Archief - Log na virus

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
d

decarlo

Legacy Member
Ik heb een paar viruskes gehad en heb ze der afgekregen met AVG.
Toch lijkt het mij raadzaam om al de overige brol ook eens te laten nakijken, vandaar dit logje.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:50:58, on 30/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\CPdeSrvU.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] -RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] -nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] -RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] -SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LHRO Agent] -C:\WINDOWS\system32\Sys32\LHRO.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NWEReboot] -
O4 - HKLM\..\Run: [NeroFilterCheck] -C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] -C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\RunServices: [Windows Service Agent] spools.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] -"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobiele favorieten maken... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - -"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (file missing)
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - -"C:\Program Files\Eset\nod32krn.exe" (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (file missing)
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: Messenger USN Journal Reader service voor Gedeelde mappen (usnjsvc) - Unknown owner - -"C:\Program Files\MSN Messenger\usnsvc.exe" (file missing)
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe

--
End of file - 9366 bytes


Dank bij voorbaat. :)
J

Jurgenv1

Legacy Member
* Download en bewaar SDFix
op je bureaublad.

Dubbelklik op SDFix.exe en kies voor Install om het tooltje uit te pakken in een eigen map op je bureaubad. Herstart dan je pc in Veilige modus

  • In veilige modus, open de SDFix map op je bureaublad en dubbelklik op RunThis.bat om het tooltje te starten.
  • Typ Y om het clean proces te starten.
  • het verwijderd alle Trojan Services of Registry Entries die met deze infectie te maken hebben, als het tooltje klaar is zal het jou vertellen om eender welke toets te drukken om je pc te herstarten, doe dit ook.
  • Wanneer de pc herstart zal het tooltje opnieuw runnen en het opruimproces beëindigen en je de melding Finished tonen, druk dan op eender welke toets om het scriptje te beëindigen en je bureaublad zullen tevoorschijn komen.
  • Wanneer je bureaublad icoontjes verschijnen zal het rapportje van SDFix openen en ook in de map bewaren onder de naam Report.txt.
  • Kopieer en plak nu de inhoud van dat rapportje hier met een nieuw hijackthis logje.
d

decarlo

Legacy Member
SDFix: Version 1.107

Run by Carlo on zo 30/09/2007 at 14:53

Microsoft Windows XP [versie 5.1.2600]

Running From: C:\DOCUME~1\Carlo\BUREAU~1\SDFIX\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\Sys32\AKV.exe - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__11_50_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__12_00_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__12_10_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__12_20_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__12_30_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__12_40_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__12_50_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__13_00_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__13_10_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__13_20_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__13_30_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__13_40_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__14_00_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__14_10_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__14_20_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__14_30_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__14_40_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__15_00_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__15_10_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__15_20_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__15_30_25.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__15_50_25.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__16_00_25.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__16_20_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__16_30_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__16_40_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__17_00_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__17_10_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__17_30_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__17_40_08.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__17_50_08.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__18_00_08.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__18_17_18.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__18_37_18.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__18_47_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__19_07_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__19_37_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__20_07_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__20_17_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__20_27_20.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__20_37_20.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__20_57_20.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__21_17_20.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__21_37_21.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__21_47_21.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__21_57_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__22_07_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__22_17_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__22_27_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__23_07_38.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__23_27_39.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_01_2007__23_37_39.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__11_11_18.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__11_21_23.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__11_41_23.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__11_51_23.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__12_01_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__12_11_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__12_21_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__12_31_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__12_41_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__12_51_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__13_14_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__13_34_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__13_44_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__13_54_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__14_14_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__14_24_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__14_34_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__14_44_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__14_54_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__15_04_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__15_24_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__15_34_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__15_44_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__15_54_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__16_04_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__16_24_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__16_34_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__16_44_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__16_54_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__17_04_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__17_14_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__17_24_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__17_34_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__18_04_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__18_14_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__18_24_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__18_44_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__18_54_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__19_14_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__19_34_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__19_44_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__19_54_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__20_14_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__20_24_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__20_44_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__20_54_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__21_04_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__21_34_32.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__21_54_32.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__22_14_32.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__22_34_32.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_02_2007__22_54_32.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_03_2007__11_22_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_03_2007__12_33_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_03_2007__13_03_20.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_03_2007__13_33_38.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_03_2007__14_11_10.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__15_59_24.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__16_09_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__16_19_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__16_29_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__16_39_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__16_49_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__16_59_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__17_09_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__17_29_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__17_39_37.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__18_40_16.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__19_00_21.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__19_10_21.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__19_40_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__19_50_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__20_20_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__20_30_23.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__20_40_23.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__20_50_23.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__21_20_33.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_04_2007__21_30_33.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__12_39_32.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__14_09_39.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__14_19_39.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__15_59_58.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__16_19_59.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__19_07_41.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__19_17_48.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__19_27_48.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__19_37_48.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__19_47_48.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__19_57_48.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__20_07_48.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_05_2007__20_19_03.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__10_31_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__10_41_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__10_51_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__12_12_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__19_20_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__19_30_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__19_40_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__19_50_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__20_00_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__20_10_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__20_20_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__20_30_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__20_40_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__21_00_43.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__21_10_44.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__21_20_44.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__21_30_44.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__22_00_56.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_06_2007__22_41_36.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__12_45_54.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__12_55_56.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__20_07_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__20_27_29.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__20_37_29.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__21_37_59.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__22_28_49.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__22_38_54.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_07_2007__22_48_54.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__14_34_05.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__16_17_50.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__16_27_53.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__16_37_53.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__16_47_53.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__16_57_54.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__17_17_54.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__17_27_54.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__17_47_59.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__18_28_10.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__18_58_25.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__19_08_25.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__19_18_25.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__19_38_25.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__19_58_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__20_18_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__20_28_26.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__21_18_27.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__21_38_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__21_48_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__21_58_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__22_08_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__22_28_28.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_08_2007__22_58_29.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__10_00_12.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__10_20_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__10_30_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__10_40_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__10_50_19.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__11_07_00.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__11_17_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__14_51_00.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__15_01_00.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__15_21_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__15_51_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__16_01_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__16_11_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__16_21_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__16_31_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__16_41_02.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__17_01_02.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__17_11_02.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__17_21_02.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__17_31_02.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__17_41_02.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__18_41_02.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__19_01_03.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__19_41_03.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__19_51_03.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__20_01_04.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__20_23_52.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__20_33_52.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__20_43_52.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__20_53_52.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__21_03_52.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__21_13_53.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__21_23_53.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__21_43_53.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__22_13_54.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__23_23_56.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__23_43_56.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_09_2007__23_53_56.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__00_03_56.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__00_16_03.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__09_16_04.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__09_36_10.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__09_46_10.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__10_06_10.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__10_16_10.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__10_26_10.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__10_46_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__11_46_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__11_56_12.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__12_06_12.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__12_16_12.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__12_36_12.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__13_26_12.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__13_36_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__14_06_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__14_36_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__14_56_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__15_06_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__15_36_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__15_56_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__16_06_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__16_16_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__16_36_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__16_46_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__17_06_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__17_16_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__17_36_15.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__17_46_15.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__18_06_15.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__18_26_15.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__18_36_15.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__19_56_38.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__20_06_38.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__20_26_39.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__20_36_39.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__20_46_39.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__21_16_40.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__21_46_40.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__21_56_40.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__22_16_40.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__22_26_40.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__22_56_41.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jul_10_2007__23_26_41.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__12_42_29.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__12_52_33.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__13_02_49.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__13_12_59.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__13_23_06.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__13_33_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__13_43_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__13_53_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__14_03_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__14_13_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__14_23_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__14_33_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__14_43_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__14_53_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__15_03_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__15_13_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__15_23_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__15_33_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__15_43_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__15_53_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__16_03_23.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__16_13_23.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__16_33_39.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__16_54_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__17_04_18.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__17_14_33.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__17_24_44.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__18_05_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__18_25_21.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__18_35_38.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__18_45_51.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__19_06_09.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__19_56_31.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__20_06_52.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__20_27_22.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__20_48_13.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__21_49_45.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__21_59_45.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__22_09_45.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_29_2007__22_19_45.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__09_08_00.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__09_18_00.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__09_28_00.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__09_38_00.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__09_48_00.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__09_58_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__10_08_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__13_05_01.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__13_15_06.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__13_25_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__13_35_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__13_45_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__13_55_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__14_05_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__14_15_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__14_35_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__14_55_07.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__15_15_17.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__16_06_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__16_16_14.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__16_39_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__16_49_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__16_59_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__17_09_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__17_19_11.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__17_29_12.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__17_39_12.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__18_50_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__19_00_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__19_10_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__19_20_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__19_30_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__19_50_30.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__21_53_50.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__22_03_56.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__22_13_57.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__22_43_57.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__22_53_57.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__23_03_57.jpg - Deleted
C:\WINDOWS\system32\Sys32\Jun_30_2007__23_13_57.jpg - Deleted
C:\WINDOWS\system32\Sys32\LHRO.001 - Deleted
C:\WINDOWS\system32\Sys32\LHRO.002 - Deleted
C:\WINDOWS\system32\Sys32\LHRO.002.tmp - Deleted
C:\WINDOWS\system32\Sys32\LHRO.005 - Deleted
C:\WINDOWS\system32\Sys32\LHRO.005.tmp - Deleted
C:\WINDOWS\system32\Sys32\LHRO.006 - Deleted
C:\WINDOWS\system32\Sys32\LHRO.007 - Deleted
C:\WINDOWS\system32\Sys32\LHRO.008 - Deleted
C:\WINDOWS\system32\Sys32\LHRO.008.tmp - Deleted
C:\WINDOWS\system32\Sys32\LHRO.009 - Deleted
C:\WINDOWS\system32\Sys32\LHRO.009.tmp - Deleted
C:\WINDOWS\system32\Sys32\LHRO.exe - Deleted


Folder C:\WINDOWS\system32\Sys32 - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
d

decarlo

Legacy Member
Final Check:

Remaining Services:
------------------




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Double Agent\\SCDA-Offline\\System\\SplinterCell4.exe"="C:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Double Agent\\SCDA-Offline\\System\\SplinterCell4.exe:*:Enabled:SplinterCell4"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\Kluiven\\sroboten1.54\\srobot.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\Kluiven\\sroboten1.54\\srobot.exe:*:Enabled:HookSrv"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\CS3\\utorrent.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\CS3\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\utorrent.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5"
"C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"="C:\\Program Files\\Microsoft Games\\Halo\\halo.exe:*:Enabled:Halo"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\NRPG RatioMaster.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\NRPG RatioMaster.exe:*:Enabled:NRPG RatioMaster"
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"="C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe:*:Enabled:Adobe Version Cue CS3 Server"
"C:\\wamp\\Apache2\\bin\\httpd.exe"="C:\\wamp\\Apache2\\bin\\httpd.exe:*:Enabled:Apache HTTP Server"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\antrix_885\\antrix_885\\Rev885\\logonserver.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\antrix_885\\antrix_885\\Rev885\\logonserver.exe:*:Enabled:logonserver"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\antrix_885\\antrix_885\\Rev885\\antrix.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\antrix_885\\antrix_885\\Rev885\\antrix.exe:*:Enabled:antrix"
"C:\\Program Files\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2.exe"="C:\\Program Files\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2.exe:*:Enabled:Ghost Recon Advanced Warfighter© 2"
"C:\\Program Files\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"="C:\\Program Files\\Ubisoft\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe:*:Enabled:Ghost Recon Advanced Warfighter© 2 Dedicated Server"
"C:\\Program Files\\Microsoft Games\\Halo 2\\halo2.exe"="C:\\Program Files\\Microsoft Games\\Halo 2\\halo2.exe:*:Enabled:Halo 2"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"="C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe:*:Enabled:Battlefield 2"
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"="C:\\Program Files\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye"
"C:\\Program Files\\Codemasters\\DiRT\\DiRT.exe"="C:\\Program Files\\Codemasters\\DiRT\\DiRT.exe:*:Enabled:DiRT Executable"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\My Mobile\\MyMobiler\\MyMobiler.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\My Mobile\\MyMobiler\\MyMobiler.exe:*:Enabled:Remote Mobile Module"
"C:\\Program Files\\Adobe\\Adobe Flash CS3\\Flash.exe"="C:\\Program Files\\Adobe\\Adobe Flash CS3\\Flash.exe:*:Enabled:Adobe Flash CS3"
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="C:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"C:\\Program Files\\Silkroad\\SilkErrSender.exe"="C:\\Program Files\\Silkroad\\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????"
"E:\\Downloads\\Isrobot 1.66_7Ease_7Dater\\srobot.exe"="E:\\Downloads\\Isrobot 1.66_7Ease_7Dater\\srobot.exe:*:Enabled:HookSrv"
"E:\\Downloads\\Isrobot 1.66_7Ease_7Dater\\sroboten1.77\\srobot.exe"="E:\\Downloads\\Isrobot 1.66_7Ease_7Dater\\sroboten1.77\\srobot.exe:*:Enabled:HookSrv"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\sroboten1.75\\srobot.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\sroboten1.75\\srobot.exe:*:Enabled:HookSrv"
"C:\\Program Files\\ProjectHax\\HaxCr4x 3.4.exe"="C:\\Program Files\\ProjectHax\\HaxCr4x 3.4.exe:*:Enabled:HaxCr4x 3.4"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\Botstuff\\Tbot[LPS]\\Tbot[LPS].exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\Botstuff\\Tbot[LPS]\\Tbot[LPS].exe:*:Enabled:Tbot[LPS]"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\Botstuff\\TServer0919b\\server.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\Botstuff\\TServer0919b\\server.exe:*:Enabled:server"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\Botstuff\\TbotSroBot0919\\server.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\Botstuff\\TbotSroBot0919\\server.exe:*:Enabled:server"
"E:\\Documenten_oud\\Kluiven\\sroboten1.54\\srobot.exe"="E:\\Documenten_oud\\Kluiven\\sroboten1.54\\srobot.exe:*:Enabled:HookSrv"
"C:\\Program Files\\ProjectHax\\Turbo Crack 5.0.exe"="C:\\Program Files\\ProjectHax\\Turbo Crack 5.0.exe:*:Enabled:Turbo Crack 5.0"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\Nubot_Redone\\Nubot Redone\\bot\\srobot.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\Nubot_Redone\\Nubot Redone\\bot\\srobot.exe:*:Enabled:HookSrv"
"C:\\Documents and Settings\\Carlo\\Bureaublad\\Nubot_Redone\\Nubot Redone\\bot\\HaxCr4x 3.3.exe"="C:\\Documents and Settings\\Carlo\\Bureaublad\\Nubot_Redone\\Nubot Redone\\bot\\HaxCr4x 3.3.exe:*:Enabled:HaxCr4x 3.3"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\Carlo\BUREAU~1\SDFIX\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Thu 12 Jul 2007 56 ..SHR --- "C:\WINDOWS\system32\7AD0514685.sys"
Thu 12 Jul 2007 10,022 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Wed 13 Jun 2007 1,237,947 ...H. --- "C:\WINDOWS\system32\drivers\spools.exe"
Fri 20 Jul 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 6 Jul 2007 857 ...HR --- "C:\Documents and Settings\Carlo\Application Data\SecuROM\UserData\securom_v7_01.bak"
Tue 26 Jul 2005 72,192 A..H. --- "C:\Documents and Settings\Carlo\Bureaublad\Memstick\Nikky\~WRL0004.tmp"
Fri 29 Oct 2004 128 A..H. --- "C:\Documents and Settings\Carlo\Bureaublad\MARC USB (J)\SecurDataStorRM\Files\AppPrefs.bak"
Fri 29 Oct 2004 53,248 A..H. --- "C:\Documents and Settings\Carlo\Bureaublad\MARC USB (J)\SecurDataStorRM\Files\CopyFile.exe"
Fri 29 Oct 2004 30,133 A..H. --- "C:\Documents and Settings\Carlo\Bureaublad\MARC USB (J)\SecurDataStorRM\Files\msghxx.dllz"
Fri 29 Oct 2004 180,700 A..H. --- "C:\Documents and Settings\Carlo\Bureaublad\MARC USB (J)\SecurDataStorRM\Files\MSVCR71.DLLz"
Fri 29 Oct 2004 1,671,168 A..H. --- "C:\Documents and Settings\Carlo\Bureaublad\MARC USB (J)\SecurDataStorRM\Files\SecurDataStor.exe"
Fri 29 Oct 2004 84,576 A..H. --- "C:\Documents and Settings\Carlo\Bureaublad\MARC USB (J)\SecurDataStorRM\Files\Viewer.exez"
Mon 13 Mar 2006 1,014,784 A..H. --- "C:\Documents and Settings\Carlo\Bureaublad\Memstick\Umberto\AXA_bestanden\~WRL1946.tmp"

Finished!
d

decarlo

Legacy Member
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:09:34, on 30/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Steam\Steam.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\CPdeSrvU.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] -RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] -nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] -RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] -SOUNDMAN.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LHRO Agent] -C:\WINDOWS\system32\Sys32\LHRO.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] -"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NWEReboot] -
O4 - HKLM\..\Run: [NeroFilterCheck] -C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] -C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] -"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobiele favorieten maken... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - -"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (file missing)
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - -"C:\Program Files\Eset\nod32krn.exe" (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (file missing)
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nc.exe
O23 - Service: Messenger USN Journal Reader service voor Gedeelde mappen (usnjsvc) - Unknown owner - -"C:\Program Files\MSN Messenger\usnsvc.exe" (file missing)
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe

--
End of file - 9192 bytes
J

Jurgenv1

Legacy Member
* Fix de volgende regel in hijackthis:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Vertel dan hoe alles verder werkt.
d

decarlo

Legacy Member
alles werkt verder perfect, die atf cleaner heeft in totaal ongeveer 700MB vrijgemaakt :)

wil je nog een hjt logje of is het in orde?

alvast bedankt voor de hulp
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan