Archief - logfile van collega

 Logfile of HijackThis v1.99.1
Scan saved at 21:17:55, on 28/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
E:\quicktime\qttask.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
E:\MULTIM~1\MMKBD.exe
L:\Kazaa Lite K++\Kazaa.kpp
C:\WINDOWS\TPPALDR.EXE
E:\HP scanner\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
L:\winamp\winampa.exe
C:\WINDOWS\epswad3.exe
D:\Psion\PsiWin\Psconsv.exe
C:\Program Files\Outlook Express\msimn.exe
D:\Skype\Phone\Skype.exe
G:\fanspeet\speedfan.exe
E:\HP scanner\HP Share-to-Web\hpgs2wnf.exe
d:\Psion\PsiWin\Elogerr.exe
C:\Program Files\Internet Explorer\iexplore.exe
G:\SOFT\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://www.google.be/"]http://www.google.be/[/url]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = [url="http://proxy.pandora.be:8080"]http://proxy.pandora.be:8080[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 69.50.166.11 [url="http://www.google.com"]www.google.com[/url]
O1 - Hosts: 69.50.166.11 google.com
O1 - Hosts: 69.50.166.11 [url="http://www.google.co.uk"]www.google.co.uk[/url]
O1 - Hosts: 69.50.166.11 google.co.uk
O1 - Hosts: 69.50.166.11 [url="http://www.google.ca"]www.google.ca[/url]
O1 - Hosts: 69.50.166.11 google.ca
O1 - Hosts: 69.50.166.11 [url="http://www.google.es"]www.google.es[/url]
O1 - Hosts: 69.50.166.11 google.es
O1 - Hosts: 69.50.166.11 [url="http://www.google.de"]www.google.de[/url]
O1 - Hosts: 69.50.166.11 google.de
O1 - Hosts: 69.50.166.11 [url="http://www.google.fr"]www.google.fr[/url]
O1 - Hosts: 69.50.166.11 google.fr
O1 - Hosts: 69.50.166.11 [url="http://www.google.com.au"]www.google.com.au[/url]
O1 - Hosts: 69.50.166.11 google.com.au
O1 - Hosts: 69.50.166.14 [url="http://www.yahoo.com"]www.yahoo.com[/url]
O1 - Hosts: 69.50.166.14 yahoo.com
O1 - Hosts: 66.218.75.184 mail.yahoo.com
O1 - Hosts: 69.50.166.12 [url="http://www.msn.com"]www.msn.com[/url]
O1 - Hosts: 69.50.166.12 msn.com
O1 - Hosts: 69.50.166.12 search.msn.com
O1 - Hosts: 69.50.166.12 [url="http://www.go.com"]www.go.com[/url]
O1 - Hosts: 69.50.166.12 go.com
O1 - Hosts: 69.50.166.13 astalavista.com
O1 - Hosts: 69.50.166.13 [url="http://www.astalavista.com"]www.astalavista.com[/url]
O1 - Hosts: 69.50.166.13 astalavista.box.sk
O1 - Hosts: 69.50.166.13 cracks.am
O1 - Hosts: 69.50.166.13 [url="http://www.cracks.am"]www.cracks.am[/url]
O2 - BHO: System - {D1C8F9CE-563E-11D8-813C-005022E14DE2} - C:\PROGRA~1\LOOKNM~1\AddAPI.dll
O4 - HKLM\..\Run: [QuickTime Task] "E:\quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [KAZAA] "L:\Kazaa Lite K++\kpp.exe" "L:\Kazaa Lite K++\Kazaa.kpp" /SYSTRAY
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] L:\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [AudioHQU] L:\Creative\SBLive\AudioHQ\AHQTbU.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Multimedir KBD] e:\MULTIM~1\MMKBD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] E:\HP scanner\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] E:\corel draw 12 swite\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=071205 serial=DR12WTX-9999998-YSP lang=EN
O4 - HKLM\..\Run: [WinampAgent] L:\winamp\winampa.exe
O4 - HKLM\..\Run: [AdPopup] C:\WINDOWS\epswad3.exe
O4 - HKCU\..\Run: [NvCplScan] nvsc32.exe
O4 - HKCU\..\Run: [Skype] "d:\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: MMKbd.exe.lnk = D:\Multimedia Hotkey Program\MMKbd.exe
O4 - Startup: Outlook Express.lnk = C:\Program Files\Outlook Express\msimn.exe
O4 - Startup: Skype.lnk = D:\Skype\Phone\Skype.exe
O4 - Startup: speedfan.lnk = G:\fanspeet\speedfan.exe
O4 - Startup: TCLOCKEX.EXE.lnk = D:\TClockEx\TCLOCKEX.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: PsiWin 2.3 Connection Server.lnk = D:\Psion\PsiWin\Psconsv.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - F:\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - dapextie.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: LookNMeet - {5D602A21-B929-11d7-A5D3-005022E14DE3} - [url="http://www.looknmeet.be/"]http://www.looknmeet.be/[/url] (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com
O16 - DPF: {00000000-0000-0000-0000-000020040000} - [url="http://207.234.185.217/ABoxInst_int9.exe"]http://207.234.185.217/ABoxInst_int9.exe[/url]
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - [url="http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1020_EN_XP.cab"]http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1020_EN_XP.cab[/url]
O16 - DPF: {18D9C485-7EEC-4395-95DA-DC3875B10E81} (TEInstallPlugIn) - [url="http://www.skylinesoft.com/interactive/terraexplorer/install/TEInstallPlugIn.cab"]http://www.skylinesoft.com/interactive/terraexplorer/install/TEInstallPlugIn.cab[/url]
O16 - DPF: {2ABE804B-4D3A-41BF-A172-304627874B45} - [url="http://akamai.downloadv3.com/binaries/DialHTML/EGDHTML_1027_XP.cab"]http://akamai.downloadv3.com/binaries/DialHTML/EGDHTML_1027_XP.cab[/url]
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - [url="http://akamai.downloadv3.com/binaries/IA/nethv32_EN_XP.cab"]http://akamai.downloadv3.com/binaries/IA/nethv32_EN_XP.cab[/url]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [url="http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab"]http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab[/url]
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - [url="http://toolbar.google.com/data/nl/big/1.1.62-big/GoogleNav.cab"]http://toolbar.google.com/data/nl/big/1.1.62-big/GoogleNav.cab[/url]
O16 - DPF: {94F5DCB7-816C-4B94-A2C1-856C6E323C5B} - [url="http://akamai.downloadv3.com/binaries/LiveService/LiveService_4_EN_XP.cab"]http://akamai.downloadv3.com/binaries/LiveService/LiveService_4_EN_XP.cab[/url]
O16 - DPF: {B467A3AF-E45B-4B1B-9983-C035D988FB0F} - [url="http://66.194.38.28/dialer/belgio_ver10.CAB"]http://66.194.38.28/dialer/belgio_ver10.CAB[/url]
O16 - DPF: {C9A703E2-3145-11D8-813C-005022E14DE2} (Installer Class) - [url="http://www.looknmeet.be:8080/lnm_v4/agent/LNMAgentInstaller.cab"]http://www.looknmeet.be:8080/lnm_v4/agent/LNMAgentInstaller.cab[/url]
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - [url="http://www.photodex.com/pxplay.cab"]http://www.photodex.com/pxplay.cab[/url]
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} - [url="http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_pack_XP.cab"]http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_pack_XP.cab[/url]
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} (CParamWr Class) - 
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe