cc/h.php?aid=291 (obfuscated)
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {E2EE3398-3679-6B34-51F3-26F80A4F6FA2} - C:\WINDOWS\SYSYT32.DLL (file missing)
O2 - BHO: Class - {722A3A6C-BED8-E31F-6041-4D5147AC396F} - C:\WINDOWS\SYSTEM\IEXC32.DLL (file missing)
O2 - BHO: Class - {94BD1A37-5653-88A2-1E65-7852D1BEE72F} - C:\WINDOWS\JAVAMC.DLL (file missing)
O2 - BHO: Class - {4E2DDB4C-9153-2B94-20B9-4B35B30A9936} - C:\WINDOWS\SYSTEM\NTSN32.DLL (file missing)
O2 - BHO: Class - {C1764056-15F0-7405-21CA-6044D79346CA} - C:\WINDOWS\SYSTEM\APIKI.DLL (file missing)
O2 - BHO: Class - {31A78644-DA8B-57E0-32EC-89917AF00CFD} - C:\WINDOWS\ATLFJ.DLL
O2 - BHO: Class - {E4CBD514-E599-C72F-5DD0-DC9B8741D00A} - C:\WINDOWS\ATLPW32.DLL
O2 - BHO: Class - {98676320-6B03-5235-77D7-38BE16BF819A} - C:\WINDOWS\APIYV.DLL
O2 - BHO: Class - {7F8FCEAC-D101-240A-BFCB-CC1453A6BA45} - C:\WINDOWS\SYSTEM\CRCB.DLL
O2 - BHO: Class - {24F53B81-94CD-AC8D-2068-53BE5B54011B} - C:\WINDOWS\SYSTEM\IPPD32.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Taakcontrole] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [MSRT.EXE] C:\WINDOWS\MSRT.EXE
O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\PROGRAM FILES\SPYFIGHTER\SPYFIGHTER.EXE" monitor
O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\PROGRAM FILES\SPYFIGHTER\AutoUpdate.exe" silent
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS\SYSTEM\BCDetect.exe defer
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKLM\..\RunServices: [NTJH32.EXE] C:\WINDOWS\NTJH32.EXE /s
O4 - HKLM\..\RunServices: [MFCKB32.EXE] C:\WINDOWS\SYSTEM\MFCKB32.EXE /s
O4 - HKLM\..\RunServices: [NTLA.EXE] C:\WINDOWS\NTLA.EXE /s
O4 - HKLM\..\RunServices: [MSON.EXE] C:\WINDOWS\MSON.EXE /s
O4 - HKLM\..\RunServices: [APPVY.EXE] C:\WINDOWS\SYSTEM\APPVY.EXE /s
O4 - HKLM\..\RunServices: [ATLOP.EXE] C:\WINDOWS\ATLOP.EXE /s
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\A4CIS\WATCH.exe
O4 - Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab


Redelijk veel miserie met deze pc van mijn neef.
Alvast bedankt!

1. Download CWShredder.
Plaats het op een plaats waar je het snel terugvindt.
Nog niet laten runnen!

2. Download AboutBuster.
Unzip AboutBuster.zip. Je zal een map te zien krijgen met daarin Aboutbuster.exe

3. Download hsafix.
Unzip hsafix op je bureaublad maar klik er nog niet op.

4. Download en installeer CCleaner
Nog niet gebruiken!

5. Zorg ervoor dat je verborgen mappen en bestanden weergegeven zijn.
Ga naar Start en klik op Deze computer.
In de menubalk selecteer je Extra en dan Mapopties.
Selecteer de tab Weergave.
Bij Verborgen bestanden en mappen selecteer je Verborgen bestanden en mappen weergeven.
Bij Bestanden en mappen haal je het vinkje weg bij: Beveiligde besturingssysteembestanden verbergen (aanbevolen).
Klik op Ja om dit te bevestigen.
Klik op OK.

6. Start nu je pc op in VEILIGE MODE.
Tijdens het opstarten hou je de F8-toets ingedrukt tot het opstartmenu verschijnt.
In dit menu kies je de optie "Veilige modus".

7. Start CWShredder en klik op FIX

8. Dubbelklik nu op hsafix die je in het begin hebt gedownload naar je bureaublad.
Als er gevraagd wordt of je het wil toevoegen aan het register moet je op ja klikken.

9. Start Aboutbuster en laat het scannen.
Laat het daarna nog eens scannen om er zeker van te zijn dat aboutbuster effectief zijn werk kan afmaken.
Klik daarna op 'save log'

10. Start CCleaner en klik op Ccleaner opstarten (onderaan rechts)

11. Reboot je pc terug naar normale mode.

12. Doe daarna een online virusscan:TrendMicro Housecall
Vink het vakje met Auto Clean aan.
Laat het volledig je systeem scannen (Dit zal een tijdje duren)

13. Post een nieuw hijackthislogje + het logje van aboutbuster

14. Vertel me ook welke problemen je ondervonden hebt (indien die aanwezig waren) tijdens het uitvoeren van deze stappen.

Yo,

Heb alle stappen kunnen doen,hier de 2logs.

Logfile of HijackThis v1.99.1
Scan saved at 22:07:05, on 28-1-06
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 4.0 MY CUSTOM EDITION\CALCHECK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\NIEUWE MAP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {E2EE3398-3679-6B34-51F3-26F80A4F6FA2} - C:\WINDOWS\SYSYT32.DLL (file missing)
O2 - BHO: Class - {722A3A6C-BED8-E31F-6041-4D5147AC396F} - C:\WINDOWS\SYSTEM\IEXC32.DLL (file missing)
O2 - BHO: Class - {94BD1A37-5653-88A2-1E65-7852D1BEE72F} - C:\WINDOWS\JAVAMC.DLL (file missing)
O2 - BHO: Class - {4E2DDB4C-9153-2B94-20B9-4B35B30A9936} - C:\WINDOWS\SYSTEM\NTSN32.DLL (file missing)
O2 - BHO: Class - {C1764056-15F0-7405-21CA-6044D79346CA} - C:\WINDOWS\SYSTEM\APIKI.DLL (file missing)
O2 - BHO: Class - {31A78644-DA8B-57E0-32EC-89917AF00CFD} - C:\WINDOWS\ATLFJ.DLL (file missing)
O2 - BHO: Class - {E4CBD514-E599-C72F-5DD0-DC9B8741D00A} - C:\WINDOWS\ATLPW32.DLL (file missing)
O2 - BHO: Class - {98676320-6B03-5235-77D7-38BE16BF819A} - C:\WINDOWS\APIYV.DLL (file missing)
O2 - BHO: Class - {7F8FCEAC-D101-240A-BFCB-CC1453A6BA45} - C:\WINDOWS\SYSTEM\CRCB.DLL (file missing)
O2 - BHO: Class - {24F53B81-94CD-AC8D-2068-53BE5B54011B} - C:\WINDOWS\SYSTEM\IPPD32.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Taakcontrole] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\PROGRAM FILES\SPYFIGHTER\SPYFIGHTER.EXE" monitor
O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\PROGRAM FILES\SPYFIGHTER\AutoUpdate.exe" silent
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS\SYSTEM\BCDetect.exe defer
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\A4CIS\WATCH.exe
O4 - Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab

-----------------------------------------

AboutBuster 6.0
Scan started on [28-1-06] at [19:25:05]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
Streams(ADS) not scanned: System not NTFS
-------------------------------------------------------------
Removed File! : C:\WINDOWS\rsbwfj.dat
Removed File! : C:\WINDOWS\xbavdk.dat
Removed File! : C:\WINDOWS\lfpkdd.dat
Removed File! : C:\WINDOWS\lvkqta.dat
Removed File! : C:\WINDOWS\vzkjxa.dat
Removed File! : C:\WINDOWS\lqwvmg.dat
Removed File! : C:\WINDOWS\atlfj.dll
Removed File! : C:\WINDOWS\srwtd.log
Removed File! : C:\WINDOWS\msrt.exe
Removed File! : C:\WINDOWS\stnjdv.dat
Removed File! : C:\WINDOWS\ljimle.dat
Removed File! : C:\WINDOWS\dbbsnp.dat
Removed File! : C:\WINDOWS\atlpw32.dll
Removed File! : C:\WINDOWS\ntla.exe
Removed File! : C:\WINDOWS\buvqnh.log
Removed File! : C:\WINDOWS\apiyv.dll
Removed File! : C:\WINDOWS\nrpnuz.txt
Removed File! : C:\WINDOWS\hpfad.dat
Removed File! : C:\WINDOWS\mson.exe
Removed File! : C:\WINDOWS\n_jxdrgi.log
Removed File! : C:\WINDOWS\xbwhup.dat
Removed File! : C:\WINDOWS\ahfuor.dat
Removed File! : C:\WINDOWS\gdekjc.txt
Removed File! : C:\WINDOWS\yvxisi.dat
Removed File! : C:\WINDOWS\atlop.exe
Removed File! : C:\WINDOWS\qeopud.dat
Removed File! : C:\WINDOWS\SYSTEM\crcb.dll
Removed File! : C:\WINDOWS\SYSTEM\rirhm.dat
Removed File! : C:\WINDOWS\SYSTEM\huxzf.dat
Removed File! : C:\WINDOWS\SYSTEM\ippd32.dll
Removed File! : C:\WINDOWS\SYSTEM\mpoez.txt
Removed File! : C:\WINDOWS\SYSTEM\lebch.log
Removed File! : C:\WINDOWS\SYSTEM\appvy.exe
-------------------------------------------------------------
Removed Temp Files
Internet Explorer Settings Reset!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 19:28:01


AboutBuster 6.0
Scan started on [28-1-06] at [19:28:51]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
Streams(ADS) not scanned: System not NTFS
-------------------------------------------------------------
No Files Found!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 19:31:31

* ga naar start==>configuratiescherm==>software en de-installeer indien aanwezig:
SpyFighter
SpyKiller
alexa

* open hijackthis en vink volgende regels aan indien aanwezig:

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {E2EE3398-3679-6B34-51F3-26F80A4F6FA2} - C:\WINDOWS\SYSYT32.DLL (file missing)
O2 - BHO: Class - {722A3A6C-BED8-E31F-6041-4D5147AC396F} - C:\WINDOWS\SYSTEM\IEXC32.DLL (file missing)
O2 - BHO: Class - {94BD1A37-5653-88A2-1E65-7852D1BEE72F} - C:\WINDOWS\JAVAMC.DLL (file missing)
O2 - BHO: Class - {4E2DDB4C-9153-2B94-20B9-4B35B30A9936} - C:\WINDOWS\SYSTEM\NTSN32.DLL (file missing)
O2 - BHO: Class - {C1764056-15F0-7405-21CA-6044D79346CA} - C:\WINDOWS\SYSTEM\APIKI.DLL (file missing)
O2 - BHO: Class - {31A78644-DA8B-57E0-32EC-89917AF00CFD} - C:\WINDOWS\ATLFJ.DLL (file missing)
O2 - BHO: Class - {E4CBD514-E599-C72F-5DD0-DC9B8741D00A} - C:\WINDOWS\ATLPW32.DLL (file missing)
O2 - BHO: Class - {98676320-6B03-5235-77D7-38BE16BF819A} - C:\WINDOWS\APIYV.DLL (file missing)
O2 - BHO: Class - {7F8FCEAC-D101-240A-BFCB-CC1453A6BA45} - C:\WINDOWS\SYSTEM\CRCB.DLL (file missing)
O2 - BHO: Class - {24F53B81-94CD-AC8D-2068-53BE5B54011B} - C:\WINDOWS\SYSTEM\IPPD32.DLL (file missing)
O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\PROGRAM FILES\SPYFIGHTER\SPYFIGHTER.EXE" monitor
O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\PROGRAM FILES\SPYFIGHTER\AutoUpdate.exe" silent
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* start je pc in VEILIGE MODUS

* verwijder volgende indien aanwezig:

C:\PROGRAM FILES\SPYFIGHTER <== deze map
C:\Program Files\SpyKiller <== deze map
C:\WINDOWS\web\related.htm <== dit bestand

* start je pc weer normaal en post een nieuw hijackthis logje hier

Alles gedaan hier volgt log :


Logfile of HijackThis v1.99.1
Scan saved at 1:22:02, on 29-1-06
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\TWAIN_32\A4CIS\WATCH.EXE
C:\PROGRAM FILES\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 4.0 MY CUSTOM EDITION\CALCHECK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
D:\PROGRAM_FILES\MSCAN\MSOFFICE\PANEL.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\NIEUWE MAP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Taakcontrole] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\SYSTEM\intell32.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS\SYSTEM\BCDetect.exe defer
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\A4CIS\WATCH.exe
O4 - Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab

* Je kan deze instructies best uitprinten of opslaan in een kladblokbestand, want straks zal je in veilige modus
moeten gaan werken, en dan is deze pagina niet beschikbaar (geen internet)

* Download smitRem.exe en sla dit op op het Bureaublad.
Dubbelklik op het bestand en pak het uit naar zijn eigen map op het Bureaublad.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm

* Start je computer op in VEILIGE MODUS


* open hijackthis en vink volgende regels aan:

O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\SYSTEM\intell32.exe

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'


* Open de smitrem-map op je bureaublad, en dubbelklik op RunThis.bat. Volg de aanwijzigingen op het scherm.
Je bureaublad en ikoontjes zullen even verdwijnen en daarna terug verschijnen, dit is normaal.
Wacht tot het tooltje zijn werk heeft gedaan en Disk Cleanup afgelopen is. Dit kan enige tijd duren, dus wees geduldig.

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

* Herstart je computer in normale modus.

* Doe een online scan via Panda's online virus scan en bewaar het rapport dat je krijgt na het scannen

* Herstart je pc nogmaals en plaats dan een nieuw logje van Hijackthis, samen met het rapport van Panda en post ook de log van de smitRem tool, die je hier kan vinden: C:\smitfiles.txt.

Jurgenv1 ,bedankt voor alle hulp alles is opgelost nu.

mag ik nog de logjes zien?