logje

• 

  Teaser

  24-03-2009 12:43

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User ‘maarten’)

  Sorry blijf zeuren maar hij staat er nog steeds.

  In alle logjes

  Rapporteren
• 

  dientje

  24-03-2009 12:51

  hij nu echt af hoor

  Rapporteren
• 

  Teaser

  24-03-2009 12:53

  Dan weer nieuwe logjes plaatsen

  En graag even erbij zetten log 1 log 2 etc.etc. enz.

  Rapporteren
• 

  dientje

  24-03-2009 12:57

  tussen de logjes zitten stippellijntjes

  Rapporteren
• 

  dientje

  24-03-2009 13:04

  ik heb alleen gekeken met zoek of hij nog op de harde schijf stond

  en gekeken ook maar echt niets gevonden

  Rapporteren
• 

  Teaser

  24-03-2009 13:07

  mooi dus even nieuwe logjes maken die plaatsen

  Rapporteren
• 

  dientje

  24-03-2009 13:14

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 13:11:36, on 24-3-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16791)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Avira\AntiVir Desktop\sched.exe

  C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  C:\Program Files\iPod\bin\iPodService.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

  C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

  C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe

  C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

  C:\Program Files\Winamp\winampa.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\Program Files\iTunes\iTunesHelper.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Palm\Hotsync.exe

  C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

  C:\Program Files\Common Files\Teleca Shared\Generic.exe

  C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.home.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\SiSUSBrg.exe

  O4 - HKLM\..\Run: Rundll32.exe SiSPower.dll,ModeAgent

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

  O4 - HKLM\..\Run: “C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe” WINDOWCALL

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Avira\AntiVir Desktop\avgnt.exe” /min

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: “C:\Program Files\Hyves Kwekker\HyvesDesktop_2.exe”

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: “C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” AcRdB7_0_7 -reboot 1 (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\DOCUME~1\maarten\APPLIC~1\OPTION~1\Link About.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\PROGRA~1\HYVESD~1\bin\HYVESD~1.EXE (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={5DD2FAC9-751C-4ca3-A589-364E7026811E}; SIMBAR=0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; .NET CLR 2.0.50727)” -“http://www.habbo.nl/client” (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1008\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘Jonne’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1009\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘Elke’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1009\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={5DD2FAC9-751C-4ca3-A589-364E7026811E}; SIMBAR=0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)” -“http://www.habbo.nl/client” (User ‘Elke’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - S-1-5-21-1343024091-1229272821-1177238915-1004 Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe (User ‘maarten’)

  O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra button: MyCom - {3E085E5E-40AF-4A93-B006-9F20BAE83AA3} - http://www.mycom.nl (file missing) (HKCU)

  O16 - DPF: {426784E5-24B2-4708-820D-117342FAD009} (Cimporter Object) - http://www.hyves.nl/cab/outlookaddressbook.cab

  O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyvz.com/statics/Aurigma/ImageUploader4.cab

  O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://84.30.136.78/activex/AxisCamControl.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {FACEE739-329B-4C23-9FCC-C85B0270CFDC} (Launcher Control) - http://www.smootsy.com/launcher.cab

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  –

  End of file - 11077 bytes

  Rapporteren
• 

  dientje

  24-03-2009 13:18

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 13:11:36, on 24-3-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16791)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Avira\AntiVir Desktop\sched.exe

  C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  C:\Program Files\iPod\bin\iPodService.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

  C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

  C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe

  C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

  C:\Program Files\Winamp\winampa.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\Program Files\iTunes\iTunesHelper.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Palm\Hotsync.exe

  C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

  C:\Program Files\Common Files\Teleca Shared\Generic.exe

  C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.home.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\SiSUSBrg.exe

  O4 - HKLM\..\Run: Rundll32.exe SiSPower.dll,ModeAgent

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

  O4 - HKLM\..\Run: “C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe” WINDOWCALL

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Avira\AntiVir Desktop\avgnt.exe” /min

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: “C:\Program Files\Hyves Kwekker\HyvesDesktop_2.exe”

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: “C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” AcRdB7_0_7 -reboot 1 (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\DOCUME~1\maarten\APPLIC~1\OPTION~1\Link About.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\PROGRA~1\HYVESD~1\bin\HYVESD~1.EXE (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={5DD2FAC9-751C-4ca3-A589-364E7026811E}; SIMBAR=0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; .NET CLR 2.0.50727)” -“http://www.habbo.nl/client” (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1008\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘Jonne’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1009\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘Elke’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1009\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={5DD2FAC9-751C-4ca3-A589-364E7026811E}; SIMBAR=0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)” -“http://www.habbo.nl/client” (User ‘Elke’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - S-1-5-21-1343024091-1229272821-1177238915-1004 Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe (User ‘maarten’)

  O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra button: MyCom - {3E085E5E-40AF-4A93-B006-9F20BAE83AA3} - http://www.mycom.nl (file missing) (HKCU)

  O16 - DPF: {426784E5-24B2-4708-820D-117342FAD009} (Cimporter Object) - http://www.hyves.nl/cab/outlookaddressbook.cab

  O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyvz.com/statics/Aurigma/ImageUploader4.cab

  O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://84.30.136.78/activex/AxisCamControl.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {FACEE739-329B-4C23-9FCC-C85B0270CFDC} (Launcher Control) - http://www.smootsy.com/launcher.cab

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  –

  End of file - 11077 bytes

  Rapporteren
• 

  dientje

  24-03-2009 13:21

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 13:11:36, on 24-3-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16791)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Avira\AntiVir Desktop\sched.exe

  C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  C:\Program Files\iPod\bin\iPodService.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

  C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

  C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe

  C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

  C:\Program Files\Winamp\winampa.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\Program Files\iTunes\iTunesHelper.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Palm\Hotsync.exe

  C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

  C:\Program Files\Common Files\Teleca Shared\Generic.exe

  C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.home.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\SiSUSBrg.exe

  O4 - HKLM\..\Run: Rundll32.exe SiSPower.dll,ModeAgent

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

  O4 - HKLM\..\Run: “C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe” WINDOWCALL

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Avira\AntiVir Desktop\avgnt.exe” /min

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: “C:\Program Files\Hyves Kwekker\HyvesDesktop_2.exe”

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: “C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” AcRdB7_0_7 -reboot 1 (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\DOCUME~1\maarten\APPLIC~1\OPTION~1\Link About.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\PROGRA~1\HYVESD~1\bin\HYVESD~1.EXE (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={5DD2FAC9-751C-4ca3-A589-364E7026811E}; SIMBAR=0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; .NET CLR 2.0.50727)” -“http://www.habbo.nl/client” (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1008\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘Jonne’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1009\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘Elke’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1009\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={5DD2FAC9-751C-4ca3-A589-364E7026811E}; SIMBAR=0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)” -“http://www.habbo.nl/client” (User ‘Elke’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - S-1-5-21-1343024091-1229272821-1177238915-1004 Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe (User ‘maarten’)

  O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra button: MyCom - {3E085E5E-40AF-4A93-B006-9F20BAE83AA3} - http://www.mycom.nl (file missing) (HKCU)

  O16 - DPF: {426784E5-24B2-4708-820D-117342FAD009} (Cimporter Object) - http://www.hyves.nl/cab/outlookaddressbook.cab

  O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyvz.com/statics/Aurigma/ImageUploader4.cab

  O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://84.30.136.78/activex/AxisCamControl.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {FACEE739-329B-4C23-9FCC-C85B0270CFDC} (Launcher Control) - http://www.smootsy.com/launcher.cab

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  –

  End of file - 11077 bytes

  Rapporteren
• 

  dientje

  24-03-2009 13:26

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 13:11:36, on 24-3-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16791)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Avira\AntiVir Desktop\sched.exe

  C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  C:\Program Files\iPod\bin\iPodService.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

  C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

  C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe

  C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

  C:\Program Files\Winamp\winampa.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\Program Files\iTunes\iTunesHelper.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Palm\Hotsync.exe

  C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

  C:\Program Files\Common Files\Teleca Shared\Generic.exe

  C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.home.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\SiSUSBrg.exe

  O4 - HKLM\..\Run: Rundll32.exe SiSPower.dll,ModeAgent

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

  O4 - HKLM\..\Run: “C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 4.0 Suite\Ulead Quick-Drop 1.0\Quick-Drop.exe” WINDOWCALL

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Avira\AntiVir Desktop\avgnt.exe” /min

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: “C:\Program Files\Hyves Kwekker\HyvesDesktop_2.exe”

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: “C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” AcRdB7_0_7 -reboot 1 (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\DOCUME~1\maarten\APPLIC~1\OPTION~1\Link About.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\Run: C:\PROGRA~1\HYVESD~1\bin\HYVESD~1.EXE (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1004\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={5DD2FAC9-751C-4ca3-A589-364E7026811E}; SIMBAR=0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; .NET CLR 2.0.50727)” -“http://www.habbo.nl/client” (User ‘maarten’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1008\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘Jonne’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1009\..\Run: C:\WINDOWS\system32\ctfmon.exe (User ‘Elke’)

  O4 - HKUS\S-1-5-21-1343024091-1229272821-1177238915-1009\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~3.EXE -Update -1100465 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={5DD2FAC9-751C-4ca3-A589-364E7026811E}; SIMBAR=0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)” -“http://www.habbo.nl/client” (User ‘Elke’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - S-1-5-21-1343024091-1229272821-1177238915-1004 Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe (User ‘maarten’)

  O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra button: MyCom - {3E085E5E-40AF-4A93-B006-9F20BAE83AA3} - http://www.mycom.nl (file missing) (HKCU)

  O16 - DPF: {426784E5-24B2-4708-820D-117342FAD009} (Cimporter Object) - http://www.hyves.nl/cab/outlookaddressbook.cab

  O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyvz.com/statics/Aurigma/ImageUploader4.cab

  O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://84.30.136.78/activex/AxisCamControl.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {FACEE739-329B-4C23-9FCC-C85B0270CFDC} (Launcher Control) - http://www.smootsy.com/launcher.cab

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  –

  End of file - 11077 bytes

  Rapporteren