Vraag & Antwoord

Beveiliging & privacy

Hijack Log, krijg meldingen van....

14 antwoorden
  • Ik krijg meldingen van "zogenaamde" anti-spyware dat ik last heb van spyware, vervolgens wordt het mij belet gebruik te maken van mijn internetverbindingen, ook is er zo'n irritante search bar geinstaleerd. Wie kan mij helpen.... Dit is mijn Hijack-log: Logfile of HijackThis v1.98.2 Scan saved at 0:16:54, on 27-3-2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\XPsys.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\ALGU.EXE C:\WINDOWS\System32\SPOOLSV32.EXE C:\WINDOWS\25796.exe C:\Documents and Settings\Jack\Mijn documenten\Mijn Downloads\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php O1 - Hosts: auto.search.msn.com 127.0.0.1 O2 - BHO: ATDP Class - {E3D3AFEE-2172-4ef5-8509-1638AFFF0374} - C:\WINDOWS\atlass.dll O3 - Toolbar: SToolbar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\stlbd.dll O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ALGU] C:\WINDOWS\System32\ALGU.EXE O4 - HKCU\..\Run: [SPOOLSV32] C:\WINDOWS\System32\SPOOLSV32.EXE O4 - HKCU\..\Run: [SVCHOST] C:\WINDOWS\System32\7.exe O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Microsoft AntiSpyware helper - {2A895427-6C8E-46FB-B987-940B9E64F9A1} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2A895427-6C8E-46FB-B987-940B9E64F9A1} - (no file) (HKCU) O13 - DefaultPrefix: http://106.nowfind.net/gall.php?url= O13 - WWW Prefix: http://106.nowfind.net/gall.php?url= O13 - Home Prefix: http://106.nowfind.net/gall.php?url= O13 - Mosaic Prefix: http://106.nowfind.net/gall.php?url= O15 - Trusted Zone: *.frame.crazywinnings.com O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab O16 - DPF: {018A066F-584A-422F-AC4C-0B1F5FE5C040} (VacPro.olanda_ver3) - http://advnt01.com/dialer/olanda_ver3.CAB O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} - O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E252E6E-A7BA-4E08-A813-0A3D5D87CD46}: NameServer = 62.251.0.6 62.251.0.7
  • Logfile of HijackThis v1.98.2 eerst even nog je hjt updaten. we zijn al bij 1.99.1
  • Zegt dit je iets: Eclickz.dll - eClickz toolbar, Ik vond dit in verband met ALGU.EXE, atlass.dll en waarschijnlijk ook 25796.exe: http://webhelper4u.com/CWS/CWSdropper_exe.html en die nowfind.net hijack lijkt wel een beetje op het volgende: http://www.techsupportforum.com/computer/topic/43577-1.html
  • Er zit van alles in dit log. Zoals al is gezegd, de laatste versie van hijackthis is V1.99.1 dus eerst even updaten. Start Hijackthis en klik op 'Open the Misc Tool section' Sleep dan de schuifbalk een stukje naar beneden en klik op 'Check for update online' Deïnstalleer Security iGuard. Start-> Configuratiescherm-> Software. selecteer "Security iGuard" en verwijderd deze. Copieer de onderstaande code en plak dat in Notepad: [code:1:7ee3cb92fc] REGEDIT4 [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\frame.crazywinnings.com] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\frame.crazywinnings.com] "*"=dword:00000004[/code:1:7ee3cb92fc] Sla het op het bureaublad als [b:7ee3cb92fc]fix.reg[/b:7ee3cb92fc] Opslaan als type: [b:7ee3cb92fc]Alle bestanden[/b:7ee3cb92fc] Gebruik het nog niet. Print onderstaande instructie uit, want de opschoning gaat in VEILIGE mode worden uitgevoerd. Kijk [url=http://users.pandora.be/marcvn/spyware/1378056.htm]hier[/url] hoe dat moet. In veilige mode start je hijackthis en selecteer de volgende items: [b:7ee3cb92fc] R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php O1 - Hosts: auto.search.msn.com 127.0.0.1 O2 - BHO: ATDP Class - {E3D3AFEE-2172-4ef5-8509-1638AFFF0374} - C:\WINDOWS\atlass.dll O3 - Toolbar: SToolbar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\stlbd.dll O4 - HKCU\..\Run: [ALGU] C:\WINDOWS\System32\ALGU.EXE O4 - HKCU\..\Run: [SPOOLSV32] C:\WINDOWS\System32\SPOOLSV32.EXE O4 - HKCU\..\Run: [SVCHOST] C:\WINDOWS\System32\7.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) O9 - Extra button: Microsoft AntiSpyware helper - {2A895427-6C8E-46FB-B987-940B9E64F9A1} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2A895427-6C8E-46FB-B987-940B9E64F9A1} - (no file) (HKCU) O13 - DefaultPrefix: http://106.nowfind.net/gall.php?url= O13 - WWW Prefix: http://106.nowfind.net/gall.php?url= O13 - Home Prefix: http://106.nowfind.net/gall.php?url= O13 - Mosaic Prefix: http://106.nowfind.net/gall.php?url= O16 - DPF: {018A066F-584A-422F-AC4C-0B1F5FE5C040} (VacPro.olanda_ver3) - http://advnt01.com/dialer/olanda_ver3.CAB O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -[/b:7ee3cb92fc] Sluit alle vensters behalve Hijackthis Klik op 'Fix checked' om de items te verwijderen Maak opnieuw een scan om te controleren dat alle hierbovengenoemde items zijn verdwenen. Dubbelklik op het bestand fix.reg en laat het aan het register toevoegen. Zorg dat de [url=http://users.pandora.be/marcvn/spyware/1117602.htm]besturingssysteembestanden en verborgen bestanden zichtbaar zijn[/url] De volgende bestanden verwijderen: C:\WINDOWS\atlass.dll C:\WINDOWS\stlbd.dll C:\WINDOWS\System32\ALGU.EXE C:\WINDOWS\System32\SPOOLSV32.EXE C:\WINDOWS\System32\7.exe C:\WINDOWS\XPsys.exe C:\WINDOWS\25796.exe Maak de Temp-map leeg: Start -> Uitvoeren tik in: %TEMP% Selecteer alle bestanden en verwijder ze. Herstart de PC in normale mode, maak een log en post deze. Sjaak
  • Ik ben er aan bezig, de nieuwe log volgt zo....
  • Ondanks bovengenoemde acties blijven de regels met "106 nowfind..." terug komen en worden porn-dialers geinstaleerd... Bijgaand mijn laatste log: Logfile of HijackThis v1.99.1 Scan saved at 16:47:28, on 27-3-2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\yahoo.exe C:\WINDOWS\yahoo.exe C:\WINDOWS\yahoo.exe C:\WINDOWS\yahoo.exe C:\WINDOWS\yahoo.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\WebSiteViewer\126081.dlr C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Jack\Mijn documenten\Mijn Downloads\Hijackthis\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php O1 - Hosts: auto.search.msn.com 127.0.0.1 O2 - BHO: (no name) - {0F9561D0-03B2-44a3-89A6-E95E417CBA25} - C:\WINDOWS\cerbmod.dll O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O13 - DefaultPrefix: http://106.nowfind.net/gall.php?url= O13 - WWW Prefix: http://106.nowfind.net/gall.php?url= O13 - Home Prefix: http://106.nowfind.net/gall.php?url= O13 - Mosaic Prefix: http://106.nowfind.net/gall.php?url= O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E252E6E-A7BA-4E08-A813-0A3D5D87CD46}: NameServer = 62.251.0.6 62.251.0.7 O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  • Jack, Waar is je anti-virus software? Maak eerst nog maar een online virusscan [url=http://www.bitdefender.com/scan/licence.php]Bitdefender scan[/url] of [url=http://housecall.trendmicro.com/housecall/start_corp.asp]Housecall[/url] of [url=http://www.pandasoftware.com/activescan/]Panda[/url] Sjaak
  • Moet deze ook gefixt worden? O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
  • [quote:29d50fc5c1="smeenk"]Moet deze ook gefixt worden? O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)[/quote:29d50fc5c1] Die had al met het fix.reg bestandje weg moeten zijn. Het probleem van de popups wordt veroorzaakt door de bestanden in de volgende directory: C:\Program Files\WebSiteViewer\ Ik zie geen items in de startup. Vandaar dat er eerst maar een online scan moet worden uitgevoerd. Ook het programma Yahoo.exe lijkt mij niet OK. Sjaak
  • Voor het verwijderen van WebSiteViewer: Download en installeer [url=http://www.ccleaner.com/]CCleaner[/url] Nog niet gebruiken. Download [url=http://www.atribune.org/downloads/HSFix.zip]HSFix[/url] Unzip de bestanden in een directory bijv. C:\HSFix\ Start de PC in VEILIGE mode en start het programma HSFix.bat. Er wordt een log gemaakt C:\hslog.txt. Start Ccleaner en klik op Ccleaner opstarten (rechts onderaan) Reboot je pc terug normaal. Post de inhoud van dit log tesamen met een nieuw log van Hijackthis Sjaak
  • Bovenstaande post even aangepast. Sjaak
  • Bijgaand de 2 log files...... Helaas blijft het zich activeren. Horseserver Removal Tool v1.05 by Atri - - 1. Registry Fix Started - Registry fix complete - 2. Deleted Services - - 3. Finding files Located on system - WebSiteViewer - 4. Deleting files that were found. - - 5. Checking for and Removing Winupdate - - - Logfile of HijackThis v1.99.1 Scan saved at 18:49:22, on 27-3-2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\ibs0.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Jack\Mijn documenten\Mijn Downloads\Hijackthis\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php O1 - Hosts: auto.search.msn.com 127.0.0.1 O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O13 - DefaultPrefix: http://106.nowfind.net/gall.php?url= O13 - WWW Prefix: http://106.nowfind.net/gall.php?url= O13 - Home Prefix: http://106.nowfind.net/gall.php?url= O13 - Mosaic Prefix: http://106.nowfind.net/gall.php?url= O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E252E6E-A7BA-4E08-A813-0A3D5D87CD46}: NameServer = 62.251.0.6 62.251.0.7 O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  • Heb je al een online scan uitgevoerd? Sjaak
  • Had je deze ook al geprobeerd te verwijderen? Dit is een antispywareprogramma met een slechte reputatie! O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe

Beantwoord deze vraag

Weet jij het antwoord op deze vraag? Registreer of meld je aan met je account

Dit is een gearchiveerde pagina. Antwoorden is niet meer mogelijk.