Archief - log check

x-freeZe · 11 apr 2008

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:53, on 11/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Azureus Installer\Azureus-Installer.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\AntiVir PersonalEdition Classic\avscan.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Hijack This\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.beyondgaming.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Pinnacle WebUpdater] "C:\Program Files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe" -s -f=UpdateVersion.xml -url=http://cdn.pinnaclesys.com/SupportFiles
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [GrpConv] grpconv -o
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PMCS] "C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"
O4 - HKCU\..\Run: [Azureus Installer] "C:\Program Files\Azureus Installer\Azureus-Installer.exe" hmw
O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_BE&c=Q306&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165138593296
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: Logical Disk Manager Administrative-service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: COM-service voor IMAPI cd-branders (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Delen van Extern bureaublad met NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Helpsessiebeheer voor Extern bureaublad (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe (file missing)
O23 - Service: Sentinel Keys Server (SentinelKeysServer) - SafeNet, Inc. - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Performance Logs and Alerts (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe (file missing)
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: Windows Media Player Network Sharing-service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O24 - Desktop Component 0: (no name) - https://www.beyondgaming.be/forums

--
End of file - 13276 bytes

Jurgenv1 · 11 apr 2008

Download Dr.Web CureIt en plaats het op je bureaublad: cureit.exe.

Dubbelklik op cureit.exe, en klik daarna op Start om het programma een snelle scan te laten uitvoeren.
Deze snelle scan zal de bestanden scannen die momenteel in het geheugen geladen zijn.
Wordt er wat gevonden, dan laat je CureIt dit repareren.
- Verschijnt er een venster met een aanbieding tot kopen met 50% korting, dan klik je deze weg met het kruisje.
Daarna zal het hoofdvenster zichtbaar worden.
- Kies bovenaan in het menu Optie voor Taal en wijzig deze naar Dutch (Nederlands), indien deze anders ingesteld staat.
- In het menu Opties kies je voor Instellingen veranderen (F9).
Op het tabblad "Scan" haal je het vinkje weg bij Heuristic Analyse.
Druk op Toepassen.
Op het tabblad "Bestandstypen" moet bij Scan mode geselecteerd zijn: Alle bestanden.
Op het tabblad "Acties" stel je het volgende in bij Malware:
-Adware: Verplaats
-Dialers: Verplaats
-Jokes: Rapportage
-Riskware: Rapportage
-Hacktools: Verplaats
Nog steeds op het tabblad "Acties" stel je het volgende in bij Objecten:
- Geïnfecteerde objecten: Repareer
- Onrepareerbare: Verplaats
- Verdachte objecten: Rapportage
Haal dan het vinkje weg bij: Prompt bij actie.
Druk op Toepassen.
Druk daarna op OK.
Terug in het hoofdvenster kan je selecteren welke scan je wil uitvoeren.
- Selecteer Volledige scan
Klik op de groene pijl aan de rechterkant om de scan te starten.
Indien de geïnfecteerde bestanden niet kunnen gedesinfecteerd worden, zullen deze verplaatst worden naar de map %userprofile%\DoctorWeb\Quarantine.
- Als de scan klaar is kies je in het menu voor Bestand voor Rapportagelijst opslaan en sla je de log op op je bureaublad.
- Sluit daarna Dr.Web Cureit.

Herstart je computer.
Dit moet je zeker uitvoeren, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen of verwijderen na een herstart.

Als de computer opnieuw gestart is, kopieer en plak je de inhoud van de log die je eerder hebt opgeslagen op je bureaublad, in je volgende post.
Post ook een nieuwe hijackthislog.

x-freeZe · 13 apr 2008

Ok, een hele boel is opgekuist precies. De file was te lang om hier te posten maar de A00.... . exe bestanden gaan nog door ( in totaal was het 1118 bestanden ). Allemaal gerepareerd.

Nu zit i nog met het volgende probleem: Telkens ik gewoon klik op een zwaar film bestand of kopie wil doen , loopt mijn pc heel eventjes vast en sluit hij het venster en verdwijnt het windowsbeeld even van men scherm tot het terug komt en alles weer normaal lijkt. Maar het bestand is niet geopend noch gekopieerd. Enig idee of dit door een virus of iets kan komen?
Laptop specs zijn redelijk goed: ( 2 gig ram, een geforce 8000 reeks, T5500 )

Code:

azureus-installer.exe	c:\program files\azureus installer	Waarschijnlijk DLOADER.Trojan	Niet repareerbaar.Naam gewijzigd.
mirc.chm\ctcp_events.htm	C:\Program Files\mIRC\mirc.chm	IRC.Generic.32	
mirc.chm	C:\Program Files\mIRC	Archief bevat geinfecteerde objecten	Verplaatst.
A0080269.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP389	Trojan.Starter.171	Gerepareerd.
A0080304.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP389	Trojan.Starter.171	Gerepareerd.
A0080419.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP389	Trojan.Starter.171	Gerepareerd.
A0086772.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086773.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086774.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086775.EXE	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086776.EXE	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086777.EXE	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086778.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086779.EXE	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086780.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086781.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086782.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086783.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086784.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086785.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086786.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086787.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086788.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086789.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086790.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086791.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086792.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086793.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086794.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086795.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086796.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086797.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086798.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086799.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086800.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086801.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086802.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086803.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086804.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086805.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086806.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086807.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086808.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086809.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086810.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086811.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086812.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086813.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086814.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086815.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086816.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086817.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086818.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086819.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086820.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086821.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086822.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086824.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086825.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086826.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086827.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086828.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086829.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086830.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086831.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086832.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086833.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086834.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086835.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086836.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086837.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086838.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086839.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086840.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086841.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086842.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086843.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086844.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086845.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086846.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086847.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086848.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086849.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086850.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086851.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086852.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086853.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086854.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086855.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086856.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086857.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086858.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086859.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086860.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086861.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086862.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086863.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086864.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086865.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086866.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086867.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086868.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086869.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086870.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086871.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086872.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086873.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086874.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086875.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086876.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086877.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086878.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086879.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086880.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086881.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086882.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086883.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086884.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086885.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086886.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086887.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086888.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086889.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086890.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086891.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086892.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086893.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086894.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086895.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086896.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086897.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086898.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086899.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086900.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086901.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086902.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086903.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086904.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086905.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086906.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086907.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086908.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086909.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086910.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086911.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086912.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086913.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086914.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086915.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086916.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086917.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086918.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.
A0086920.exe	C:\System Volume Information\_restore{313D570C-5245-44EC-915E-9AFD800B3602}\RP395	Trojan.Starter.171	Gerepareerd.

x-freeZe · 13 apr 2008

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:47:41, on 13/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijack This\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.beyondgaming.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Pinnacle WebUpdater] "C:\Program Files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe" -s -f=UpdateVersion.xml -url=http://cdn.pinnaclesys.com/SupportFiles
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PMCS] "C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"
O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_BE&c=Q306&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165138593296
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: Logical Disk Manager Administrative-service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: COM-service voor IMAPI cd-branders (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Delen van Extern bureaublad met NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Helpsessiebeheer voor Extern bureaublad (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe (file missing)
O23 - Service: Sentinel Keys Server (SentinelKeysServer) - SafeNet, Inc. - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Performance Logs and Alerts (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe (file missing)
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: Windows Media Player Network Sharing-service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O24 - Desktop Component 0: (no name) - https://www.beyondgaming.be/forums

--
End of file - 12981 bytes

Jurgenv1 · 13 apr 2008

* Download en bewaar SDFix
op je bureaublad.

Dubbelklik op SDFix.exe en kies voor Install om het tooltje uit te pakken in een eigen map op je bureaubad. Herstart dan je pc in Veilige modus

In veilige modus, open de SDFix map op je bureaublad en dubbelklik op RunThis.bat om het tooltje te starten.
Typ Y om het clean proces te starten.
het verwijdert alle Trojan Services of Registry Entries die met deze infectie te maken hebben, als het tooltje klaar is zal het jou vertellen om eender welke toets te drukken om je pc te herstarten, doe dit ook.
Wanneer de pc herstart zal het tooltje opnieuw runnen en het opruimproces beëindigen en je de melding Finished tonen, druk dan op eender welke toets om het scriptje te beëindigen en je bureaublad zullen tevoorschijn komen.
Wanneer je bureaublad icoontjes verschijnen zal het rapportje van SDFix openen en ook in de map bewaren onder de naam Report.txt.
Kopieer en plak nu de inhoud van dat rapportje hier met een nieuw hijackthis logje.

x-freeZe · 13 apr 2008

Heb de stapjes mooi gevolgd, maar bij het opstarten van het programma ( met windows in veilige modus ) kon ik in het dos schermpje veel errors zien ( zoals, bestand niet gevonden 12 x ). Uiteindelijk verdween het dos schermpje en zag ik enkel de zwarte achtergrond van de veilige modus. Heb de pc 15 min zo laten staan maar er kwam nieks tevoorschijn. Pc dan maar herstart en toen ik naar gewone modus terug keerde begon hij na mij in te logen verder te scannen. Dit dan het rapportje :

Rebooting

Checking Files :

No Trojan Files Found

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1351.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-13 17:56:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:eb88bc7a
"s1"=dword:4ac95057
"s2"=dword:746a4947
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:63,0e,99,a1,7a,1a,78,3e,ed,2d,77,66,22,36,3b,31,0a,10,bb,e5,fa,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,e2,f8,32,87,4b,75,cb,62,e6,e3,4d,2e,42,27,96,8c,54,..
"khjeh"=hex:ef,36,f0,8f,b0,1f,13,ba,c1,ba,f5,16,7b,e4,22,19,98,f5,56,5e,c2,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ac,17,8d,a6,cd,09,b4,27,bf,21,86,e2,0b,8a,51,81,ef,92,b8,02,1a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:63,0e,99,a1,7a,1a,78,3e,ed,2d,77,66,22,36,3b,31,0a,10,bb,e5,fa,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,e2,f8,32,87,4b,75,cb,62,e6,e3,4d,2e,42,27,96,8c,54,..
"khjeh"=hex:ef,36,f0,8f,b0,1f,13,ba,c1,ba,f5,16,7b,e4,22,19,98,f5,56,5e,c2,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ac,17,8d,a6,cd,09,b4,27,bf,21,86,e2,0b,8a,51,81,ef,92,b8,02,1a,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 174

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"
"C:\\Program Files\\VoipBuster.com\\VoipBuster\\VoipBuster.exe"="C:\\Program Files\\VoipBuster.com\\VoipBuster\\VoipBuster.exe:*:Enabled:VoipBuster"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled

kype"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe:LocalSubNet

isabled

MCService"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"

x-freeZe · 13 apr 2008

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:22:56, on 13/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijack This\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.beyondgaming.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Pinnacle WebUpdater] "C:\Program Files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe" -s -f=UpdateVersion.xml -url=http://cdn.pinnaclesys.com/SupportFiles
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PMCS] "C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"
O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_BE&c=Q306&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165138593296
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: Logical Disk Manager Administrative-service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: COM-service voor IMAPI cd-branders (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Delen van Extern bureaublad met NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Helpsessiebeheer voor Extern bureaublad (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe (file missing)
O23 - Service: Sentinel Keys Server (SentinelKeysServer) - SafeNet, Inc. - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Performance Logs and Alerts (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe (file missing)
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: Windows Media Player Network Sharing-service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O24 - Desktop Component 0: (no name) - https://www.beyondgaming.be/forums

--
End of file - 13047 bytes

Jurgenv1 · 14 apr 2008

Ziet er goed uit, zijn er nog problemen?

Archief - log check

x-freeZe

Legacy Member

Jurgenv1

Legacy Member

x-freeZe

Legacy Member

x-freeZe

Legacy Member

Jurgenv1

Legacy Member

x-freeZe

Legacy Member

x-freeZe

Legacy Member

Jurgenv1

Legacy Member