Archief - Log (spysheriff problemen)

Mijn computer is eens bedolven onder spyware... Zelfs hitman pro lijkt niet direct te helpen.

Logfile of HijackThis v1.99.1
Scan saved at 15:18:25, on 29/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\svchost.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\System32\VTTimer.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Save\Save.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\vxgamet1.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgamet2.exe
C:\Program Files\HjackThis\HijackThis.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file:\\C:\WINDOWS\System32\Searchx.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://C:\WINDOWS\blank.mht
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.skynet.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - _{30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: {B5AB638F-D76C-415B-A8F2-F3CEAC502212} - - (no file)
F2 - REGystem.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
F3 - REG:win.ini: load=C:\Program Files\KEVIN\kevin.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UrlHooker - {A0349DB8-1AC8-4beb-A017-733BD6CC060B} - C:\Program Files\Sint Corporation\HomePage\bin\HomePageSolid.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: DLHelperEXE.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {00E3FEB0-11A8-659F-23B1-0B6D6B1937A1} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {028C7904-30F1-10F3-8700-0B2A6E43C445} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {05154E0D-E6BB-13B0-92D0-65235FC0AAAA} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {052D317A-DF1B-54E5-1EAA-01B77561435A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0593FD35-B8A6-07BF-3FCC-511D05A3978B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {067BF92E-CE17-606D-E993-367454E11F00} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {06EFA0DE-8280-792C-CF53-4EAE32A51607} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {07921EB3-74AB-71CB-77C6-522A2120B2AD} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {08893D92-625C-48F4-F5CF-066F0F5D0438} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {08A81E56-C51B-649A-5352-336105C47264} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {094752CC-AD52-364E-02E0-2B3867BD0A28} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0980EA7D-2AE4-521B-C5F5-477D2B019A70} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {09A58FEA-1018-4BFC-4F1D-44D8585AE9AC} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0B0BB14C-9CF4-5F20-3589-0D9233EFF605} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0B19AD4B-249D-3AF8-FA37-32A1620FFAEF} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0B39D320-8C0D-2B59-3E53-7A127377669D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0B8BBB58-5057-58BD-4D37-29875759B6CB} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0C8C359B-5BB9-5EB0-7FFF-798D6A8B55AE} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0E1F1FE5-D198-2D9F-1414-70EA4E5C88FF} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0E7ADC19-8744-2F83-CA4F-5468221F798A} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0F1D34B4-6BB2-4465-C474-01986A76E582} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0FC8CFF1-0C13-4B7F-2841-5EEA2A1F479C} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1099F084-401C-25C6-8DCD-591E4D5F134A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1181BD1E-48C3-11C7-316A-76B579EB6D41} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1266CB20-51A3-183B-41CA-58F5768AF7D4} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {12BC80A4-BB85-1AA7-56CB-1F8B723C5548} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {15684A0D-635B-0E7A-4594-5DCA0D202B37} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1599D9A6-707D-2099-3853-0D6C1C5AC7DF} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {15F72FE2-268B-02D0-C897-15797ED43732} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {16A12528-AC34-4B99-660F-0C086140C39A} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1748250B-A578-009F-AA84-0A7A435F2190} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1ACF6C8D-9A6F-33E7-4C21-433558E73DB0} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1AF2F8E7-AEB6-757E-2B4D-0DA108ADA5BD} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1AF462AA-8CC4-683F-0644-040814E98B40} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1B92720A-5EF7-54F5-CFD6-1E643B5372A6} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1CBA1D92-94F9-7394-972F-04734F66E6FD} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1D308F4D-4560-19E3-745C-5AF32E723D7C} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1FBC719E-1FA3-04FB-A94A-2A360826D0EB} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1FE97FD9-35DC-2D26-B8C7-5C491E112F76} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2063D93D-959C-7E91-E08C-59802CC6A159} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {20D300E3-38C6-73CF-A830-1EEA24D91D9C} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {214DCD7B-DE3B-54A2-6100-0A6712773C62} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2158E69B-E411-0931-2576-08200C97FA38} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2176A8D1-CD31-3DEA-D529-4FF46340BBC8} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {227388DB-CC4B-2ED3-0222-6510644A9772} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {237C2A8A-A8E6-554A-07E4-7E604FF96B85} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {23971A87-4FF2-611A-77DE-745E132FE972} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {23A8B46F-89EC-6F7E-CFE4-6F3F588F377F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {23E7F2EB-3DAF-0C73-0063-202322C25028} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {24762067-CCD6-7ACA-0B2E-523D07845726} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {24A3D3BB-C325-0FFF-0BDF-0D1F79FF8FEE} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {24B51281-3A23-5D12-C4B3-3BE3626DB03D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {25217578-26A2-0EC6-CC4A-3C3B6DA1B2D4} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2580D81D-39BA-5177-5F80-4C3D270F7615} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {262C3801-C138-773E-5CE4-7FAC7021709F} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {26E8C469-CB74-0499-C7D2-0CF45865819F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {28D06CD4-E838-4224-1F51-3BF35DE53BD4} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2975C1B4-7B83-7630-5624-33857644F4FA} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {29BF47C3-484C-008E-35E4-35F24124D016} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2A7305D2-CED1-2423-0B8A-6D6270EC72D9} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2B66260F-BA21-7A95-070E-127D69FB1E69} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2B939D63-E011-2E5F-314B-3B77384D400F} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2DB28808-5441-3F2A-171A-7EBF5027C643} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2DCBB887-DBDC-2313-55D5-6E760EF54B1B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2FBEB936-0493-636C-3E9B-3EE73604CBF7} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2FE3E978-9BD3-6823-3D12-16C82AEF8D2D} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {334E3DEC-C94A-04AE-734F-2A9423FE4B7A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {341A20E4-AF86-5A34-04AF-3F352021D2F5} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3457227D-A774-015C-6600-38BD051BD6ED} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {36F76664-97E0-5CA7-A845-0FBF55DD929F} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3701587E-212D-2C96-A55B-66D474809366} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {39FC70DA-0BCA-5BBE-52B8-7A045A6F34DD} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3A4C6EC7-60D0-0B64-FA05-5DFD687789C0} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {3ACE6A52-81A3-1600-8A54-0EB822ACB74F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {3B59D4F5-B1E9-7CF0-C1E9-34C13E2EF48B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3BB1D2DF-EE31-69FF-27D8-7428242BF455} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3BF1E945-F452-73C8-0857-332E3ECF6849} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {3ED11B7B-82AC-1930-5731-0D6E5930119A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {3F6B2CF3-02B1-60F9-D64C-2D8A0AFE8913} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {40A5B48D-3A12-2D49-2731-4E691EDB1BA5} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4138E005-121D-47BF-5D5B-50CD2E4A21DF} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {42E496FD-EAE3-56FD-F7CC-4B96422D6D60} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {435C62E5-E670-2327-9A1A-6F2000C5EB2E} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {44092D31-A20D-2702-BFF3-41DE682F59BA} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {444A896C-B2E0-3AC0-7322-2CEA7A92DA3B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {45E81DED-8D14-00B8-571E-22377F5BBFE6} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {47360864-6CC7-35A0-B071-5BB56516AA39} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {473613EE-B786-2C6E-4CCE-4D9536DACC89} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {47CD4969-FBB5-1851-8B7A-305B32AFD28E} - http://69.50.188.54/1/gdnBE208.exe

O16 - DPF: {48B084AD-5D2B-3DC7-C51D-4A8A5BB8161E} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {4A8596A5-B060-7ADB-0799-7650153A62D5} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4B0618D7-0075-1CAB-2E1E-536175EE4E29} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {4B256B71-C246-7242-082C-551225814EA1} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {4B3BD8B4-7EBC-6816-9CE8-162C150314D5} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4E396DF4-9985-0870-3CF0-67F464126835} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4F34BCE7-7E48-5EEB-F2C6-4C524A250E5D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4F61D348-C1AC-624A-BE00-4C07326A6C1B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {52522D68-7DF2-4209-13B7-7BE803E814C7} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5334374D-331B-1545-6D1E-639B7EA2523B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {533CA5B6-1DC2-12F2-6E6D-48FB61065B5D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {53F8A54A-7B43-247B-2D40-0C4E57F9ECAB} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5573FEA5-28B2-2CF3-407F-25444537A3D3} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {55AC6858-ACF2-6C2F-700F-7C6B61A0F531} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {55B93B83-B794-4D4B-4343-74883232D4EE} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {56371793-6704-3330-FC7D-6C564DD5C097} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5713DAEF-E04E-550B-23AD-7077544D71AB} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {579A3E35-DBC3-4A9E-618E-596D1A9F730A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {58051CE7-E261-0B1E-1AD3-752A2E386044} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5966F114-8613-4119-D2D2-1EE83157690D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5A78EEB0-4FF7-41EF-3990-251D0C21E4E1} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5A8DD036-F969-775B-3D62-670F4086765A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5B2F41CC-C74D-6F25-7E2C-1BAD2D2BAACA} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5C0023E8-3B85-737F-455B-00AF146E9E50} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5C3BAFC8-060A-5AB1-412A-2EE3090F8B3B} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5D181F5C-A3CB-54A3-8731-18184CF8506C} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5D451CED-4A2A-2A28-EDD1-42A7046C18F9} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5E070609-A4C2-5FA4-FA15-495E6568DB85} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5E5FA3F2-0673-7D7C-83D0-30D340D24E24} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5F1D4A23-8E67-26B7-54E4-578376EEC1EE} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6011F0C4-E01A-50DD-949C-4CF1387FF0A1} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {60B6AC54-928A-43C8-1405-34314B1C3D1C} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {615A1401-D626-69F0-D9A7-1066388A745E} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {62E20615-2BF2-4710-A0CC-343E754CFD43} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {63FCC94D-10B2-1DDD-8F37-1B39700EFEFF} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {640908EF-9663-08BA-0B02-30B256FDBF80} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {64097B95-08DA-16A4-55C9-50C30AD668F1} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6475AF98-D707-576C-1B97-07C800C93773} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {649A7079-5DEC-1CE2-9C85-0CFD48A399D1} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {64D734DD-CCD3-0D41-908C-56953F7159BB} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {65461F08-8ED2-2700-2085-64E42E0A26F5} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {66F88743-A020-4191-E3BA-153B0F9522DE} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6729017F-413E-334B-307B-0AE65CABDFD9} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {688D445C-18A3-7B1C-23EF-006377C3F7F7} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {69EB04D2-B004-40E7-BD57-426963AC90F8} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6A02B7A2-7E34-2F18-24CD-50A866FD622A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6AA882FC-3E77-24B2-7833-60021E067365} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6B50E669-D6F6-4129-5D45-3D5B4F0C99F7} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {6B512B26-994B-39B2-C0C1-1C207541EDE6} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6D43590F-7A0E-62FA-E19A-1D8F0B61B14E} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6D591493-F7FF-6F95-BE59-39B261D56500} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {6DBB1FD8-EDE7-7E31-1ABD-04D33B1354B4} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6E668BF7-7381-7DDF-E713-171D48018A88} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {7001E72E-43A8-387F-306D-7D2B1B1A4B77} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {703DA8E7-0134-7281-9372-24D07F33FA41} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {706459A2-7CD6-3723-B912-0EA2013A965B} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {70882508-A695-3FD9-41CA-204D7A483E61} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {725246F1-A883-448A-5254-69460A4ED7FA} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {7290D2DF-6E8F-0C44-3574-647A0BA3537C} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {72ADE487-09A2-5CDE-CEEE-420624BC0AEB} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7383D009-4949-595C-BC9E-1ED21E66F98F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {754404CD-BC04-77B2-97D7-50506B08C360} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {75510741-7AA6-17E0-67AE-5E1E4BB1FC63} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {75C9DD28-8F90-48EE-9642-0D7D657900D0} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {761DCDC9-986A-4CF0-1A1B-1FC83AD61A54} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {77D0CAA9-2F76-4100-E297-62EF23605A19} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {7830C992-5146-69D0-D5BD-11BC517F389D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {78C212C4-954B-023D-92D8-709D423EBD81} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {799A1BA1-0570-3285-4BC3-440E3D064A23} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7B570B9D-B90C-24CE-5F11-0C1371F8CFE4} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7C5D649C-EC38-621E-F311-469474D4862F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7D775338-F20A-429D-CB54-68894E9E6057} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7E2A144C-4D4F-020D-2BCF-5C993041E923} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7EC1EA2F-285D-4CC5-069A-61CA7087C236} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7EF9D4FD-CB1B-6932-1036-246F2B209ECC} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7F83CE58-584D-2B34-9095-20CB62D86B4F} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {7FAAEA16-4A28-13BB-4566-769F4EFBE9A4} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/be/games4.cab
O16 - DPF: {970BF476-3CF2-4572-9EF9-4479E1591DB8} - http://www.globalphon.com/dialer/belgio_ver3.CAB
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=4600
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhelper/version7/dlhelper.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E3E79AB-5E8D-4673-98CB-BF525D828A46}: NameServer = 195.238.2.21 195.238.2.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{0E3E79AB-5E8D-4673-98CB-BF525D828A46}: NameServer = 195.238.2.21 195.238.2.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{0E3E79AB-5E8D-4673-98CB-BF525D828A46}: NameServer = 195.238.2.21 195.238.2.22
O21 - SSODL: Creative MediaSource - {56920927-AE5B-CE41-C75D-01F48143DD23} - c:\progra~1\common~1\instal~1\engine\6\intel3~1\winqjqta1.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Opstarten in veilige modus en de volgende regels verwijderen uit je log. Eveneens verwijder je alle bestanden die op deze regels vermeld worden, behalve voor die overbodige. Daarna opnieuw opstarten en een nieuwe log posten om te zien of alles weg is.

C:\WINDOWS\Svchost.exe
C:\Program Files\Save\Save.exe
C:\WINDOWS\System32\vxgamet1.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgame4.exe
C:\WINDOWS\System32\vxgamet2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file:\\C:\WINDOWS\System32\Searchx.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://C:\WINDOWS\blank.mht
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R3 - URLSearchHook: (no name) - _{30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: {B5AB638F-D76C-415B-A8F2-F3CEAC502212} - - (no file)
F2 - REGystem.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
F3 - REG:win.ini: load=C:\Program Files\KEVIN\kevin.exe
O2 - BHO: UrlHooker - {A0349DB8-1AC8-4beb-A017-733BD6CC060B} - C:\Program Files\Sint Corporation\HomePage\bin\HomePageSolid.dll
O4 - HKLM\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\Svchost.exe /s
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exe
O4 - Startup: DLHelperEXE.exe
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll
O9 - Extra button: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)
O16 - DPF: {00E3FEB0-11A8-659F-23B1-0B6D6B1937A1} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {028C7904-30F1-10F3-8700-0B2A6E43C445} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {05154E0D-E6BB-13B0-92D0-65235FC0AAAA} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {052D317A-DF1B-54E5-1EAA-01B77561435A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0593FD35-B8A6-07BF-3FCC-511D05A3978B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {067BF92E-CE17-606D-E993-367454E11F00} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {06EFA0DE-8280-792C-CF53-4EAE32A51607} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {07921EB3-74AB-71CB-77C6-522A2120B2AD} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {08893D92-625C-48F4-F5CF-066F0F5D0438} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {08A81E56-C51B-649A-5352-336105C47264} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {094752CC-AD52-364E-02E0-2B3867BD0A28} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0980EA7D-2AE4-521B-C5F5-477D2B019A70} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {09A58FEA-1018-4BFC-4F1D-44D8585AE9AC} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0B0BB14C-9CF4-5F20-3589-0D9233EFF605} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0B19AD4B-249D-3AF8-FA37-32A1620FFAEF} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0B39D320-8C0D-2B59-3E53-7A127377669D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0B8BBB58-5057-58BD-4D37-29875759B6CB} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0C8C359B-5BB9-5EB0-7FFF-798D6A8B55AE} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0E1F1FE5-D198-2D9F-1414-70EA4E5C88FF} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0E7ADC19-8744-2F83-CA4F-5468221F798A} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {0F1D34B4-6BB2-4465-C474-01986A76E582} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {0FC8CFF1-0C13-4B7F-2841-5EEA2A1F479C} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1099F084-401C-25C6-8DCD-591E4D5F134A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1181BD1E-48C3-11C7-316A-76B579EB6D41} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1266CB20-51A3-183B-41CA-58F5768AF7D4} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {12BC80A4-BB85-1AA7-56CB-1F8B723C5548} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {15684A0D-635B-0E7A-4594-5DCA0D202B37} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1599D9A6-707D-2099-3853-0D6C1C5AC7DF} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {15F72FE2-268B-02D0-C897-15797ED43732} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {16A12528-AC34-4B99-660F-0C086140C39A} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1748250B-A578-009F-AA84-0A7A435F2190} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1ACF6C8D-9A6F-33E7-4C21-433558E73DB0} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1AF2F8E7-AEB6-757E-2B4D-0DA108ADA5BD} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1AF462AA-8CC4-683F-0644-040814E98B40} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1B92720A-5EF7-54F5-CFD6-1E643B5372A6} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1CBA1D92-94F9-7394-972F-04734F66E6FD} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1D308F4D-4560-19E3-745C-5AF32E723D7C} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {1FBC719E-1FA3-04FB-A94A-2A360826D0EB} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {1FE97FD9-35DC-2D26-B8C7-5C491E112F76} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2063D93D-959C-7E91-E08C-59802CC6A159} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {20D300E3-38C6-73CF-A830-1EEA24D91D9C} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {214DCD7B-DE3B-54A2-6100-0A6712773C62} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2158E69B-E411-0931-2576-08200C97FA38} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2176A8D1-CD31-3DEA-D529-4FF46340BBC8} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {227388DB-CC4B-2ED3-0222-6510644A9772} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {237C2A8A-A8E6-554A-07E4-7E604FF96B85} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {23971A87-4FF2-611A-77DE-745E132FE972} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {23A8B46F-89EC-6F7E-CFE4-6F3F588F377F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {23E7F2EB-3DAF-0C73-0063-202322C25028} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {24762067-CCD6-7ACA-0B2E-523D07845726} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {24A3D3BB-C325-0FFF-0BDF-0D1F79FF8FEE} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {24B51281-3A23-5D12-C4B3-3BE3626DB03D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {25217578-26A2-0EC6-CC4A-3C3B6DA1B2D4} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2580D81D-39BA-5177-5F80-4C3D270F7615} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {262C3801-C138-773E-5CE4-7FAC7021709F} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {26E8C469-CB74-0499-C7D2-0CF45865819F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {28D06CD4-E838-4224-1F51-3BF35DE53BD4} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2975C1B4-7B83-7630-5624-33857644F4FA} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {29BF47C3-484C-008E-35E4-35F24124D016} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2A7305D2-CED1-2423-0B8A-6D6270EC72D9} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2B66260F-BA21-7A95-070E-127D69FB1E69} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2B939D63-E011-2E5F-314B-3B77384D400F} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2DB28808-5441-3F2A-171A-7EBF5027C643} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2DCBB887-DBDC-2313-55D5-6E760EF54B1B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {2FBEB936-0493-636C-3E9B-3EE73604CBF7} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {2FE3E978-9BD3-6823-3D12-16C82AEF8D2D} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {334E3DEC-C94A-04AE-734F-2A9423FE4B7A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {341A20E4-AF86-5A34-04AF-3F352021D2F5} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3457227D-A774-015C-6600-38BD051BD6ED} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {36F76664-97E0-5CA7-A845-0FBF55DD929F} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3701587E-212D-2C96-A55B-66D474809366} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {39FC70DA-0BCA-5BBE-52B8-7A045A6F34DD} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3A4C6EC7-60D0-0B64-FA05-5DFD687789C0} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {3ACE6A52-81A3-1600-8A54-0EB822ACB74F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {3B59D4F5-B1E9-7CF0-C1E9-34C13E2EF48B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3BB1D2DF-EE31-69FF-27D8-7428242BF455} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {3BF1E945-F452-73C8-0857-332E3ECF6849} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {3ED11B7B-82AC-1930-5731-0D6E5930119A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {3F6B2CF3-02B1-60F9-D64C-2D8A0AFE8913} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {40A5B48D-3A12-2D49-2731-4E691EDB1BA5} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4138E005-121D-47BF-5D5B-50CD2E4A21DF} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {42E496FD-EAE3-56FD-F7CC-4B96422D6D60} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {435C62E5-E670-2327-9A1A-6F2000C5EB2E} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {44092D31-A20D-2702-BFF3-41DE682F59BA} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {444A896C-B2E0-3AC0-7322-2CEA7A92DA3B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {45E81DED-8D14-00B8-571E-22377F5BBFE6} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {47360864-6CC7-35A0-B071-5BB56516AA39} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {473613EE-B786-2C6E-4CCE-4D9536DACC89} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {47CD4969-FBB5-1851-8B7A-305B32AFD28E} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {48B084AD-5D2B-3DC7-C51D-4A8A5BB8161E} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {4A8596A5-B060-7ADB-0799-7650153A62D5} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4B0618D7-0075-1CAB-2E1E-536175EE4E29} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {4B256B71-C246-7242-082C-551225814EA1} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {4B3BD8B4-7EBC-6816-9CE8-162C150314D5} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4E396DF4-9985-0870-3CF0-67F464126835} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4F34BCE7-7E48-5EEB-F2C6-4C524A250E5D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {4F61D348-C1AC-624A-BE00-4C07326A6C1B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {52522D68-7DF2-4209-13B7-7BE803E814C7} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5334374D-331B-1545-6D1E-639B7EA2523B} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {533CA5B6-1DC2-12F2-6E6D-48FB61065B5D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {53F8A54A-7B43-247B-2D40-0C4E57F9ECAB} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5573FEA5-28B2-2CF3-407F-25444537A3D3} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {55AC6858-ACF2-6C2F-700F-7C6B61A0F531} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {55B93B83-B794-4D4B-4343-74883232D4EE} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {56371793-6704-3330-FC7D-6C564DD5C097} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5713DAEF-E04E-550B-23AD-7077544D71AB} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {579A3E35-DBC3-4A9E-618E-596D1A9F730A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {58051CE7-E261-0B1E-1AD3-752A2E386044} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5966F114-8613-4119-D2D2-1EE83157690D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5A78EEB0-4FF7-41EF-3990-251D0C21E4E1} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5A8DD036-F969-775B-3D62-670F4086765A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5B2F41CC-C74D-6F25-7E2C-1BAD2D2BAACA} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5C0023E8-3B85-737F-455B-00AF146E9E50} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5C3BAFC8-060A-5AB1-412A-2EE3090F8B3B} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5D181F5C-A3CB-54A3-8731-18184CF8506C} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5D451CED-4A2A-2A28-EDD1-42A7046C18F9} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {5E070609-A4C2-5FA4-FA15-495E6568DB85} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5E5FA3F2-0673-7D7C-83D0-30D340D24E24} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {5F1D4A23-8E67-26B7-54E4-578376EEC1EE} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6011F0C4-E01A-50DD-949C-4CF1387FF0A1} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {60B6AC54-928A-43C8-1405-34314B1C3D1C} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {615A1401-D626-69F0-D9A7-1066388A745E} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {62E20615-2BF2-4710-A0CC-343E754CFD43} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {63FCC94D-10B2-1DDD-8F37-1B39700EFEFF} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {640908EF-9663-08BA-0B02-30B256FDBF80} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {64097B95-08DA-16A4-55C9-50C30AD668F1} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6475AF98-D707-576C-1B97-07C800C93773} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {649A7079-5DEC-1CE2-9C85-0CFD48A399D1} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {64D734DD-CCD3-0D41-908C-56953F7159BB} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {65461F08-8ED2-2700-2085-64E42E0A26F5} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {66F88743-A020-4191-E3BA-153B0F9522DE} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6729017F-413E-334B-307B-0AE65CABDFD9} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {688D445C-18A3-7B1C-23EF-006377C3F7F7} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {69EB04D2-B004-40E7-BD57-426963AC90F8} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6A02B7A2-7E34-2F18-24CD-50A866FD622A} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6AA882FC-3E77-24B2-7833-60021E067365} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6B50E669-D6F6-4129-5D45-3D5B4F0C99F7} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {6B512B26-994B-39B2-C0C1-1C207541EDE6} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6D43590F-7A0E-62FA-E19A-1D8F0B61B14E} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6D591493-F7FF-6F95-BE59-39B261D56500} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {6DBB1FD8-EDE7-7E31-1ABD-04D33B1354B4} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {6E668BF7-7381-7DDF-E713-171D48018A88} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {7001E72E-43A8-387F-306D-7D2B1B1A4B77} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {703DA8E7-0134-7281-9372-24D07F33FA41} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {706459A2-7CD6-3723-B912-0EA2013A965B} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {70882508-A695-3FD9-41CA-204D7A483E61} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {725246F1-A883-448A-5254-69460A4ED7FA} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {7290D2DF-6E8F-0C44-3574-647A0BA3537C} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {72ADE487-09A2-5CDE-CEEE-420624BC0AEB} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7383D009-4949-595C-BC9E-1ED21E66F98F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {754404CD-BC04-77B2-97D7-50506B08C360} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {75510741-7AA6-17E0-67AE-5E1E4BB1FC63} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {75C9DD28-8F90-48EE-9642-0D7D657900D0} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {761DCDC9-986A-4CF0-1A1B-1FC83AD61A54} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {77D0CAA9-2F76-4100-E297-62EF23605A19} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {7830C992-5146-69D0-D5BD-11BC517F389D} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {78C212C4-954B-023D-92D8-709D423EBD81} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {799A1BA1-0570-3285-4BC3-440E3D064A23} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7B570B9D-B90C-24CE-5F11-0C1371F8CFE4} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7C5D649C-EC38-621E-F311-469474D4862F} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7D775338-F20A-429D-CB54-68894E9E6057} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7E2A144C-4D4F-020D-2BCF-5C993041E923} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7EC1EA2F-285D-4CC5-069A-61CA7087C236} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7EF9D4FD-CB1B-6932-1036-246F2B209ECC} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {7F83CE58-584D-2B34-9095-20CB62D86B4F} - http://69.50.188.54/1/gdnBE208.exe
O16 - DPF: {7FAAEA16-4A28-13BB-4566-769F4EFBE9A4} - http://82.179.166.72/1/gdnBE208.exe
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/be/games4.cab
O16 - DPF: {970BF476-3CF2-4572-9EF9-4479E1591DB8} - http://www.globalphon.com/dialer/belgio_ver3.CAB
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTic....cab?refid=4600
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhe...n7/dlhelper.cab
O21 - SSODL: Creative MediaSource - {56920927-AE5B-CE41-C75D-01F48143DD23} - c:\progra~1\common~1\instal~1\engine\6\intel3~1\wi nqjqta1.dll

overbodig:

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\nerocheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

Hartelijk dank alvast!

Logfile of HijackThis v1.99.1
Scan saved at 14:31:10, on 30/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\VTTimer.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\HjackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: {B5AB638F-D76C-415B-A8F2-F3CEAC502212} - - (no file)
F3 - REG:win.ini: load=C:\Program Files\KEVIN\kevin.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: DLHelperEXE.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E3E79AB-5E8D-4673-98CB-BF525D828A46}: NameServer = 195.238.2.21 195.238.2.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{0E3E79AB-5E8D-4673-98CB-BF525D828A46}: NameServer = 195.238.2.21 195.238.2.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{0E3E79AB-5E8D-4673-98CB-BF525D828A46}: NameServer = 195.238.2.21 195.238.2.22
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Reboot naar Safe Mode (F8 bij boot)

Fix in HJT:
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: {B5AB638F-D76C-415B-A8F2-F3CEAC502212} - - (no file)
F3 - REG:win.ini: load=C:\Program Files\KEVIN\kevin.exe
O4 - Startup: DLHelperEXE.exe
O9 - Extra button: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {5C87699E-11EB-45EC-AD34-4AB8F87B856F} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)

Unregister dll's (Start-->Run):
regsvr32 /u C:\WINDOWS\System32\intlmain.dll

Verwijder manueel:
C:\Program Files\KEVIN\
C:\Windows\System32\DLHelperEXE.exe of C:\Windows\DLHelperEXE.exe
C:\WINDOWS\System32\intlmain.dll

Reboot en post nieuwe log.