Mededeling

**BendeBoy** · 28-02-08, 01:55

Hi Wendy,

Welkom op Nucia

Download [url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe]ComboFix en sla het op je bureaublad op.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download ComboFix opnieuw.
Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Dubbelklik op Combofix.exe
Volg de instructies, aanvaard de disclaimer door 1 (continue) te typen, gevolgd door ENTER.
Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.
Plaats deze log in je volgende post, samen met een vers HijackThis logje.

- Daniël

**wendyvdl** · 28-02-08, 19:33

Ik heb combofix uitgevoerd. Hieronder volgt de log hiervan en daaronder een log van hijack this:

ComboFix 08-02-25.3 - Wendyvdl 2008-02-28 18:53:24.1 - NTFSx86
Gestart vanuit: C:\Documents and Settings\Wendyvdl\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Wendyvdl\Application Data\inst.exe
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\system32\fccyyya.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\orutv.ini
C:\WINDOWS\system32\orutv.ini2
C:\WINDOWS\system32\vturo.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\nm

(((((((((((((((((((( Bestanden Gemaakt van 2008-01-28 to 2008-02-28 ))))))))))))))))))))))))))))))
.

2008-02-27 20:39 . 2008-02-27 22:49 <DIR> dr-h----- C:\Documents and Settings\Wendyvdl\Onlangs geopend
2008-02-26 23:56 . 2008-02-26 23:56 268 --ah----- C:\sqmdata11.sqm
2008-02-26 23:56 . 2008-02-26 23:56 244 --ah----- C:\sqmnoopt11.sqm
2008-02-26 23:09 . 2008-02-26 23:13 388 --a------ C:\WINDOWS\wininit.ini
2008-02-26 22:00 . 2008-02-26 22:01 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-26 22:00 . 2008-02-26 23:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-26 21:17 . 2008-02-26 21:17 268 --ah----- C:\sqmdata10.sqm
2008-02-26 21:17 . 2008-02-26 21:17 244 --ah----- C:\sqmnoopt10.sqm
2008-02-26 20:40 . 2008-02-26 20:40 268 --ah----- C:\sqmdata09.sqm
2008-02-26 20:40 . 2008-02-26 20:40 244 --ah----- C:\sqmnoopt09.sqm
2008-02-26 19:54 . 2008-02-26 20:58 22 --a------ C:\WINDOWS\pskt.ini
2008-02-25 23:31 . 2008-02-25 23:31 244 --ah----- C:\sqmnoopt08.sqm
2008-02-25 23:31 . 2008-02-25 23:31 232 --ah----- C:\sqmdata08.sqm
2008-02-25 23:26 . 2008-02-25 23:26 244 --ah----- C:\sqmnoopt07.sqm
2008-02-25 23:26 . 2008-02-25 23:26 232 --ah----- C:\sqmdata07.sqm
2008-02-25 23:18 . 2008-02-25 23:18 268 --ah----- C:\sqmdata06.sqm
2008-02-25 23:18 . 2008-02-25 23:18 244 --ah----- C:\sqmnoopt06.sqm
2008-02-25 22:58 . 2008-02-25 22:58 268 --ah----- C:\sqmdata05.sqm
2008-02-25 22:58 . 2008-02-25 22:58 244 --ah----- C:\sqmnoopt05.sqm
2008-02-25 20:49 . 2008-02-26 21:06 68,429 --a------ C:\WINDOWS\BM67c97dbe.xml
2008-02-24 17:35 . 2008-02-24 17:35 <DIR> d-------- C:\Program Files\NewsBin
2008-02-24 17:21 . 2008-02-24 17:21 12,499 --a------ C:\WINDOWS\system32\Seagate.bin
2008-02-24 14:16 . 2008-02-24 14:16 <DIR> d-------- C:\Program Files\QuickPar
2008-02-24 13:05 . 2008-02-25 23:19 <DIR> d-------- C:\Documents and Settings\Wendyvdl\Application Data\NewsBin
2008-02-24 13:05 . 2008-02-24 13:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NewsBin
2008-02-23 18:30 . 2008-02-23 18:32 <DIR> d-------- C:\Program Files\FTDv3.8
2008-02-22 23:35 . 2008-02-22 23:35 <DIR> d-------- C:\Documents and Settings\Wendyvdl\Application Data\Eyeblaster
2008-02-20 20:35 . 2008-02-20 20:35 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-20 20:35 . 2008-02-20 20:35 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-18 21:11 . 2008-02-18 21:11 <DIR> d-------- C:\Documents and Settings\Wendyvdl\Application Data\Beep Industries
2008-02-10 23:46 . 2008-02-10 23:46 268 --ah----- C:\sqmdata04.sqm
2008-02-10 23:46 . 2008-02-10 23:46 244 --ah----- C:\sqmnoopt04.sqm
2008-02-10 20:27 . 2008-02-10 20:27 <DIR> d-------- C:\Documents and Settings\Wendyvdl\Application Data\LEAPS
2008-02-10 19:43 . 2008-02-10 19:43 <DIR> d-------- C:\Documents and Settings\Wendyvdl\Application Data\Pegasys Inc
2008-02-10 19:40 . 2008-02-10 19:40 268 --ah----- C:\sqmdata03.sqm
2008-02-10 19:40 . 2008-02-10 19:40 244 --ah----- C:\sqmnoopt03.sqm
2008-02-10 19:39 . 2008-02-10 19:35 33,408 --a------ C:\WINDOWS\system32\drivers\CDRBSDRV.SYS
2008-02-10 19:38 . 2008-02-10 19:35 145,504 --a------ C:\WINDOWS\system32\bgsvcgen.exe
2008-02-10 19:38 . 2008-02-10 19:35 59,488 --a------ C:\WINDOWS\system32\GenSvcInst.exe
2008-02-10 18:12 . 2008-02-10 19:36 <DIR> d-------- C:\Program Files\Pegasys Inc
2008-02-10 00:15 . 2008-02-10 00:15 244 --ah----- C:\sqmnoopt02.sqm
2008-02-10 00:15 . 2008-02-10 00:15 232 --ah----- C:\sqmdata02.sqm
2008-02-09 23:33 . 2008-02-09 23:33 268 --ah----- C:\sqmdata01.sqm
2008-02-09 23:33 . 2008-02-09 23:33 244 --ah----- C:\sqmnoopt01.sqm
2008-02-09 21:38 . 2008-02-09 21:38 244 --ah----- C:\sqmnoopt00.sqm
2008-02-09 21:38 . 2008-02-09 21:38 232 --ah----- C:\sqmdata00.sqm
2008-02-07 16:54 . 2008-02-07 17:33 67 --a------ C:\WINDOWS\Easy Avi Divx Xvid to DVD Burner.INI
2008-02-06 19:53 . 2008-02-06 19:53 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-02-04 05:23 . 2008-02-04 05:12 292,848 --a------ C:\WINDOWS\system32\CCTVKooPlayer.ocx
2008-02-01 11:17 . 2008-02-01 11:17 587,264 --a------ C:\WINDOWS\WLXPGSS.SCR

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 18:09 --------- d-----w C:\Documents and Settings\Wendyvdl\Application Data\DNA
2008-02-28 17:32 --------- d-----w C:\Program Files\Windows Live
2008-02-26 20:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-18 22:44 --------- d-----w C:\Program Files\Zylom Games
2008-02-18 20:10 --------- d-----w C:\Documents and Settings\Wendyvdl\Application Data\Zylom
2008-02-15 21:57 --------- d-----w C:\Documents and Settings\Wendyvdl\Application Data\BitTorrent
2008-02-14 20:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-10 18:34 --------- d-----w C:\Documents and Settings\Wendyvdl\Application Data\AVG7
2008-02-10 17:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-09 22:21 47,360 ----a-w C:\Documents and Settings\Wendyvdl\Application Data\pcouffin.sys
2008-02-07 21:04 --------- d-----w C:\Program Files\TVUPlayer
2008-02-07 19:23 --------- d-----w C:\Documents and Settings\Wendyvdl\Application Data\dvdcss
2008-02-07 17:03 --------- d-----w C:\Documents and Settings\Wendyvdl\Application Data\Ahead
2008-02-07 17:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-02-06 19:24 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-02-06 16:41 --------- d--h--w C:\Documents and Settings\Wendyvdl\Application Data\Move Networks
2008-02-04 22:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\JollyBear
2008-01-30 18:51 --------- d-----w C:\Program Files\SopCast
2008-01-29 20:54 --------- d-----w C:\Program Files\Google
2008-01-29 14:49 --------- d-----w C:\Program Files\Common Files\Real
2008-01-27 21:45 --------- d-----w C:\Program Files\DivX
2008-01-22 14:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\TVU networks
2008-01-14 21:35 --------- d-----w C:\Program Files\DNA
2008-01-14 15:51 --------- d-----w C:\Documents and Settings\Wendyvdl\Application Data\TVU Networks
2008-01-14 15:48 --------- d-----w C:\Program Files\TVAnts
2008-01-10 18:58 --------- d-----w C:\Program Files\Common Files\Synacast
2008-01-10 16:48 --------- d-----w C:\Program Files\LimeWire
2007-09-29 18:46 1,462 ----a-w C:\Documents and Settings\Wendyvdl\Application Data\filterclsid.dat
2007-08-04 15:48 244 ----a-w C:\Documents and Settings\Wendyvdl\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 12:49 153136]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-01-14 22:35 290112]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-22 21:15 344064]
"SoundMan"="SOUNDMAN.EXE" [2005-08-01 07:28 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SMSERIAL"="sm56hlpr.exe" [2005-07-06 03:47 544768 C:\WINDOWS\sm56hlpr.exe]
"PowerManager"="C:\Program Files\Power Manager\PM.exe" [2005-08-19 09:11 163840]
"OdTray.exe"="C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe" [2005-05-18 14:14 1015871]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-23 13:59 579072]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"BM67c97dbe"="C:\WINDOWS\system32\pdgtldxt.dll" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-23 14:00 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OdysseyClient]
odyEvent.dll 2006-07-04 20:17 106496 C:\WINDOWS\system32\odyEvent.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Bluetooth Manager.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Bluetooth Manager.lnk
backup=C:\WINDOWS\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Wendyvdl^Menu Start^Programma's^Opstarten^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\Wendyvdl\Menu Start\Programma's\Opstarten\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
--a------ 2007-09-08 00:01 43008 C:\Program Files\BitTorrent\bittorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
--a------ 2002-12-02 20:56 40960 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWS myPrintMileage Agent]
--a------ 2004-12-01 14:08 102400 C:\Program Files\Hewlett-Packard\HP Deskjet 1280\Toolbox\mpm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-09 17:53 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-07-13 19:50 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 00:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\sopvod.exe"=
"C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"C:\\Program Files\\TVAnts\\Tvants.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Documents and Settings\\Wendyvdl\\Mijn documenten\\tv players\\viviplay.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:server low id
"4672:UDP"= 4672:UDP:kademlia

R3 EKBfltr;ENE Keyboard Controller;C:\WINDOWS\system32\DRIVERS\EKBfltr.sys [2005-08-01 07:29]
R3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys [2005-05-18 12:52]
S3 ZD1211U(Sitecom);Sitecom Wireless Network USB Adapter 54G WL-113(Sitecom);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-07-05 22:38]

.
Inhoud van de 'Gedeelde Taken' map
"2008-02-28 17:29:29 C:\WINDOWS\Tasks\Controleren op updates voor Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-28 19:12:36
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\system32\Ati2evxx.exe
.
**************************************************************************
.
Voltooingstijd: 2008-02-28 19:18:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-28 18:18:17
.
2008-02-28 17:34:27 --- E O F ---

En hier mijn HijackThis logfile:

Logfile of HijackThis v1.99.1
Scan saved at 19:27:44, on 28-2-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Power Manager\PM.exe
C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Wendyvdl\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.nl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.ubvu.vu.nl/ubvu/pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0F584FEA-281C-40F6-8D31-A1D083CEB950} - (no file)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: (no name) - {522443ED-6F9E-4528-B006-6B91AC1D4C1F} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8A7F5D4B-C506-49F7-B2E5-8BC34470384D} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [BM67c97dbe] Rundll32.exe "C:\WINDOWS\system32\pdgtldxt.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.78\AMVConverter\grab.html
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.78\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by110w.bay110.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: fccyyya - C:\WINDOWS\
O20 - Winlogon Notify: OdysseyClient - C:\WINDOWS\SYSTEM32\odyEvent.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Odyssey Client for Fujitsu Siemens Computers (odClientService) - Funk Software, Inc. - C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe

Groetjes,
Wendy

Mededeling

pop-ups van o.a. zedo en tabbladen worden automatisch geopend

pop-ups van o.a. zedo en tabbladen worden automatisch geopend

Comment

Comment