Spyware

• 

  senior

  03-08-2009 23:37

  Gepost door: Jos H ()

  Datum: 03 augustus 2009 16:26

  Mogelijk besmet met spyware.

  Ga naar de buren na uitvoeren van het volgende.

  Ik hoop dat ik het goed hebt gedaan.

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 23:26:15, on 3-8-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16876)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\AskBarDis\bar\bin\AskService.exe

  C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe

  C:\Program Files\Intel\AMT\atchk.exe

  C:\Program Files\Intel\AMT\atchksrv.exe

  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

  C:\WINDOWS\system32\inetsrv\inetinfo.exe

  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\WINDOWS\system32\RUNDLL32.EXE

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\Program Files\UPC\bin\sprtcmd.exe

  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\Logitech\iTouch\iTouch.exe

  C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe

  C:\Program Files\Intel\AMT\LMS.exe

  C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\system32\RunDll32.exe

  C:\WINDOWS\system32\nvsvc32.exe

  C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\PDF Complete\pdfsvc.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Intel\AMT\UNS.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\Logitech\SetPoint\SetPoint.exe

  C:\WINDOWS\system32\SearchIndexer.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

  C:\WINDOWS\system32\wuauclt.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  C:\WINDOWS\system32\SearchProtocolHost.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.knuz.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

  O2 - BHO: PrimoAdsForYou - {D35DA2A5-1D09-03BB-FE6E-C569BE05CFA0} - C:\Program Files\PrimoAdsForYou\PrimoAdsForYou.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

  O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxtray.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\hkcmd.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxpers.exe

  O4 - HKLM\..\Run: “C:\Program Files\Intel\AMT\atchk.exe”

  O4 - HKLM\..\Run: C:\Program Files\PDF Complete\pdfsty.exe

  O4 - HKLM\..\Run: C:\Program Files\Compaq\SetRefresh\SetRefresh.exe

  O4 - HKLM\..\Run: “C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe” /hide /waitservice

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: nwiz.exe /install

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: C:\PROGRA~1\Pinnacle\PPE\PPE.EXE

  O4 - HKLM\..\Run: “C:\Program Files\UPC\bin\sprtcmd.exe” /P UPC

  O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

  O4 - HKLM\..\Run: F:\Setup.exe \RESET

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: C:\Program Files\Logitech\iTouch\iTouch.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe”

  O4 - HKLM\..\Run: RunDll32 CMICNFG3.cpl,CMICtrlWnd

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” /tray

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

  O8 - Extra context menu item: Upload to photobucket - res://c:\\progra~1\\AskBarDis\\bar\\bin\\askBar.dll/pbContextMenu.html

  O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

  O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

  O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe

  O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe

  O23 - Service: Intel(R) Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe

  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

  O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: Intel(R) Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe

  O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

  O23 - Service: Intel(R) Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe

  –

  End of file - 10825 bytes

  Rapporteren
• 

  Huib

  03-08-2009 23:58

  Hoi Senior,

  Verwijder het programma AskBarDis. Dit kun je doen het configuratiescherm te openen en daar het item Software te openen. Zoek de regel op in de lijst, klik hem aan en klik vervolgens op ‘verwijderen’.

  Voer nu alle stappen van de volgende link uit en plaats daarna de 2 gevraagde logjes:

  http://antivirus.startpagina.nl/prikbord/4625317/voer-dit-eerst-uit-voordat-je-de-logjes-plaatst!!#msg-4625317

  Succes,

  Huib:)

  

  Rapporteren
• 

  senior

  04-08-2009 10:03

  Nw list.

  Op dit moment geen last van spyware.

  Grv Eric een senior van 74jr.

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 9:58:31, on 4-8-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16876)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Intel\AMT\atchk.exe

  C:\Program Files\Intel\AMT\atchksrv.exe

  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

  C:\WINDOWS\system32\RUNDLL32.EXE

  C:\WINDOWS\system32\inetsrv\inetinfo.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\Program Files\UPC\bin\sprtcmd.exe

  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

  C:\Program Files\Intel\AMT\LMS.exe

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\Program Files\Logitech\iTouch\iTouch.exe

  C:\WINDOWS\system32\nvsvc32.exe

  C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe

  C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe

  C:\WINDOWS\system32\RunDll32.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\PDF Complete\pdfsvc.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Logitech\SetPoint\SetPoint.exe

  C:\Program Files\Intel\AMT\UNS.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\WINDOWS\system32\SearchIndexer.exe

  C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

  C:\Program Files\Outlook Express\msimn.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.knuz.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: (no name) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)

  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

  O2 - BHO: PrimoAdsForYou - {D35DA2A5-1D09-03BB-FE6E-C569BE05CFA0} - C:\Program Files\PrimoAdsForYou\PrimoAdsForYou.dll (file missing)

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

  O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxtray.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\hkcmd.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxpers.exe

  O4 - HKLM\..\Run: “C:\Program Files\Intel\AMT\atchk.exe”

  O4 - HKLM\..\Run: C:\Program Files\PDF Complete\pdfsty.exe

  O4 - HKLM\..\Run: C:\Program Files\Compaq\SetRefresh\SetRefresh.exe

  O4 - HKLM\..\Run: “C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe” /hide /waitservice

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: nwiz.exe /install

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: C:\PROGRA~1\Pinnacle\PPE\PPE.EXE

  O4 - HKLM\..\Run: “C:\Program Files\UPC\bin\sprtcmd.exe” /P UPC

  O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

  O4 - HKLM\..\Run: F:\Setup.exe \RESET

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: C:\Program Files\Logitech\iTouch\iTouch.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe”

  O4 - HKLM\..\Run: RunDll32 CMICNFG3.cpl,CMICtrlWnd

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” /tray

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

  O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

  O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

  O23 - Service: Intel(R) Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe

  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

  O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: Intel(R) Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe

  O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

  O23 - Service: Intel(R) Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe

  –

  End of file - 10308 bytes

  Rapporteren
• 

  Huib

  04-08-2009 10:51

  Hoi Eric,

  Verwijder Spybot van je computer omdat teatimer, een onderdeel van spybot de fix in de weg kan zitten.

  Deze kun je na de fix weer installeren;)

  Start HijackThis en Klik op :Do a Systemscan only

  Zet nu een vinkje bij de volgende regels:

  O2 - BHO: PrimoAdsForYou - {D35DA2A5-1D09-03BB-FE6E-C569BE05CFA0} - C:\Program Files\PrimoAdsForYou\PrimoAdsForYou.dll (file missing)

  O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)

  Sluit alle vensters, behalve die van HijackThis en klik op Fix checked.

  Download start up lite:

  http://www.malwarebytes.org/StartUpLite.exe

  StartUpLite geeft alle onnodige programma's aan, die worden opgestart met Windows.

  De keuze is aan jouw welke je wel nodig vindt om op te starten met je Windows (kies in dat geval “No action”).

  Via Start Programma's kan je ze altijd handmatig laten opstarten. Letop snelkoppelingen op het bureaublad leiden ook tot vertraging.

  Gebruik in StartUpLite niet de optie “Remove” !!!

  Dan wordt het uit het register verwijderd en veranderingen kunnen dan niet meer ongedaan worden gemaakt.

  Selecteer alleen de “Remove” optie indien je zeker bent dat je in de toekomst dit programma nooit meer wilt laten opstarten met Windows!!

  Plaats na het uitvoeren van dit alles nog even een nieuw HijackThis logje.

  Succes,

  Huib:)

  

  Rapporteren
• 

  senior

  04-08-2009 11:08

  Hallo Huib.

  Ik hoop dat dit goed is gedaan door mij, tot op heden is het me allemaal duidelijk.

  Grv Eric.

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 11:05:08, on 4-8-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16876)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Intel\AMT\atchk.exe

  C:\Program Files\Intel\AMT\atchksrv.exe

  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

  C:\WINDOWS\system32\RUNDLL32.EXE

  C:\WINDOWS\system32\inetsrv\inetinfo.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\Program Files\UPC\bin\sprtcmd.exe

  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

  C:\Program Files\Intel\AMT\LMS.exe

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\Program Files\Logitech\iTouch\iTouch.exe

  C:\WINDOWS\system32\nvsvc32.exe

  C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe

  C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe

  C:\WINDOWS\system32\RunDll32.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\PDF Complete\pdfsvc.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Logitech\SetPoint\SetPoint.exe

  C:\Program Files\Intel\AMT\UNS.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\WINDOWS\system32\SearchIndexer.exe

  C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.knuz.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: (no name) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)

  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

  O4 - HKLM\..\Run: “C:\Program Files\Intel\AMT\atchk.exe”

  O4 - HKLM\..\Run: C:\Program Files\PDF Complete\pdfsty.exe

  O4 - HKLM\..\Run: C:\Program Files\Compaq\SetRefresh\SetRefresh.exe

  O4 - HKLM\..\Run: “C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe” /hide /waitservice

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

  O4 - HKLM\..\Run: C:\PROGRA~1\Pinnacle\PPE\PPE.EXE

  O4 - HKLM\..\Run: “C:\Program Files\UPC\bin\sprtcmd.exe” /P UPC

  O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

  O4 - HKLM\..\Run: F:\Setup.exe \RESET

  O4 - HKLM\..\Run: C:\Program Files\Logitech\iTouch\iTouch.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe”

  O4 - HKLM\..\Run: RunDll32 CMICNFG3.cpl,CMICtrlWnd

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” /tray

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

  O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

  O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

  O23 - Service: Intel(R) Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe

  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

  O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: Intel(R) Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe

  O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

  O23 - Service: Intel(R) Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe

  –

  End of file - 8880 bytes

  Rapporteren
• 

  Huib

  04-08-2009 11:22

  Hoi Eric,

  Ik heb nog 1 regel over het hoofd gezien:?

  Start nogmaals HijackThis en Klik op :Do a Systemscan only

  Vink de volgende regel nog aan en klik daarna op fix checked:

  O2 - BHO: (no name) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)

  Deze was n.l. ook nog van die Askbar;)

  Graag zou ik nog een logje van MBAM willen zien.

  Zie punt 7 uit de volgende link:

  http://antivirus.startpagina.nl/prikbord/4625317/voer-dit-eerst-uit-voordat-je-de-logjes-plaatst!!#msg-4625317

  Succes,

  Huib:)

  

  Rapporteren
• 

  senior

  04-08-2009 11:57

  Hallo Huib.

  Dit proggie moet je kopen en ik heb alleen maar a.o.w.

  Rapporteren
• 

  Huib

  04-08-2009 12:17

  HahaX(

  Alles wat wij hier aangeven is gratis Eric;)

  Groetjes Huib:)

  

  Rapporteren
• 

  Argus

  04-08-2009 12:46

  Dit proggie moet je kopen

  Dit proggie kan je kopen voor maar €24 en dan je leven lang gratis updates WOW

  Rapporteren
• 

  senior

  04-08-2009 12:56

  1 Het is gelukt.

  2 AOW= 970 € info voor Argus.

  Hierbij de lijst MBAM

  Malwarebytes' Anti-Malware 1.40

  Database versie: 2557

  Windows 5.1.2600 Service Pack 3

  4-8-2009 12:51:01

  mbam-log-2009-08-04 (12-48-37).txt

  Scan type: Volledige Scan (C:\|D:\|)

  Objecten gescand: 215796

  Verstreken tijd: 27 minute(s), 29 second(s)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 3

  Registerwaarden geïnfecteerd: 0

  Registerdata bestanden geïnfecteerd: 1

  Mappen geïnfecteerd: 12

  Bestanden geïnfecteerd: 21

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registersleutels geïnfecteerd:

  HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> No action taken.

  HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PlayMP3Z) -> No action taken.

  HKEY_CLASSES_ROOT\AppID\{418d86be-7386-4f1a-83e0-53604adbda74} (Trojan.BHO) -> No action taken.

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registerdata bestanden geïnfecteerd:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

  Mappen geïnfecteerd:

  C:\Documents and Settings\Administrator\Menu Start\Programma's\PlayMP3z (Adware.PlayMP3Z) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\keys (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\dbases (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\temp (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Menu Start\Programma's\Privacy components (Rogue.PrivacyComponents) -> No action taken.

  C:\Program Files\Privacy components\faq (Rogue.Privacycomponents) -> No action taken.

  C:\Program Files\Privacy components (Rogue.Privacycomponents) -> No action taken.

  C:\Program Files\Privacy components\tools (Rogue.Privacycomponents) -> No action taken.

  C:\Program Files\Privacy components\sounds (Rogue.Privacycomponents) -> No action taken.

  C:\Program Files\Privacy components\tools\sp (Rogue.Privacycomponents) -> No action taken.

  C:\Program Files\Privacy components\tools\sc (Rogue.Privacycomponents) -> No action taken.

  Bestanden geïnfecteerd:

  C:\Documents and Settings\Administrator\Menu Start\Programma's\PlayMP3z\Run PlayMP3z.pif (Adware.PlayMP3Z) -> No action taken.

  C:\System Volume Information\_restore{03FC1E3F-6BED-4081-9D0A-983C1DFF58B7}\RP518\A0078740.exe (Adware.PlayMP3z) -> No action taken.

  C:\System Volume Information\_restore{03FC1E3F-6BED-4081-9D0A-983C1DFF58B7}\RP518\A0078615.exe (Adware.PlayMP3z) -> No action taken.

  C:\System Volume Information\_restore{03FC1E3F-6BED-4081-9D0A-983C1DFF58B7}\RP512\A0078090.exe (Adware.PlayMP3z) -> No action taken.

  D:\Download\RegistryHelperSetup.exe (Rogue.Installer) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\dbases\sm.dat (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\dbases\rd.dat (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\dbases\sc.dat (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\keys\rd.key (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\dbases\sp.dat (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\keys\cg.key (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\keys\sc.key (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\keys\sp.key (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\dbases\cg.dat (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\dbases\mw.dat (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\temp\mwactive (Rogue.PrivacyComponents) -> No action taken.

  C:\Documents and Settings\Administrator\Application Data\Privacy components\temp\spfilter (Rogue.PrivacyComponents) -> No action taken.

  C:\Program Files\Privacy components\faq\guide.html (Rogue.Privacycomponents) -> No action taken.

  C:\Program Files\Privacy components\sounds\3.mp3 (Rogue.Privacycomponents) -> No action taken.

  C:\Program Files\Privacy components\sounds\1.mp3 (Rogue.Privacycomponents) -> No action taken.

  C:\Program Files\Privacy components\tools\sc\ca.crt (Rogue.Privacycomponents) -> No action taken.

  Rapporteren