antivirus.startpagina.nl

sidefind

  • Anonymous avatar

    Hennie

    Hoi allemaal

    Weet iemand hoe ik dit verwijder (ISearchTech.SideFind).

    Spybot AdAware, niets helpt.

    M.vgr.Hennie

  • Anonymous avatar

    lucas

    Ik zou het niet weten. De procedure op dit prikbord staat onder de rode link (LEES DIT EERST) boven in je scherm.

    Volg alle stappen en plaats een logje in dit topic dan kunnen we je verder helpen.

    Lucas :)

  • Anonymous avatar

    MANONNA

    Volgens mij..(correct me if I'm wrong) heb je nu in program files een map met archive.

    C:program files/archive.

    Daar zit die bende in..dus zolang die map er nog staat krijg je het steeds terug.

    Ik had het ook.

    Maar doe de stappen eerst maar eens onder LEES DIT EERST ja :D

  • Anonymous avatar

    lucas

    Klopt Manona, maar het kan ook nog wat anders zijn ;)

    Ik heb 1 maal zonder logje een advies gegeven is mij achteraf niet zo goed bevallen :D

    Lucas :)

  • Anonymous avatar

    Hennie

    Bedankt, ik zal binnenkort een log plaatsen

    Hennie 8-)

  • Anonymous avatar

    Hennie

    Hier is dan mijn logfile, kunnen jullie wat vinden, dat verwijst naar ISearchTech.SideFind, Spybot kan hem niet herstellen.

    Groeten Hennie

    Logfile of HijackThis v1.99.1

    Scan saved at 14:45:39, on 22-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\WINDOWS\System32\GEARSec.exe

    D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

    D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    D:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe

    C:\Program Files\Logitech\SetPoint\KEM.exe

    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

    D:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\PCCCLIENT.EXE

    D:\Program Files\Trend Micro\PC-cillin 2002\PCCGUIDE.EXE

    D:\Program Files\Trend Micro\PC-cillin 2002\POP3TRAP.EXE

    D:\Program Files\eMule\emule.exe

    C:\WINDOWS\system32\drwtsn32.exe

    C:\WINDOWS\system32\drwtsn32.exe

    C:\Documents and Settings\Wiefferen1\Bureaublad\Onderhoud\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.wanadoo.nl

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www-proxy.wanadoo.nl:8080

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - D:\Program Files\ReGetDx\iebar.dll

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe”

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe”

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe”

    O4 - HKCU\..\Run: D:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash

    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

    O4 - Global Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat

    O8 - Extra context menu item: &Alles downloaden met &ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm

    O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm

    O8 - Extra context menu item: Do&wnload met &ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm

    O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra button: Help - {117B1345-9A6A-4E7D-BB8B-DCFDC2317821} - file:///C|/Program Files/Wanadoo Cable/Help/index.html (file missing) (HKCU)

    O9 - Extra button: Website - {329CC529-3A8F-48A4-96FA-A650BDE1A587} - internet.casema.net/helpdesk/ (file missing) (HKCU)

    O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.nl

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - by16fd.bay16.hotmail.msn.com/resources/MsnPUpld.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097670331073

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129903401546

    O16 - DPF: {80330F43-7899-4D7F-AD17-C41F3E005895} (Download.DownloadManager) - www.musicminutes.com/downloadmanager/activex/download.cab

    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - messenger.msn.com/download/msnmessengersetupdownloader.cab

    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{BBC4576E-9558-4E02-AAF4-FA54C28D77A8}: NameServer = 195.96.96.97,195.96.96.33

    O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

    O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

    O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - D:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe

    O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

    O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - D:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

  • Anonymous avatar

    Erik

    Start alleen Hijackthis en vink alleen de volgende regels aan:

    O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll

    O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - D:\Program Files\ReGetDx\iebar.dll

    Sluit alle browser vensters behalve HJT en klik op fix checked.

    Verwijder de volgende mappen:

    C:\Program Files\Common Files\ReGet Shared <== Map

    D:\Program Files\ReGetDx <== Map

    Post een nieuw HJT logje en laat even weten hoe het met de problemen is

  • Anonymous avatar

    Hennie

    Hoi Erik

    Het staat er nog steeds, hier een nieuw log

    Logfile of HijackThis v1.99.1

    Scan saved at 17:29:29, on 22-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\WINDOWS\System32\GEARSec.exe

    D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

    D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    D:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe

    D:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe

    C:\Program Files\Logitech\SetPoint\KEM.exe

    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

    C:\Documents and Settings\Wiefferen1\Bureaublad\Onderhoud\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.nl

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www-proxy.wanadoo.nl:8080

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe”

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe”

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe”

    O4 - HKCU\..\Run: D:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash

    O4 - HKCU\..\Run: \Program\BackWeb-8876480.exe

    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

    O4 - Global Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat

    O8 - Extra context menu item: &Alles downloaden met &ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm

    O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm

    O8 - Extra context menu item: Do&wnload met &ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm

    O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra button: Help - {117B1345-9A6A-4E7D-BB8B-DCFDC2317821} - file:///C|/Program Files/Wanadoo Cable/Help/index.html (file missing) (HKCU)

    O9 - Extra button: Website - {329CC529-3A8F-48A4-96FA-A650BDE1A587} - http://internet.casema.net/helpdesk/ (file missing) (HKCU)

    O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.nl

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com/resources/MsnPUpld.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097670331073

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129903401546

    O16 - DPF: {80330F43-7899-4D7F-AD17-C41F3E005895} (Download.DownloadManager) - http://www.musicminutes.com/downloadmanager/activex/download.cab

    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab

    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{BBC4576E-9558-4E02-AAF4-FA54C28D77A8}: NameServer = 195.96.96.97,195.96.96.33

    O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

    O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

    O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - D:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe

    O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

    O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - D:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

  • Anonymous avatar

    Erik

    Fix deze regels nog met HJT:

    O16 - DPF: {80330F43-7899-4D7F-AD17-C41F3E005895} (Download.DownloadManager) - www.musicminutes.com/downloadmanager/activex/download.cab

    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

    Heb je al je PC herstart :?

  • Anonymous avatar

    Hennie

    hoi Erik

    Hier een nieuwe log, ik start m'n PC natuurlijk opnieuw op.

    Ik ben vanavond weg, dus ik zie het morgen wel weer

    Groeten Hennie 8-)

    Logfile of HijackThis v1.99.1

    Scan saved at 19:26:26, on 22-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\WINDOWS\System32\GEARSec.exe

    D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

    D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    D:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe

    D:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe

    D:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe

    C:\Program Files\Logitech\SetPoint\KEM.exe

    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

    C:\WINDOWS\system32\wuauclt.exe

    D:\Program Files\eMule\emule.exe

    C:\Documents and Settings\Wiefferen1\Bureaublad\Onderhoud\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.nl

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www-proxy.wanadoo.nl:8080

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe”

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe”

    O4 - HKLM\..\Run: “D:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe”

    O4 - HKCU\..\Run: D:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash

    O4 - HKCU\..\Run: \Program\BackWeb-8876480.exe

    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

    O4 - Global Startup: Spy Sweeper Fix.lnk = C:\Program Files\Webroot\Spy Sweeper\SpySweeperFix.bat

    O8 - Extra context menu item: &Alles downloaden met &ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm

    O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm

    O8 - Extra context menu item: Do&wnload met &ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm

    O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra button: Help - {117B1345-9A6A-4E7D-BB8B-DCFDC2317821} - file:///C|/Program Files/Wanadoo Cable/Help/index.html (file missing) (HKCU)

    O9 - Extra button: Website - {329CC529-3A8F-48A4-96FA-A650BDE1A587} - http://internet.casema.net/helpdesk/ (file missing) (HKCU)

    O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.nl

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by16fd.bay16.hotmail.msn.com/resources/MsnPUpld.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097670331073

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129903401546

    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{BBC4576E-9558-4E02-AAF4-FA54C28D77A8}: NameServer = 195.96.96.97,195.96.96.33

    O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

    O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

    O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - D:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe

    O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - D:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

    O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - D:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe