Hijackthis log

• 

  Ufuk

  05-11-2005 08:08

  Opstarten duurt bij mij heel lang, voordat het allemaal opgestart is, zijn wij 15 minuten verder.

  Kan iemand naar mijn logfile kijken en alles wat weg kan aangeven, zodat ik het kan verwijderen.

  Laatste tijd wordt mijn antivirusprogramma steeds uitgeschakelt, vanzelf w.s. door een of andere programma.

  Alvast heel erg bedankt.

  Ufuk

  Logfile of HijackThis v1.99.1

  Scan saved at 7:58:49, on 5-11-2005

  Platform: Windows XP SP2 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\AVPersonal\AVWUPSRV.EXE

  C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

  C:\WINDOWS\System32\nvsvc32.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\Classic PhoneTools\CapFax.EXE

  C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe

  C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

  C:\PROGRA~1\HotKeys\Ikeymain.exe

  C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE

  C:\Program Files\Real\RealPlayer\RealPlay.exe

  C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

  C:\Program Files\QuickTime\qttask.exe

  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

  C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

  C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

  C:\Program Files\Winamp\winampa.exe

  C:\WINDOWS\system32\rundll32.exe

  C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\WINDOWS\NCLAUNCH.EXe

  C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

  C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

  C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

  C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe

  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe

  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

  C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe

  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE

  C:\Program Files\AVPersonal\AVGNT.EXE

  C:\Documents and Settings\ERCIYAS\Mijn documenten\hijackthis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://0ml.net/cat

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\sp.dll/sp.html

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://0ml.net/cat

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://0ml.net/cat

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\sp.dll/sp.html

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pagina.nl

  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://0ml.net/searchasst.html

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://0ml.net/searchasst.html

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://0ml.net/cat

  R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://0ml.net/cat

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer van Het Net

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

  O2 - BHO: (no name) - {953ADA24-33AB-4B17-BA37-FD071CC1D92C} - C:\WINDOWS\system32\ghnibaa.dll (file missing)

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

  O3 - Toolbar: The Simple Toolbar Search - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA99EB} - (no file)

  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

  O3 - Toolbar: (no name) - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - (no file)

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

  O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\WINDOWS\System32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Classic PhoneTools\CapFax.EXE

  O4 - HKLM\..\Run: C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe

  O4 - HKLM\..\Run: C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

  O4 - HKLM\..\Run: C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\HotKeys\Ikeymain.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h

  O4 - HKLM\..\Run: C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

  O4 - HKLM\..\Run: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

  O4 - HKLM\..\Run: C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

  O4 - HKLM\..\Run: “C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe” /icon

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\AVPersonal\AVGNT.EXE” /min

  O4 - HKLM\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray

  O4 - HKLM\..\Run: C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

  O4 - HKLM\..\Run: C:\Program Files\Winamp\winampa.exe

  O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

  O4 - HKLM\..\Run: C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe

  O4 - HKLM\..\Run: “C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe”

  O4 - HKLM\..\RunServices: C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

  O4 - HKLM\..\RunOnce: “C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\DELDIR0.EXE” “C:\Program Files\McAfee\McAfee Shared Components\Guardian\”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: C:\Program Files\Microsoft Works\WkDetect.exe

  O4 - HKCU\..\Run: C:\WINDOWS\NCLAUNCH.EXe

  O4 - HKCU\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

  O4 - Global Startup: BlueSoleil.lnk = ?

  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

  O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

  O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

  O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

  O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

  O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

  O8 - Extra context menu item: Ontvang alles met FlashGet - C:\Program Files\FlashGet\jc_all.htm

  O8 - Extra context menu item: Ontvang met FlashGet - C:\Program Files\FlashGet\jc_link.htm

  O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

  O9 - Extra button: The Simple Toolbar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\System32\shdocvw.dll

  O9 - Extra ‘Tools’ menuitem: The Simple Toolbar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\System32\shdocvw.dll

  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O14 - IERESET.INF: START_PAGE_URL=http://www.hetnet.nl

  O16 - DPF: ConferenceRoom Java Client - http://www.myturkport.com/java/cr.cab

  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

  O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://home.hetnet.nl/bb/XUpload.ocx

  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab

  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

  O17 - HKLM\System\CCS\Services\Tcpip\..\{28B1EE3E-BD30-476D-8534-2EF0BADEEFB2}: NameServer = 195.121.1.34 195.121.1.66

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  O18 - Filter: text/html - {62B0B82B-D4BE-47FC-8C79-C9CD7738B571} - C:\WINDOWS\system32\ghnibaa.dll

  O18 - Filter: text/plain - {62B0B82B-D4BE-47FC-8C79-C9CD7738B571} - C:\WINDOWS\system32\ghnibaa.dll

  O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE

  O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

  O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)

  Rapporteren
• 

  pablo

  06-11-2005 12:13

  hoi ufuk,

  download op deze pagina het tooltje voor jouw besturingssysteem naar je bureaublad.

  http://www.trojaner-info.de/anleitungen/hijackthis/about_blank.html

  start het tooltje en klik op “desinfection starten”

  je pc zal herstart worden en na de herstart zal er een logje verschijnen,plaats dat hier samen met een nieuw hijack logje

  paul

  Rapporteren
• 

  Ufuk

  06-11-2005 21:40

  Logje na opstarten:

  (11-6-05 21:26:41) SPSeHjFix started v1.1.2

  (11-6-05 21:26:42) OS: WinXP Service Pack 2 (5.1.2600)

  (11-6-05 21:26:42) Language: nederlands

  (11-6-05 21:26:42) Win-Path: C:\WINDOWS

  (11-6-05 21:26:42) System-Path: C:\WINDOWS\system32

  (11-6-05 21:26:42) Temp-Path: C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\

  (11-6-05 21:26:46) Disinfection started

  (11-6-05 21:26:46) Bad-Dll(IEP): c:\docume~1\erciyas\locals~1\temp\sp.dll

  (11-6-05 21:26:46) UBF: 9 - UBB: 4 - UBR: 28

  (11-6-05 21:26:46) FilterKey: HKCR\text/html (deleted)

  (11-6-05 21:26:46) FilterKey: HKCR\CLSID\{62B0B82B-D4BE-47FC-8C79-C9CD7738B571} (deleted)

  (11-6-05 21:26:46) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)

  (11-6-05 21:26:46) FilterKey: HKCR\text/plain (deleted)

  (11-6-05 21:26:46) FilterKey: HKCR\CLSID\{62B0B82B-D4BE-47FC-8C79-C9CD7738B571} (error while deleting)

  (11-6-05 21:26:46) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)

  (11-6-05 21:26:46) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{953ADA24-33AB-4B17-BA37-FD071CC1D92C} (deleted)

  (11-6-05 21:26:46) BHO-Key: HKCR\CLSID\{953ADA24-33AB-4B17-BA37-FD071CC1D92C} (deleted)

  (11-6-05 21:26:46) UBF: 7 - UBB: 3 - UBR: 28

  (11-6-05 21:26:46) Bad IE-pages:

  deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\erciyas\locals~1\temp\sp.dll/sp.html

  hijacklog:

  Logfile of HijackThis v1.99.1

  Scan saved at 21:37:16, on 6-11-2005

  Platform: Windows XP SP2 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE

  C:\Program Files\AVPersonal\AVWUPSRV.EXE

  C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

  C:\WINDOWS\System32\nvsvc32.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\system32\wuauclt.exe

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\Classic PhoneTools\CapFax.EXE

  C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe

  C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

  C:\PROGRA~1\HotKeys\Ikeymain.exe

  C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE

  C:\Program Files\Real\RealPlayer\RealPlay.exe

  C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

  C:\Program Files\QuickTime\qttask.exe

  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

  C:\Program Files\AVPersonal\AVGNT.EXE

  C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

  C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

  C:\Program Files\Winamp\winampa.exe

  C:\WINDOWS\system32\rundll32.exe

  C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\WINDOWS\NCLAUNCH.EXe

  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

  C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

  C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe

  C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe

  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe

  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE

  C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

  C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Windows NT\Bureau-accessoires\WORDPAD.EXE

  C:\Documents and Settings\ERCIYAS\Mijn documenten\hijackthis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://0ml.net/cat

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://0ml.net/cat

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://0ml.net/cat

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pagina.nl

  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://0ml.net/searchasst.html

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://0ml.net/searchasst.html

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://0ml.net/cat

  R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://0ml.net/cat

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer van Het Net

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

  O3 - Toolbar: The Simple Toolbar Search - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA99EB} - (no file)

  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

  O3 - Toolbar: (no name) - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - (no file)

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

  O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\WINDOWS\System32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Classic PhoneTools\CapFax.EXE

  O4 - HKLM\..\Run: C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe

  O4 - HKLM\..\Run: C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

  O4 - HKLM\..\Run: C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\HotKeys\Ikeymain.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h

  O4 - HKLM\..\Run: C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

  O4 - HKLM\..\Run: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

  O4 - HKLM\..\Run: C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

  O4 - HKLM\..\Run: “C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe” /icon

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\AVPersonal\AVGNT.EXE” /min

  O4 - HKLM\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray

  O4 - HKLM\..\Run: C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

  O4 - HKLM\..\Run: C:\Program Files\Winamp\winampa.exe

  O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

  O4 - HKLM\..\Run: C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe

  O4 - HKLM\..\Run: “C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe”

  O4 - HKLM\..\RunServices: C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

  O4 - HKLM\..\RunOnce: “C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\DELDIR0.EXE” “C:\Program Files\McAfee\McAfee Shared Components\Guardian\”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: C:\Program Files\Microsoft Works\WkDetect.exe

  O4 - HKCU\..\Run: C:\WINDOWS\NCLAUNCH.EXe

  O4 - HKCU\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

  O4 - Global Startup: BlueSoleil.lnk = ?

  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

  O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

  O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

  O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

  O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

  O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

  O8 - Extra context menu item: Ontvang alles met FlashGet - C:\Program Files\FlashGet\jc_all.htm

  O8 - Extra context menu item: Ontvang met FlashGet - C:\Program Files\FlashGet\jc_link.htm

  O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

  O9 - Extra button: The Simple Toolbar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\System32\shdocvw.dll

  O9 - Extra ‘Tools’ menuitem: The Simple Toolbar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\System32\shdocvw.dll

  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O14 - IERESET.INF: START_PAGE_URL=http://www.hetnet.nl

  O16 - DPF: ConferenceRoom Java Client - http://www.myturkport.com/java/cr.cab

  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

  O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://home.hetnet.nl/bb/XUpload.ocx

  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab

  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

  O17 - HKLM\System\CCS\Services\Tcpip\..\{28B1EE3E-BD30-476D-8534-2EF0BADEEFB2}: NameServer = 195.121.1.34 195.121.1.66

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE

  O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

  O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)

  groeten

  Rapporteren
• 

  pablo

  06-11-2005 21:50

  hoi ufuk,

  dat gedeelte is gelukt,nu de rest nog

  zet microsoft antispyware even uit,of geef aan dat hij de registerveranderingen moet accepteren

  zet in configuratiescherm-mapoptie's eerst een vinkje bij “verborgen bestanden en mappen weergeven” en haal het vinkje weg bij “extensie's voor bekende bestandstypen verbergen” en bij “beschermde besturingsbestanden verbergen ( aanbevolen) ”,klik op toepassen en ok

  print de onderstaand instruktie's uit of kopieer ze naar een text bestand,de rest van de fix is in veilige modus en dan kan je deze pagina dus niet meer gebruiken om te spieken

  start op in veilige modus ( uitleg )

  start alléén hijack,vink alleen de onderstaande regels aan en klik op “fix checked”

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 0ml.net/cat

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 0ml.net/cat

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 0ml.net/cat

  R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = 0ml.net/searchasst.html

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = 0ml.net/searchasst.html

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = 0ml.net/cat

  R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = 0ml.net/cat

  O3 - Toolbar: The Simple Toolbar Search - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA99EB} - (no file)

  O3 - Toolbar: (no name) - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - (no file)

  O4 - HKLM\..\RunOnce: “C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\DELDIR0.EXE” “C:\Program Files\McAfee\McAfee Shared Components\Guardian\”

  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)

  leeg je temp file's voor iedere gebruiker,de mappen leegmaken,niet verwijderen:

  C:\Documents and Settings\\Local Settings\Temp\

  C:\Documents and Settings\\Local Settings\Temporary Internet Files

  C:\Documents and Settings\\Local Settings\Temporary Internet Files\content.ie5 <= als deze map niet weergegeven word ga dan naar de map temporary internet files en type dan \content.ie5 erachter in de adresbalk en klik enter

  C:\Windows\Temp\

  start opnieuw op in normale modus en plaats een nieuw hijack logje ter controle

  paul

  Rapporteren
• 

  Ufuk

  09-11-2005 06:33

  ik heb het gedaan, maar weinig verschil met het opstarten :

  logfile :

  Logfile of HijackThis v1.99.1

  Scan saved at 6:29:02, on 9-11-2005

  Platform: Windows XP SP2 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE

  C:\Program Files\AVPersonal\AVWUPSRV.EXE

  C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

  C:\WINDOWS\System32\nvsvc32.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\Classic PhoneTools\CapFax.EXE

  C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe

  C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

  C:\PROGRA~1\HotKeys\Ikeymain.exe

  C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE

  C:\Program Files\Real\RealPlayer\RealPlay.exe

  C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

  C:\Program Files\QuickTime\qttask.exe

  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

  C:\Program Files\AVPersonal\AVGNT.EXE

  C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

  C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

  C:\Program Files\Winamp\winampa.exe

  C:\WINDOWS\system32\rundll32.exe

  C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\WINDOWS\NCLAUNCH.EXe

  C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

  C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

  C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

  C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe

  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe

  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

  C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe

  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE

  C:\WINDOWS\system32\wscntfy.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Documents and Settings\ERCIYAS\Mijn documenten\hijackthis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\sp.dll/sp.html

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\sp.dll/sp.html

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pagina.nl

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer van Het Net

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl\msntb.dll

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

  O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\WINDOWS\System32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Classic PhoneTools\CapFax.EXE

  O4 - HKLM\..\Run: C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe

  O4 - HKLM\..\Run: C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

  O4 - HKLM\..\Run: C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\HotKeys\Ikeymain.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h

  O4 - HKLM\..\Run: C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

  O4 - HKLM\..\Run: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

  O4 - HKLM\..\Run: C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

  O4 - HKLM\..\Run: “C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe” /icon

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\AVPersonal\AVGNT.EXE” /min

  O4 - HKLM\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray

  O4 - HKLM\..\Run: C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

  O4 - HKLM\..\Run: C:\Program Files\Winamp\winampa.exe

  O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

  O4 - HKLM\..\Run: C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe

  O4 - HKLM\..\Run: “C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe”

  O4 - HKLM\..\RunServices: C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: C:\Program Files\Microsoft Works\WkDetect.exe

  O4 - HKCU\..\Run: C:\WINDOWS\NCLAUNCH.EXe

  O4 - HKCU\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

  O4 - Global Startup: BlueSoleil.lnk = ?

  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

  O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

  O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

  O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

  O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

  O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

  O8 - Extra context menu item: Ontvang alles met FlashGet - C:\Program Files\FlashGet\jc_all.htm

  O8 - Extra context menu item: Ontvang met FlashGet - C:\Program Files\FlashGet\jc_link.htm

  O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

  O9 - Extra button: The Simple Toolbar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\System32\shdocvw.dll

  O9 - Extra ‘Tools’ menuitem: The Simple Toolbar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\System32\shdocvw.dll

  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O14 - IERESET.INF: START_PAGE_URL=http://www.hetnet.nl

  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

  O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://home.hetnet.nl/bb/XUpload.ocx

  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab

  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

  O17 - HKLM\System\CCS\Services\Tcpip\..\{28B1EE3E-BD30-476D-8534-2EF0BADEEFB2}: NameServer = 195.121.1.34 195.121.1.66

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  O18 - Filter: text/html - {62B0B82B-D4BE-47FC-8C79-C9CD7738B571} - C:\WINDOWS\system32\ghnibaa.dll

  O18 - Filter: text/plain - {62B0B82B-D4BE-47FC-8C79-C9CD7738B571} - C:\WINDOWS\system32\ghnibaa.dll

  O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE

  O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

  O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)

  groetjes,

  Rapporteren
• 

  pablo

  09-11-2005 09:56

  hoi ufuk,

  zet in configuratiescherm-mapoptie's eerst een vinkje bij “verborgen bestanden en mappen weergeven” en haal het vinkje weg bij “extensie's voor bekende bestandstypen verbergen” en bij “beschermde besturingsbestanden verbergen ( aanbevolen) ”,klik op toepassen en ok

  print de onderstaand instruktie's uit of kopieer ze naar een text bestand,de rest van de fix is in veilige modus en dan kan je deze pagina dus niet meer gebruiken om te spieken

  gebruik eerst nogmaals de cleaner,start na de herstart meteen weer op in veilige modus ( uitleg )

  start alléén hijack,vink alleen de onderstaande regels aan en klik op “fix checked”

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\sp.dll/sp.html

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ERCIYAS\LOCALS~1\Temp\sp.dll/sp.html

  O18 - Filter: text/html - {62B0B82B-D4BE-47FC-8C79-C9CD7738B571} - C:\WINDOWS\system32\ghnibaa.dll

  O18 - Filter: text/plain - {62B0B82B-D4BE-47FC-8C79-C9CD7738B571} - C:\WINDOWS\system32\ghnibaa.dll

  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)

  verwijder de volgende bestanden

  C:\WINDOWS\system32\ghnibaa.dll

  leeg je temp file's voor iedere gebruiker,de mappen leegmaken,niet verwijderen:

  C:\Documents and Settings\\Local Settings\Temp\

  C:\Documents and Settings\\Local Settings\Temporary Internet Files

  C:\Documents and Settings\\Local Settings\Temporary Internet Files\content.ie5 <= als deze map niet weergegeven word ga dan naar de map temporary internet files en type dan \content.ie5 erachter in de adresbalk en klik enter

  C:\Windows\Temp\

  start opnieuw op in normale modus en plaats een nieuw hijack logje ter controle

  paul

  Rapporteren