Archief - check log please

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
h

humpty hump

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 0:49:57, on 12/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\j6221932.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Security Tools\iesmn.exe
C:\Program Files\Security Tools\imsmain.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Security Tools\iesmin.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\outlook\outlook.exe
C:\Program Files\Security Tools\imsmn.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Wim\My Documents\Hjtl\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Security Tools\iesbpl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\pjjerpdw.dll",realset
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000137.exe 61A847B5BBF72813329B385771FE01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j6221932.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
h

humpty hump

Legacy Member
ComboFix 07-06-13 - C:\Documents and Settings\Wim\Desktop\ComboFix.exe
"Wim" - 2007-06-12 23:08:03 - Service Pack 2 NTFS


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\awtqo.dll
C:\WINDOWS\system32\kfrkrtcn.dll
C:\WINDOWS\system32\orbbidfv.dll
C:\WINDOWS\system32\phdcoxko.dll
C:\WINDOWS\system32\pjjerpdw.dll
C:\WINDOWS\system32\pndnujsm.dll
C:\WINDOWS\system32\svvopmej.dll
C:\WINDOWS\system32\tnwvueee.dll
C:\WINDOWS\system32\virdspgj.dll
C:\WINDOWS\system32\vvvgyfwu.dll
C:\WINDOWS\system32\yadpokpm.dll
C:\WINDOWS\system32\oqtwa.ini
C:\WINDOWS\system32\okxocdhp.ini
C:\WINDOWS\system32\wdprejjp.ini
C:\WINDOWS\system32\knnmp.bak1
C:\WINDOWS\system32\knnmp.bak2
C:\WINDOWS\system32\knnmp.ini
C:\WINDOWS\system32\knnmp.bak1
C:\WINDOWS\system32\knnmp.bak2
C:\WINDOWS\system32\knnmp.ini
C:\WINDOWS\system32\pmnnk.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\outlook
C:\WINDOWS\b.exe
C:\WINDOWS\wr.txt


((((((((((((((((((((((((( Files Created from 2007-05-12 to 2007-06-12 )))))))))))))))))))))))))))))))


2007-06-12 23:07 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-12 01:56 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-06-12 01:56 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-06-12 01:40 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-06-12 00:58 <DIR> d-------- C:\WINDOWS\pss
2007-06-12 00:52 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-12 00:36 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-06-12 00:36 <DIR> d-------- C:\Program Files\SpyCrush 3.2
2007-06-12 00:35 43,018 --a------ C:\WINDOWS\system32\lafC.dll
2007-06-11 16:21 8,192 --a------ C:\WINDOWS\system32\j6221932.exe
2007-06-11 16:21 13,844 --a------ C:\WINDOWS\system32\qymoufcs.exe
2007-06-11 00:36 <DIR> d-------- C:\Program Files\QuickTime
2007-06-10 23:33 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-06-10 15:54 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2007-06-10 15:54 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2007-06-10 15:53 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-06-10 15:53 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-06-10 15:14 <DIR> d-------- C:\Program Files\Playlogic
2007-06-10 14:13 <DIR> d-------- C:\Program Files\Lavasoft
2007-06-10 14:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-10 14:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-10 14:06 <DIR> d-------- C:\Program Files\Electronic Arts
2007-06-10 14:04 167 --a------ C:\DOCUME~1\Wim\8552.bat
2007-06-10 13:26 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-06-10 13:26 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2007-06-10 13:26 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-06-10 13:26 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-06-10 13:26 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-06-10 13:26 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-06-10 13:26 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-06-10 13:26 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2007-06-10 13:26 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2007-06-10 13:26 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2007-06-10 13:26 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-06-10 13:26 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-06-10 13:26 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2007-06-10 13:26 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-06-10 13:24 <DIR> d-------- C:\Program Files\Codemasters
2007-06-10 13:22 <DIR> d---s---- C:\DOCUME~1\Wim\UserData
2007-06-10 13:22 <DIR> d-------- C:\Program Files\CCleaner
2007-06-10 13:21 73 --a------ C:\WINDOWS\system32\n.bat
2007-06-10 13:21 167 --a------ C:\WINDOWS\system32\6696.bat
2007-06-10 13:20 86,016 --a------ C:\WINDOWS\system32\ps.exe
2007-06-10 13:20 38,925 --a------ C:\WINDOWS\system32\app.exe
2007-06-10 13:20 32,768 --a------ C:\WINDOWS\system32\setup9x.exe
2007-06-10 13:20 10,326 --a------ C:\WINDOWS\system32\install.exe
2007-06-10 13:20 1,097 --a------ C:\WINDOWS\system32\x.dat
2007-06-10 13:15 <DIR> d-------- C:\DOCUME~1\Wim\Shared
2007-06-10 13:15 <DIR> d-------- C:\DOCUME~1\Wim\Incomplete
2007-06-10 13:15 <DIR> d-------- C:\DOCUME~1\Wim\APPLIC~1\LimeWire
2007-06-09 19:01 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-06-09 19:01 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-06-09 19:00 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2007-06-09 19:00 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-06-09 19:00 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-06-09 19:00 <DIR> d---s---- C:\Program Files\Xfire
2007-06-09 19:00 <DIR> d-------- C:\DOCUME~1\Wim\APPLIC~1\Xfire
2007-06-09 18:59 9,008 --a------ C:\WINDOWS\system\VER.DLL
2007-06-09 18:59 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-06-09 18:59 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-06-09 18:59 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2007-06-09 18:59 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2007-06-09 18:59 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-06-09 18:59 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-06-09 18:59 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-06-09 18:59 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-06-09 18:59 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-06-09 18:59 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-06-09 18:59 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-06-09 18:59 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-06-09 18:59 5,120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-06-09 18:59 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-06-09 18:59 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-06-09 18:59 19,200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-06-09 18:59 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-06-09 18:59 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-06-09 18:59 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-06-09 18:59 <DIR> dr------- C:\Program Files
2007-06-09 18:59 <DIR> d--hs---- C:\WINDOWS\Installer
2007-06-09 18:59 <DIR> d-------- C:\Program Files\Common Files\SpeechEngines
2007-06-09 18:59 <DIR> d-------- C:\Program Files\Common Files\ODBC


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-20 04:05:00 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-04-20 04:05:00 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-04-20 04:05:00 8,429,568 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-04-20 04:05:00 745,472 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-04-20 04:05:00 6,739,168 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-04-20 04:05:00 6,668,288 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-04-20 04:05:00 6,217,728 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-04-20 04:05:00 5,439,488 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-04-20 04:05:00 5,434,880 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-04-20 04:05:00 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-04-20 04:05:00 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-04-20 04:05:00 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-04-20 04:05:00 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-04-20 04:05:00 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-04-20 04:05:00 37,888 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-04-20 04:05:00 37,888 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-04-20 04:05:00 344,064 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-04-20 04:05:00 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-04-20 04:05:00 3,645,440 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-04-20 04:05:00 3,538,944 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-04-20 04:05:00 3,289,088 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-04-20 04:05:00 3,235,840 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-04-20 04:05:00 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-20 04:05:00 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-04-20 04:05:00 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
2007-04-20 04:05:00 2,387,968 ----a-w C:\WINDOWS\system32\nvwssr.dll
2007-04-20 04:05:00 2,273,280 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-04-20 04:05:00 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-04-20 04:05:00 163,908 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-04-20 04:05:00 143,360 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-04-20 04:05:00 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-20 04:05:00 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-04-20 04:05:00 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
2007-04-20 04:05:00 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-04-20 04:05:00 1,101,824 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-04-20 04:05:00 1,073,152 ----a-w C:\WINDOWS\system32\nvcpluir.dll
2007-04-20 04:05:00 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
2007-04-20 04:05:00 1,018,748 ----a-w C:\WINDOWS\system32\nvucode.bin
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-13 13:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 03:25]
{8F2183B9-F4DB-4913-8F82-6F9CC42E4CF8}=C:\WINDOWS\system32\lafC.dll [2007-06-12 00:35]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-05-30 14:30]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-18 08:22]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-05-18 14:26]
"nwiz"="nwiz.exe" [2007-04-20 06:05 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-11 00:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:07]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=0 (0x0)
"NoColorChoice"=0 (0x0)
"NoSizeChoice"=0 (0x0)
"NoDispBackgroundPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)
"NoDispCPL"=0 (0x0)
"NoVisualStyleChoice"=0 (0x0)
"NoDispSettingsPage"=0 (0x0)
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktopChanges"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSaveSettings"=0 (0x0)
"NoThemesTab"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9ff419a8-1748-4ca7-99df-d269465b0e8b}"="C:\WINDOWS\system32\iauoi.dll" [2007-06-12 00:35]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 14:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljklli]
mljklli.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-12 23:10:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-12 23:11:02 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-12 23:11

--- E O F ---
h

humpty hump

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 23:15:01, on 12/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\j6221932.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Wim\My Documents\Hjtl\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8F2183B9-F4DB-4913-8F82-6F9CC42E4CF8} - C:\WINDOWS\system32\lafC.dll
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Security Tools\iesbpl.dll (file missing)
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: mljklli - mljklli.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j6221932.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
J

Jurgenv1

Legacy Member
* Open hijackthis en vink volgende regels aan:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8F2183B9-F4DB-4913-8F82-6F9CC42E4CF8} - C:\WINDOWS\system32\lafC.dll
O3 - Toolbar: Protection Bar - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - C:\Program Files\Security Tools\iesbpl.dll (file missing)
O20 - Winlogon Notify: mljklli - mljklli.dll (file missing)

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Je Java software is verouderd.
Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.
Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

Download Java Runtime Environment (JRE) 6u1.
  • Scroll omlaag naar : "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Klik op de "Download" knop aan de rechterkant.
  • Vink aan: "Accept License Agreement".
  • De pagina zal herladen.
  • Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen, en bewaar het naar je Bureaublad.
  • Sluit alle programma's die eventueel open zijn - Zeker je web browser!
  • Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.
  • Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
  • Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
  • Herhaal dit tot alle oudere versies verdwenen zijn.
  • Na het verwijderen van alle oudere versies, herstart je pc.
  • Dubbelklik vervolgens op jre-6u1-windows-i586-p.exe op je Bureaublad om de nieuwste versie van Java te installeren.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Herstart dan je pc en vertel hoe alles verder werkt.
h

humpty hump

Legacy Member
der staat nog altijd iets van spyware zo waar men klok en msn staat
h

humpty hump

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 13:15:58, on 13/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\j6221932.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Wim\My Documents\Hjtl\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j6221932.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
J

Jurgenv1

Legacy Member
* Open een kladblokbestand.
Kopieer onderstaande (tussen de streepjes) in dit kladblokbestand.

Code: 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{9ff419a8-1748-4ca7-99df-d269465b0e8b}"=-

Ga naar Bestand - Opslaan als.
Bij "Opslaan in" kies je: Bureaublad
Bij "Bestandsnaam" zet je: fix.reg
Bij "Opslaan als type" selecteer je: Alle bestanden (*.*).
Klik op de knop Opslaan.
Dubbelklik op de fix.reg file en laat de wijzigingen aan het register toevoegen.

* Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

C:\Program Files\SpyCrush 3.2
C:\WINDOWS\system32\lafC.dll
C:\WINDOWS\system32\j6221932.exe
C:\WINDOWS\system32\qymoufcs.exe
C:\WINDOWS\system32\iauoi.dll

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje.
h

humpty hump

Legacy Member
C:\Program Files\SpyCrush 3.2 moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\lafC.dll
C:\WINDOWS\system32\lafC.dll NOT unregistered.
C:\WINDOWS\system32\lafC.dll moved successfully.
C:\WINDOWS\system32\j6221932.exe moved successfully.
C:\WINDOWS\system32\qymoufcs.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\iauoi.dll
C:\WINDOWS\system32\iauoi.dll NOT unregistered.
C:\WINDOWS\system32\iauoi.dll moved successfully.

Created on 06/13/2007 22:42:25
h

humpty hump

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 22:44:34, on 13/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\j6221932.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Wim\Desktop\OTMoveIt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Wim\My Documents\Hjtl\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j6221932.exe (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan