Archief - HijackThis check ff

Logfile of HijackThis v1.99.0
Scan saved at 15:15:29, on 31/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Rainlendar\Rainlendar.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Soulseek\slsk.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Winamp\Winamp.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Documents and Settings\Bjorn\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cffhiwxofxbfxwsdofgj.com...5djP596RjYYiKsRq4iLIzDzsKX7KAV11p8AtY/Sn.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lmzpvchjdrvucaav.com/UZZPa9ONg6ssZo7ljAdVzxUdlqdsc8OEUu8_nZ03384.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {3E062B62-0631-743C-655A-4AA0DF600640} - C:\DOCUME~1\Bjorn\APPLIC~1\CORNAU~1\StartMpeg.exe
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Media Program Balm Bait] C:\Documents and Settings\All Users\Application Data\surfclosemediaprogram\01 mix.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Scr media] C:\DOCUME~1\Bjorn\APPLIC~1\CREATI~1\LOUDHTM.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee SpamKiller Server - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Rainlendar\Rainlendar.exe
-> gekend? Anders deleten

c:\progra~1\intern~1\iexplore.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cffhiwxofxbfxwsdofgj.com...11p8AtY/Sn.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lmzpvchjdrvucaav.com/UZZ...Uu8_nZ03384.htm
O2 - BHO: (no name) - {3E062B62-0631-743C-655A-4AA0DF600640} - C:\DOCUME~1\Bjorn\APPLIC~1\CORNAU~1\StartMpeg.exe

O4 - HKLM\..\Run: [Media Program Balm Bait] C:\Documents and Settings\All Users\Application Data\surfclosemediaprogram\01 mix.exe
--> dit programma ken ik niet....

O4 - HKCU\..\Run: [Scr media] C:\DOCUME~1\Bjorn\APPLIC~1\CREATI~1\LOUDHTM.exe


Wacht ook op een check van stephen of exit

C:\Program Files\Rainlendar\Rainlendar.exe
heb je normaal zelf geïnstalleerd.
c:\progra~1\intern~1\iexplore.exe is gewoon internet explorer.
O4 - HKLM\..\Run: [Media Program Balm Bait] C:\Documents and Settings\All Users\Application Data\surfclosemediaprogram\01 mix.exe
spyware, mag weg
Verder alles van raintjah`.