antivirus.startpagina.nl

log file

  • Anonymous avatar

    Caren

    kan iemand na deze logfile kijken, heb de stappen gedaan maar hij blijft zeer trag

    Logfile of HijackThis v1.99.1

    Scan saved at 21:18:10, on 24-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\windows\system\hpsysdrv.exe

    C:\HP\KBD\KBD.EXE

    C:\Program Files\ATI Technologies\ATI-configuratiescherm\atiptaxx.exe

    C:\WINDOWS\Mixer.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    C:\Program Files\Real\RealPlayer\RealPlay.exe

    C:\WINDOWS\system32\LVCOMSX.EXE

    C:\Program Files\Logitech\Video\LogiTray.exe

    C:\WINDOWS\system32\emakesv.exe

    C:\Program Files\Webroot\Washer\wwDisp.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

    C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe

    C:\Program Files\Logitech\Video\FxSvr2.exe

    C:\Program Files\eFax Messenger 4.0\J2GTray.exe

    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

    C:\Program Files\Logitech\SetPoint\KEM.exe

    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

    C:\WINDOWS\system32\mmc.exe

    C:\WINDOWS\system32\DfrgNtfs.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Documents and Settings\Eigenaar\Local Settings\Temporary Internet Files\Content.IE5\P7RW26P6\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/eMakeSV/Portal/portal.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/eMakeSV/Portal/portal.html

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/eMakeSV/Portal/portal.html

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

    O2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000000} - C:\WINDOWS\system32\IEHelper.dll (file missing)

    O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

    O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\igfxtray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\hkcmd.exe

    O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

    O4 - HKLM\..\Run: “C:\Program Files\VERITAS Software\Update Manager\sgtray.exe” /r

    O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

    O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

    O4 - HKLM\..\Run: nwiz.exe /install

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: atiptaxx.exe

    O4 - HKLM\..\Run: Mixer.exe /startup

    O4 - HKLM\..\Run: C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

    O4 - HKLM\..\Run: C:\Program Files\Norton Internet Security\UrlLstCk.exe

    O4 - HKLM\..\Run: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

    O4 - HKLM\..\Run: C:\PROGRA~1\SYMNET~1\SNDMon.exe

    O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -u

    O4 - HKLM\..\Run: C:\Program Files\Gouden Gids\Virtuele Katja\VKatja.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\LVCOMSX.EXE

    O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\ISStart.exe

    O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\LogiTray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART

    O4 - HKLM\..\Run: C:\WINDOWS\system32\emakesv.exe

    O4 - HKCU\..\Run: c:\Program Files\Microsoft Works\WkDetect.exe

    O4 - HKCU\..\Run: C:\Program Files\Webroot\Washer\wwDisp.exe

    O4 - HKCU\..\Run: C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0

    O4 - HKCU\..\Run: \Program\BackWeb-8876480.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized

    O4 - HKCU\..\Run: “C:\PROGRA~1\FREEME~1\fmempro.exe” autostart

    O4 - HKCU\..\Run: C:\PROGRA~1\CSIM\aim.exe -cnetwait.odl

    O4 - HKCU\..\Run: “C:\Program Files\Logitech\Video\ManifestEngine.exe” boot

    O4 - HKCU\..\Run: C:\Program Files\Ascentive\Spyware Striker\SpywareStriker.exe -m

    O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE

    O4 - Global Startup: eFax DllCmd 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe

    O4 - Global Startup: eFax Tray Menu 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GTray.exe

    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

    O4 - Global Startup: hpoddt01.exe.lnk = ?

    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/

    O16 - DPF: {0D5AAD20-C9EF-11D4-B5D3-00C04F163665} (CBSBiB.iPCRClickMap) - http://www.cbs.nl/nl/cijfers/buurt-in-beeld/klikkaart.CAB

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by110fd.bay110.hotmail.msn.com/resources/MsnPUpld.cab

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game19.zylomgames.com/activex/zylomgamesplayer.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

    O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  • Anonymous avatar

    wollie

    Hallo Caren,

    Kijk eens bij Start>Configuratiescherm>Software of daar het programma Switch tussen staat. Indien aanwezig verwijderen. Herstart daarna je PC en maak een nieuw Hijack This logje.

    Switch kan je overigens het beste verwijderen in de veilige modus (tijdens het starten op F8 klikken) en zorg indien je het in normale modus doet dat het geen contact maakt met het internet.

    Wollie :)

  • Anonymous avatar

    dirk

    terug op de basis !!!!!!!!

  • Anonymous avatar

    Caren

    Wollie Bedankt hier de nieuwe log file

    Logfile of HijackThis v1.99.1

    Scan saved at 22:10:01, on 24-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\windows\system\hpsysdrv.exe

    C:\HP\KBD\KBD.EXE

    C:\Program Files\ATI Technologies\ATI-configuratiescherm\atiptaxx.exe

    C:\WINDOWS\Mixer.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    C:\Program Files\Real\RealPlayer\RealPlay.exe

    C:\Program Files\Gouden Gids\Virtuele Katja\VKatja.exe

    C:\WINDOWS\system32\LVCOMSX.EXE

    C:\Program Files\Logitech\Video\LogiTray.exe

    C:\Program Files\Webroot\Washer\wwDisp.exe

    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Ascentive\Spyware Striker\SpywareStriker.exe

    C:\Program Files\Gouden Gids\Virtuele Katja\VKMain.exe

    C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe

    C:\Program Files\eFax Messenger 4.0\J2GTray.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

    C:\Program Files\Logitech\SetPoint\KEM.exe

    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

    C:\Program Files\Logitech\Video\FxSvr2.exe

    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Documents and Settings\Eigenaar\Local Settings\Temporary Internet Files\Content.IE5\P7RW26P6\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/eMakeSV/Portal/portal.html

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = about:blank

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

    O2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000000} - C:\WINDOWS\system32\IEHelper.dll (file missing)

    O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

    O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\igfxtray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\hkcmd.exe

    O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

    O4 - HKLM\..\Run: “C:\Program Files\VERITAS Software\Update Manager\sgtray.exe” /r

    O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

    O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

    O4 - HKLM\..\Run: nwiz.exe /install

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: atiptaxx.exe

    O4 - HKLM\..\Run: Mixer.exe /startup

    O4 - HKLM\..\Run: C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

    O4 - HKLM\..\Run: C:\Program Files\Norton Internet Security\UrlLstCk.exe

    O4 - HKLM\..\Run: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

    O4 - HKLM\..\Run: C:\PROGRA~1\SYMNET~1\SNDMon.exe

    O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -u

    O4 - HKLM\..\Run: C:\Program Files\Gouden Gids\Virtuele Katja\VKatja.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\LVCOMSX.EXE

    O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\ISStart.exe

    O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\LogiTray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART

    O4 - HKCU\..\Run: c:\Program Files\Microsoft Works\WkDetect.exe

    O4 - HKCU\..\Run: C:\Program Files\Webroot\Washer\wwDisp.exe

    O4 - HKCU\..\Run: C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0

    O4 - HKCU\..\Run: \Program\BackWeb-8876480.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized

    O4 - HKCU\..\Run: “C:\PROGRA~1\FREEME~1\fmempro.exe” autostart

    O4 - HKCU\..\Run: C:\PROGRA~1\CSIM\aim.exe -cnetwait.odl

    O4 - HKCU\..\Run: “C:\Program Files\Logitech\Video\ManifestEngine.exe” boot

    O4 - HKCU\..\Run: C:\Program Files\Ascentive\Spyware Striker\SpywareStriker.exe -m

    O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE

    O4 - Global Startup: eFax DllCmd 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe

    O4 - Global Startup: eFax Tray Menu 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GTray.exe

    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

    O4 - Global Startup: hpoddt01.exe.lnk = ?

    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/

    O16 - DPF: {0D5AAD20-C9EF-11D4-B5D3-00C04F163665} (CBSBiB.iPCRClickMap) - http://www.cbs.nl/nl/cijfers/buurt-in-beeld/klikkaart.CAB

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by110fd.bay110.hotmail.msn.com/resources/MsnPUpld.cab

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game19.zylomgames.com/activex/zylomgamesplayer.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

    O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  • Anonymous avatar

    wollie

    Hallo Caren,

    Je voert straks alles uit in veilige modus, daarom raad ik je aan deze instructie te printen of op te slaan in een tekstbestandje!

    1. Omdat de bestanden die je van je PC gaat verwijderen eventueel verborgen kunnen staan moet je eerst het volgende doen:

    Ga naar Start>Configuratiescherm>Mapopties>tabblad Weergave: Zet een vinkje bij verborgen bestanden en mappen weergeven, en haal de vinkjes weg bij beveiligde systeembestanden verbergen ( aanbevolen ) en bij extensies voor bekende bestandstypen verbergen, klik op en .

    2. Met Spyware Striker heb je jezelf een nepscanner binnen gehaald. Verwijder hem via Start>Configuratiescherm>Software.

    3. NB. Plaats Hijack This in een eigen map, bijvoorbeeld C:\HJT\. Hijack This maakt namelijk back-ups in de map waarin hij staat. In andere mappen raak je deze back-ups kwijt!

    4. Start je computer nu op in de veilige modus.

    5. Start Hijack This op en klik op .

    Vink alleen de volgende regels aan in Hijack This:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20Files/eMakeSV/Portal/portal.html

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = about:blank

    O2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-000000000000} - C:\WINDOWS\system32\IEHelper.dll (file missing)

    O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL

    O4 - HKLM\..\Run: C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART

    O8 - Extra context menu item: &Search - kc.bar.need2find.com/KC/menusearch.html?p=KC

    6. Sluit nu alle toepassingen behalve Hijack This en klik op

    7. Verwijder (indien aanwezig) de volgende mappen/bestanden:

    C:/Program Files/eMakeSV <= deze map

    C:\Program Files\Need2Find\ <= deze map

    ] C:\WINDOWS\system32\P2P Networking\ <= deze map

    8. Plaats na herstart in normale modus een nieuwe Hijack This log en geef aan welke problemen je eventueel bent tegengekomen bij het uitvoeren van de Fix.

    Succes, Wollie :)

  • Anonymous avatar

    Caren

    Wollie sorry dat het wat langer duurde maar ik moest werken, bedankt voor je hulp alvast , Ik mheb alles gedaan en heb nergens hinder van gehad alles werkt nog. Alleen blijft de pc er traag , Hieronder de nieuwe log

    Logfile of HijackThis v1.99.1

    Scan saved at 14:17:54, on 25-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\windows\system\hpsysdrv.exe

    C:\HP\KBD\KBD.EXE

    C:\Program Files\VERITAS Software\Update Manager\sgtray.exe

    C:\Program Files\ATI Technologies\ATI-configuratiescherm\atiptaxx.exe

    C:\WINDOWS\Mixer.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    C:\Program Files\Real\RealPlayer\RealPlay.exe

    C:\Program Files\Gouden Gids\Virtuele Katja\VKatja.exe

    C:\WINDOWS\system32\LVCOMSX.EXE

    C:\Program Files\Logitech\Video\LogiTray.exe

    C:\Program Files\Webroot\Washer\wwDisp.exe

    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe

    C:\Program Files\eFax Messenger 4.0\J2GTray.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

    C:\Program Files\Gouden Gids\Virtuele Katja\VKMain.exe

    C:\Program Files\Logitech\Video\FxSvr2.exe

    C:\Program Files\Logitech\SetPoint\KEM.exe

    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\HJT\hijackthis.exe

    C:\Program Files\Messenger\msmsgs.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

    O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\igfxtray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\hkcmd.exe

    O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

    O4 - HKLM\..\Run: “C:\Program Files\VERITAS Software\Update Manager\sgtray.exe” /r

    O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

    O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

    O4 - HKLM\..\Run: nwiz.exe /install

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: atiptaxx.exe

    O4 - HKLM\..\Run: Mixer.exe /startup

    O4 - HKLM\..\Run: C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

    O4 - HKLM\..\Run: C:\Program Files\Norton Internet Security\UrlLstCk.exe

    O4 - HKLM\..\Run: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

    O4 - HKLM\..\Run: C:\PROGRA~1\SYMNET~1\SNDMon.exe

    O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -u

    O4 - HKLM\..\Run: C:\Program Files\Gouden Gids\Virtuele Katja\VKatja.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\LVCOMSX.EXE

    O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\ISStart.exe

    O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\LogiTray.exe

    O4 - HKCU\..\Run: c:\Program Files\Microsoft Works\WkDetect.exe

    O4 - HKCU\..\Run: C:\Program Files\Webroot\Washer\wwDisp.exe

    O4 - HKCU\..\Run: C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0

    O4 - HKCU\..\Run: \Program\BackWeb-8876480.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized

    O4 - HKCU\..\Run: “C:\PROGRA~1\FREEME~1\fmempro.exe” autostart

    O4 - HKCU\..\Run: C:\PROGRA~1\CSIM\aim.exe -cnetwait.odl

    O4 - HKCU\..\Run: “C:\Program Files\Logitech\Video\ManifestEngine.exe” boot

    O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE

    O4 - Global Startup: eFax DllCmd 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe

    O4 - Global Startup: eFax Tray Menu 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GTray.exe

    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

    O4 - Global Startup: hpoddt01.exe.lnk = ?

    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/

    O16 - DPF: {0D5AAD20-C9EF-11D4-B5D3-00C04F163665} (CBSBiB.iPCRClickMap) - http://www.cbs.nl/nl/cijfers/buurt-in-beeld/klikkaart.CAB

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by110fd.bay110.hotmail.msn.com/resources/MsnPUpld.cab

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game19.zylomgames.com/activex/zylomgamesplayer.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

    O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  • Anonymous avatar

    wollie

    Hallo Caren,

    Ik ken dat werken :D.

    In principe zitten er in je logje niet echt spyware meer, maar je zou de volgende dingen nog kunnen doen. Dat wat ik je weg laat halen met Hijack This is niet echt spyware, maar het zijn programmaatjes die op de achtergrond contact maken met hun bron op het internet zonder dat jij dat in de gaten hebt en waarschijnlijk daar ook helemaal niet op zit te wachten. Vandaar dat ik je dat weg laat halen (het contact maken ;))

    1. Start Hijack This op en klik op .

    Vink alleen de volgende regels aan in Hijack This:

    O4 - HKCU\..\Run: \Program\BackWeb-8876480.exe

    O4 - Global Startup: hpoddt01.exe.lnk = ?

    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} –

    2. Sluit nu alle toepassingen behalve Hijack This en klik op

    3. Je kan ook nog je PC eens een goede schoonmaakbeurt geven volgens dit stappenplan. Daarmee kan je vaak wat snelheid terugkrijgen.

    http://www.virushelp.nl/onderhoud.htm

    Succes, Wollie :)

  • Anonymous avatar

    Caren

    Wollie

    Als ik je laatste posting uitvoer krijg ik deze melding, wat moet ik hier mee?

    Unexpected error occurred!

    Error #52 (Bad file name or number) in Sub GetLongPath(?.exe).

    Please send a report to merijn@spywareinfo.com, mentioning what you were doing, and what version of Windows you have.

    This message has been copied to your clipboard.

    ter controle nogmaals een log file

    Logfile of HijackThis v1.99.1

    Scan saved at 19:09:34, on 26-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\windows\system\hpsysdrv.exe

    C:\HP\KBD\KBD.EXE

    C:\Program Files\ATI Technologies\ATI-configuratiescherm\atiptaxx.exe

    C:\WINDOWS\Mixer.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    C:\Program Files\Real\RealPlayer\RealPlay.exe

    C:\WINDOWS\system32\LVCOMSX.EXE

    C:\Program Files\Logitech\Video\LogiTray.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe

    C:\Program Files\eFax Messenger 4.0\J2GTray.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

    C:\Program Files\Logitech\SetPoint\KEM.exe

    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

    C:\Program Files\Logitech\Video\FxSvr2.exe

    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\HJT\hijackthis.exe

    C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Messenger\msmsgs.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

    O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\igfxtray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\hkcmd.exe

    O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

    O4 - HKLM\..\Run: “C:\Program Files\VERITAS Software\Update Manager\sgtray.exe” /r

    O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

    O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

    O4 - HKLM\..\Run: nwiz.exe /install

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: atiptaxx.exe

    O4 - HKLM\..\Run: Mixer.exe /startup

    O4 - HKLM\..\Run: C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

    O4 - HKLM\..\Run: C:\Program Files\Norton Internet Security\UrlLstCk.exe

    O4 - HKLM\..\Run: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

    O4 - HKLM\..\Run: C:\PROGRA~1\SYMNET~1\SNDMon.exe

    O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -u

    O4 - HKLM\..\Run: C:\Program Files\Gouden Gids\Virtuele Katja\VKatja.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\LVCOMSX.EXE

    O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\ISStart.exe

    O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\LogiTray.exe

    O4 - HKCU\..\Run: c:\Program Files\Microsoft Works\WkDetect.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized

    O4 - HKCU\..\Run: “C:\PROGRA~1\FREEME~1\fmempro.exe” autostart

    O4 - HKCU\..\Run: “C:\Program Files\Logitech\Video\ManifestEngine.exe” boot

    O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE

    O4 - Global Startup: eFax DllCmd 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe

    O4 - Global Startup: eFax Tray Menu 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GTray.exe

    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/

    O16 - DPF: {0D5AAD20-C9EF-11D4-B5D3-00C04F163665} (CBSBiB.iPCRClickMap) - http://www.cbs.nl/nl/cijfers/buurt-in-beeld/klikkaart.CAB

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by110fd.bay110.hotmail.msn.com/resources/MsnPUpld.cab

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game19.zylomgames.com/activex/zylomgamesplayer.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

    O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  • Anonymous avatar

    wollie

    Caren schreef:

    >

    > Als ik je laatste posting uitvoer krijg ik deze melding, wat

    > moet ik hier mee?

    Hallo Caren,

    De opdracht heeft hij wel uitgevoerd. De melding kan je negeren, of indien je Merijn wil helpen met het doorontwikkelen van Hijack This dan de melding doormailen aan Merijn.

    Merijn is een Nederlandse jongen die Hijack This heeft gemaakt, waardoor anti-malware sites zoals deze over de gehele wereld mensen zoals jijzelf kan helpen. Merijn doet dit kostenloos en doordat gebruikers van zijn progje hem foutmeldingen doorstuurt kan hij iedere keer Hijack This nog verder verbeteren.

    Je logje is overigens nu echt schoon. Het traag zijn van je PC heeft dus niet meer te maken met spyware, virussen en andere malware. Om meer snelheid te krijgen kan je dus dat stappenplan doen, waar ik je eerder de link van heb gegeven.

    Wollie :)

  • Anonymous avatar

    Carren

    Hey Wollie bedankt voor je tijd en hulp , De pc is nu inderdaad een stuk sneller maar ik ga het stappen plan nog doen. NU moet ik ALWEER werken :(