Op deze website gebruiken we cookies om content en advertenties te personaliseren, om functies voor social media te bieden en om ons websiteverkeer te analyseren. Ook delen we informatie over uw gebruik van onze site met onze partners voor social media, adverteren en analyse. Deze partners kunnen deze gegevens combineren met andere informatie die u aan ze heeft verstrekt of die ze hebben verzameld op basis van uw gebruik van hun services. Meer informatie.

Akkoord

Vraag & Antwoord

Beveiliging & privacy

TR/Agent.aoy.1

kokohuyb
4 antwoorden
  • Hoi,

    Ik heb steeds last van TR/Agent.aoy.1

    Dit probleem stelt zich sinds ik aan de hand van een topic op dit forum het 'Vundo-probleem' heb opgelost gekregen. Blijkbaar kent 'het internet' de agent waar ik last van heb niet. Hebben jullie een oplossing voor het probleem? Wat willen jullie hebben aan gegevens? (hieronder staan er al enkele)

    [b:6423acaac8]Antivir[/b:6423acaac8] geeft aan:

    C:\WINDOWS\system32\uavvsdlq.exe
    Is the Trojan horse TR/Agent.aoy.1


    [b:6423acaac8]HijackThis-log:[/b:6423acaac8]

    Logfile of HijackThis v1.99.1
    Scan saved at 0:31:53, on 22/06/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\system32\uavvsdlq.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32
    vsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\Program Files\Webroot\Enterprise\CommAgent\CommAgent.exe
    C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeper.exe
    C:\Program Files\UltraVNC\winvnc.exe
    C:\WINDOWS\system32\wwSecure.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\Google Talk\googletalk.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Webroot\Washer\wwDisp.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Wacom\TabUserW.exe
    C:\Program Files\CoreFTP\coreftp.exe
    C:\Documents and Settings\Gebruiker\Local Settings\Temporary Internet Files\Content.IE5\88UP0MRC\cureit[1].exe
    C:\DOCUME~1\GEBRUI~1\LOCALS~1\Temp\RarSFX0\_start.exe
    C:\DOCUME~1\GEBRUI~1\LOCALS~1\Temp\RarSFX0\cureit.exe
    C:\koko\ht\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zita.be/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    R3 - Default URLSearchHook is missing
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
    O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
    O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gudie.spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1145094331406
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: bw+0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: offline-8876480 - {5F2E307D-8C50-4255-ABB7-FA0620609ACD} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN
    ipsvc.exe (file missing)
    O23 - Service: Norman NJeeves - Unknown owner - C:\VIRUSfighter\bin\NJEEVES.EXE (file missing)
    O23 - Service: Norman ZANDA - Unknown owner - C:\VIRUSfighter\Bin\Zanda.exe (file missing)
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Unknown owner - C:\VIRUSfighter\Nvc\bin
    vcoas.exe (file missing)
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\NVCSCHED.EXE (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
    vsvc32.exe
    O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
    O23 - Service: Webroot CommAgent Service (WebrootCommAgentService) - Webroot Software, Inc. - C:\Program Files\Webroot\Enterprise\CommAgent\CommAgent.exe
    O23 - Service: Webroot SpySweeper Service (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Enterprise\Spy Sweeper\SpySweeper.exe
    O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\winvnc.exe" -service (file missing)
    O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
  • Download reglooks.exe
    Plaats het op je bureaublad.
    Dubbelklik op reglooks.exe. Doe verder niets en wacht tot er een logfile opent. Post de inhoud van deze logfile.
  • REGLOOKS logfile

    version 0.971
    za 23/06/2007 20:38:20,84
    running from: "C:\PROGRA~1\MOZILL~2"

    — SSODL regkeys —

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
    only standard or legit regkeys found


    — STS regkeys —

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
    only standard or legit regkeys found


    — USERINIT regkey —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"


    — SHELL regkey —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    "Shell"="Explorer.exe"


    — SYSTEM regkey —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    "System"=""


    — APPINIT_DLLS regkey —

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
    "AppInit_DLLs"=""


    — NOTIFY regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
    only standard or legit regkeys found


    — RUN / LOAD regkeys —

    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
    "load"=""


    — BOOTEXECUTE regkey —

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
    BootExecute= autocheck autochk *\0\0


    — PENDINGFILERENAMEOPERATIONS regkey —

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
    Pendingfilerenameoperations= \??\C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic\Update\AVUPDATE_467c62bb\UPDENGVDFTEST\0\0\0


    — SHELLEXECUTEHOOKS regkey —

    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
    "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"


    — AUTORUN regkeys —

    HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
    "AutoRun"=""


    — HKLM\Run regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "PCMCIA Resource Monitor"="nvp2pmon.exe"
    "AGRSMMSG"="AGRSMMSG.exe"
    "LManager"="C:\\PROGRA~1\\LAUNCH~1\\QtZiAcer.EXE"
    "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
    "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
    "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
    "SoundMan"="SOUNDMAN.EXE"
    "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
    "SSBkgdUpdate"="C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe -Embedding -boot"
    "ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
    "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
    "BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
    "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
    "RegistryMechanic"=""


    — HKLM\RunOnce regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
    no HKLM RunOnce keys found


    — HKLM\RunOnceEx regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
    no HKLM RunOnceEx keys found


    — HKLM\RunServices regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    regkey does not exist


    — HKLM\RunServicesOnce regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
    regkey does not exist


    — HKCU\Run regkeys —

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "ISPMonitor"="C:\\Program Files\\ISP Monitor\\isp.exe"
    "SIDEBAR"="\"C:\\Program Files\\Desktop Sidebar\\dsidebar.exe\""
    "Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
    "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
    "LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
    "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
    "WhenUSave"="\"C:\\Program Files\\Save\\Save.exe\""
    "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"
    "Active Desktop Calendar"="C:\\Program Files\\XemiComputers\\Active Desktop Calendar\\ADC.exe"
    "MMAgent"="C:\\Program Files\\Mobile Master\\MMAgent.exe"


    — HKCU\RunOnce regkeys —

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
    "FFTI"="C:\\Documents and Settings\\koko\\Application Data\\Mozilla\\Firefox\\Profiles\\3qtnbykf.default\\extensions\\{B13721C7-F507-4982-B2E5-502A71474FED}\\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath=\"C:\\Documents and Settings\\koko\\Application Data\\Mozilla\\Firefox\\Profiles/3qtnbykf.default\\extensions\\{B13721C7-F507-4982-B2E5-502A71474FED}\""


    — HKCU\RunOnceEx regkeys —

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
    regkey does not exist


    — HKCU\RunServices regkeys —

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    regkey does not exist


    — HKCU\RunServicesOnce regkeys —

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
    regkey does not exist


    — HKU\.DEFAULT\Run regkeys —

    HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"


    — HKU\S-1-5-18\Run regkeys —

    HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"


    — HKU\S-1-5-19\Run regkeys —

    HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"


    — HKU\S-1-5-20\Run regkeys —

    HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"


    — HKLM\Explorer\Run regkeys —

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
    regkey does not exist


    — HKCU\Explorer\Run regkeys —

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
    regkey does not exist


    — Image File Execution regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
    no debuggers found


    — BROWSER HELPER OBJECTS regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    "{00C6482D-C502-44C8-8409-FCE54AD9C208}" FILE ="C:\\Program Files\\TechSmith\\SnagIt 8\\SnagItBHO.dll"
    "{45AD732C-2CE2-4666-B366-B2214AD57A49}" FILE ="C:\\Program Files\\Desktop Sidebar\\sbhelp.dll"
    "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" FILE ="C:\\PROGRA~1\\MICROS~3\\Office12\\GRA8E1~1.DLL"
    "{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" FILE ="C:\\Program Files\\Java\\jre1.6.0_01\\bin\\ssv.dll"
    "{7E853D72-626A-48EC-A868-BA8D5E23E045}" regkey not found (ERROR)
    "{9030D464-4C02-4ABF-8ECC-5164760863C6}" FILE ="C:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WindowsLiveLogin.dll"


    — TOOLBAR regkeys —

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
    "{95188727-288F-4581-A48D-EAB3BD027314}" FILE ="C:\\PROGRA~1\\Zend\\ZENDST~1.0\\bin\\ZENDIE~1.DLL"
    "{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}" FILE ="C:\\Program Files\\TechSmith\\SnagIt 8\\SnagItIEAddin.dll"


    — URLSEARCHHOOKS regkeys —

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks
    only standard regkeys found


    — SRCEENSAVER regkey —

    HKEY_CURRENT_USER\Control Panel\Desktop
    "SCRNSAVE.EXE"="C:\\WINDOWS\\UD.SCR"


    — CONTEXTMENUHANDLERS regkeys —

    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers
    "7-Zip" CLSID ={23170F69-40C1-278A-1000-000100020000} FILE ="C:\\Program Files\\7-Zip\\7-zip.dll"
    "EngInSiteRemoteAgent" CLSID ={90F5DB19-D9FC-4260-835F-60EDF278AE4E} FILE ="C:\\PROGRA~1\\LUCKAS~1\\ENGINS~1\\contmenu.dll"
    "MyPhoneExplorer" CLSID ={2D30AAA2-9084-4686-B8B9-B9B62EEFFD4E} FILE ="C:\\Program Files\\MyPhoneExplorer\\DLL\\ShellMgr.dll"
    "Offline Files" CLSID ={750fdf0e-2a26-11d1-a3ea-080036587f03} FILE =%SystemRoot%\System32\cscui.dll
    "Open With" CLSID ={09799AFB-AD67-11d1-ABCD-00C04FC30936} FILE =%SystemRoot%\system32\SHELL32.dll
    "Open With EncryptionMenu" CLSID ={A470F8CF-A1E8-4f65-8335-227475AA5C46} FILE =%SystemRoot%\system32\SHELL32.dll
    "Shell Extension for Malware scanning" CLSID ={45AC2688-0253-4ED8-97DE-B5370FA7D48A} FILE ="C:\\Program Files\\AntiVir PersonalEdition Classic\\shlext.dll"
    "SnagItMainShellExt" CLSID ={CF74B903-3389-469c-B3B6-0204D204FCBD} FILE ="C:\\Program Files\\TechSmith\\SnagIt 8\\SnagItShellExt.dll"
    "tosBtShllExt" CLSID ={6BEF3D0B-53F0-4b0d-B91C-C19ED3D4C9D1} FILE ="C:\\WINDOWS\\system32\\TosBtShell.dll"
    "Washer" CLSID ={6EE51AA0-77A0-11D7-B4E1-000347126E46} FILE ="C:\\PROGRA~1\\COMMON~1\\WEBROO~1\\SHELLW~1.DLL"
    "XXX Groove GFS Context Menu Handler XXX" CLSID ={6C467336-8281-4E60-8204-430CED96822D} FILE ="C:\\PROGRA~1\\MICROS~3\\Office12\\GRA8E1~1.DLL"
    "{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}" Start Menu Pin FILE =%SystemRoot%\system32\SHELL32.dll

    HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers
    "7-Zip" CLSID ={23170F69-40C1-278A-1000-000100020000} FILE ="C:\\Program Files\\7-Zip\\7-zip.dll"
    "EncryptionMenu" CLSID ={A470F8CF-A1E8-4f65-8335-227475AA5C46} FILE =%SystemRoot%\system32\SHELL32.dll
    "Offline Files" CLSID ={750fdf0e-2a26-11d1-a3ea-080036587f03} FILE =%SystemRoot%\System32\cscui.dll
    "Sharing" CLSID ={f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} FILE ="ntshrui.dll"
    "SnagItMainShellExt" CLSID ={CF74B903-3389-469c-B3B6-0204D204FCBD} FILE ="C:\\Program Files\\TechSmith\\SnagIt 8\\SnagItShellExt.dll"
    "tosBtShllExt" CLSID ={6BEF3D0B-53F0-4b0d-B91C-C19ED3D4C9D1} FILE ="C:\\WINDOWS\\system32\\TosBtShell.dll"
    "Washer" CLSID ={6EE51AA0-77A0-11D7-B4E1-000347126E46} FILE ="C:\\PROGRA~1\\COMMON~1\\WEBROO~1\\SHELLW~1.DLL"
    "XXX Groove GFS Context Menu Handler XXX" CLSID ={6C467336-8281-4E60-8204-430CED96822D} FILE ="C:\\PROGRA~1\\MICROS~3\\Office12\\GRA8E1~1.DLL"

    HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers
    "EngInSiteRemoteAgent" CLSID ={90F5DB19-D9FC-4260-835F-60EDF278AE4E} FILE ="C:\\PROGRA~1\\LUCKAS~1\\ENGINS~1\\contmenu.dll"
    "Shell Extension for Malware scanning" CLSID ={45AC2688-0253-4ED8-97DE-B5370FA7D48A} FILE ="C:\\Program Files\\AntiVir PersonalEdition Classic\\shlext.dll"
    "XXX Groove GFS Context Menu Handler XXX" CLSID ={6C467336-8281-4E60-8204-430CED96822D} FILE ="C:\\PROGRA~1\\MICROS~3\\Office12\\GRA8E1~1.DLL"


    — ALTERNATESHELL regkey —

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
    "AlternateShell"="cmd.exe"


    — SAFEBOOT MINIMAL SERVICES —

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
    no unknown services found


    — SAFEBOOT NETWORK SERVICES —

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
    nm
    nm.sys


    — SERVICES —

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Adobe LM Service
    "DisplayName"="Adobe LM Service"
    "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALCXSENS
    "DisplayName"="Service for WDM 3D Audio Driver"
    system32\drivers\ALCXSENS.SYS

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALCXWDM
    "DisplayName"="Service for Realtek AC97 Audio (WDM)"
    system32\drivers\ALCXWDM.SYS

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AntiVirScheduler
    "DisplayName"="AntiVir PersonalEdition Classic Scheduler"
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AntiVirService
    "DisplayName"="AntiVir PersonalEdition Classic Guard"
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avgntdd
    "DisplayName"="avgntdd"
    SYSTEM32\DRIVERS\avgntdd.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avgntmgr
    "DisplayName"="avgntmgr"
    SYSTEM32\drivers\avgntmgr.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b57w2k
    "DisplayName"="Broadcom NetXtreme Gigabit Ethernet"
    System32\DRIVERS\b57xp32.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT
    "DisplayName"="Poortstuurprogramma voor Bluetooth"
    System32\Drivers\BTHport.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BthServ
    "DisplayName"="Bluetooth Support Service"
    %SystemRoot%\system32\svchost.exe -k bthsvcs

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHUSB
    "DisplayName"="USB-stuurprogramma voor Bluetooth-radio's"
    System32\Drivers\BTHUSB.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTWUSB
    "DisplayName"="WIDCOMM USB Bluetooth Driver"
    System32\Drivers\btwusb.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CCDECODE
    "DisplayName"="Closed Caption-decoder"
    system32\DRIVERS\CCDECODE.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DKbFltr
    "DisplayName"="Dritek HotKey Keyboard Filter Driver"
    System32\Drivers\DKbFltr.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidUsb
    "DisplayName"="Microsoft HID Class-stuurprogramma"
    System32\DRIVERS\hidusb.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IDriverT
    "DisplayName"="InstallDriver Table Manager"
    "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iPod Service
    "DisplayName"="iPod-service"
    "C:\Program Files\iPod\bin\iPodService.exe"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ISPMonitorSrv
    "DisplayName"="ISP Monitor"
    C:\Program Files\ISP Monitor\ISPMonitorSrv.exe

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid
    "DisplayName"="Stuurprogramma voor toetsenbord-HID"
    System32\DRIVERS\kbdhid.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LHidKe
    "DisplayName"="Logitech SetPoint HID Mouse Filter Driver"
    system32\DRIVERS\LHidKE.Sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LHidUsbK
    "DisplayName"="Logitech SetPoint USB Receiver device driver"
    System32\Drivers\LHidUsbK.Sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LMouKE
    "DisplayName"="Logitech SetPoint Mouse Filter Driver"
    system32\DRIVERS\LMouKE.Sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Microsoft Office Groove Audit Service
    "DisplayName"="Microsoft Office Groove Audit Service"
    "C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid
    "DisplayName"="Stuurprogramma voor muis-HID"
    System32\DRIVERS\mouhid.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIRCOMM
    "DisplayName"="Microsoft IR Communications Driver"
    system32\DRIVERS\MSIRCOMM.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTEE
    "DisplayName"="Microsoft Streaming Tee/Sink-to-Sink-conversieprogramma"
    system32\drivers\MSTEE.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NABTSFEC
    "DisplayName"="NABTS/FEC VBI Codec"
    system32\DRIVERS\NABTSFEC.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NBService
    "DisplayName"="NBService"
    C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    m
    "DisplayName"="Stuurprogramma voor Netwerkcontrole"
    system32\DRIVERS\NMnt.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPPTNT2
    "DisplayName"="NPPTNT2"
    \??\C:\WINDOWS\system32
    pptNT2.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NSNDIS5
    "DisplayName"="NSNDIS5 NDIS Protocol Driver"
    \??\C:\WINDOWS\system32\NSNDIS5.SYS

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\odserv
    "DisplayName"="Microsoft Office Diagnostics Service"
    "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PASCO
    "DisplayName"="PASCO PASPORT USB Driver (PSSensor.sys)"
    System32\Drivers\PSSensor.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PenClass
    "DisplayName"="Pen Class"
    system32\Drivers\PenClass.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ROOTMODEM
    "DisplayName"="Microsoft Legacy Modem Driver"
    System32\Drivers\RootMdm.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ScsiPort
    %SystemRoot%\system32\drivers\scsiport.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ser2pl
    "DisplayName"="ATEN USB to Serial port driver"
    system32\DRIVERS\ser2pl.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serenum
    "DisplayName"="Serenum Filter Driver"
    system32\DRIVERS\serenum.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sfdrv01
    "DisplayName"="StarForce Protection Environment Driver (version 1.x)"
    System32\drivers\sfdrv01.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sfhlp02
    "DisplayName"="StarForce Protection Helper Driver (version 2.x)"
    System32\drivers\sfhlp02.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sfvfs02
    "DisplayName"="StarForce Protection VFS Driver (version 2.x)"
    System32\drivers\sfvfs02.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SLIP
    "DisplayName"="BDA Slip De-Framer"
    system32\DRIVERS\SLIP.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SoC PC-Camera Service
    "DisplayName"="Microcular"
    system32\DRIVERS\pfc027.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd
    System32\Drivers\sptd.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\StarWindService
    "DisplayName"="StarWind iSCSI Service"
    C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\streamip
    "DisplayName"="BDA IPSink"
    system32\DRIVERS\StreamIP.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swwd
    no imagepath value found

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TabletService
    "DisplayName"="TabletService"
    C:\WINDOWS\system32\Tablet.exe

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\toshidpt
    "DisplayName"="TOSHIBA Bluetooth HID port driver"
    system32\drivers\Toshidpt.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tosporte
    "DisplayName"="Bluetooth Port Driver from Toshiba"
    system32\DRIVERS\tosporte.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tosrfbd
    "DisplayName"="Bluetooth RFBUS from TOSHIBA"
    System32\Drivers\tosrfbd.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tosrfbnp
    "DisplayName"="Bluetooth RFBNEP from TOSHIBA"
    System32\Drivers\tosrfbnp.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tosrfcom
    "DisplayName"="Bluetooth RFCOMM from TOSHIBA"
    System32\Drivers\tosrfcom.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tosrfhid
    "DisplayName"="Bluetooth RFHID from TOSHIBA"
    system32\DRIVERS\Tosrfhid.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tosrfnds
    "DisplayName"="Bluetooth Personal Area Network from TOSHIBA"
    system32\DRIVERS\tosrfnds.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TosRfSnd
    "DisplayName"="Bluetooth Audio Device (WDM) from TOSHIBA"
    system32\drivers\TosRfSnd.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tosrfusb
    "DisplayName"="Bluetooth USB Controller"
    System32\Drivers\tosrfusb.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USB
    no imagepath value found

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbohci
    "DisplayName"="Microsoft USB Open Host Controller Miniport Driver"
    System32\DRIVERS\usbohci.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbscan
    "DisplayName"="Stuurprogramma voor USB-scanner"
    system32\DRIVERS\usbscan.sys

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usnjsvc
    "DisplayName"="Messenger Sharing Folders USN Journal Reader service"
    "C:\Program Files\MSN Messenger\usnsvc.exe"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usprserv
    "DisplayName"="User Privilege Service"
    %SystemRoot%\System32\svchost.exe -k netsvcs

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi
    no imagepath value found

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WSTCODEC
    "DisplayName"="World Standard Teletext-codec"
    system32\DRIVERS\WSTCODEC.SYS

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wwSecSvc
    "DisplayName"="Washer AutoComplete"
    C:\WINDOWS\system32\wwSecure.exe

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{229B3C6D-D906-4706-AFB6-EF7F180E6C20}
    no imagepath value found

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{41AC0174-4C5E-4328-9274-B72CF58202C3}
    no imagepath value found

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{55B9E1D5-D4AA-436A-9D04-8C40FFFA1CD3}
    no imagepath value found

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{579D4E82-7FB9-4A7F-8781-721B7F17BE7B}
    no imagepath value found

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{B5BBDC89-3118-4DCF-9311-E07E9CA978C1}
    no imagepath value found


    — SECURITYPROVIDERS regkey —

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
    "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


    — SVCHOST regkey —

    HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost
    LocalService: Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
    NetworkService: DnsCache\0\0
    netsvcs: 6to4\0AppMgmt\0AudioSrv\0Browser\0CryptSvc\0DMServer\0DHCP\0ERSvc\0EventSystem\0FastUserSwitchingCompatibility\0HidServ\0Ias\0Iprip\0Irmon\0LanmanServer\0LanmanWorkstation\0Messenger\0Netman\0Nla\0Ntmssvc\0NWCWorkstation\0Nwsapagent\0Rasauto\0Rasman\0Remoteaccess\0Schedule\0Seclogon\0SENS\0Sharedaccess\0SRService\0Tapisrv\0Themes\0TrkWks\0W32Time\0WZCSVC\0Wmi\0WmdmPmSp\0winmgmt\0TermService\0wuauserv\0BITS\0ShellHWDetection\0helpsvc\0WmdmPmSN\0xmlprov\0wscsvc\0\0
    rpcss: RpcSs\0\0
    imgsvc: StiSvc\0\0
    termsvcs: TermService\0\0
    HTTPFilter: HTTPFilter\0\0
    DcomLaunch: DcomLaunch\0TermService\0\0
    WudfServiceGroup: WUDFSvc\0\0
    bthsvcs: BthServ\0\0


    — WOW-CMDLINE regkeys —

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW
    "cmdline" = %SystemRoot%\system32
    tvdm.exe
    "wowcmdline" = %SystemRoot%\system32
    tvdm.exe -a %SystemRoot%\system32\krnl386


    — STARTUP FOLDERS —

    C:\Documents and Settings\koko\Menu Start\Programma's\Opstarten\desktop.ini
    C:\Documents and Settings\koko\Menu Start\Programma's\Opstarten\Dragon NaturallySpeaking.lnk.disabled
    C:\Documents and Settings\koko\Menu Start\Programma's\Opstarten\OpenOffice.org 2.0.lnk.disabled
    C:\Documents and Settings\koko\Menu Start\Programma's\Opstarten\OpenOffice.org 2.1.lnk
    C:\Documents and Settings\koko\Menu Start\Programma's\Opstarten\World Community Grid Agent.lnk
    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\desktop.ini
    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\TabUserW.exe.lnk
    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Bluetooth Manager.lnk
    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\BOINC Manager.lnk.disabled
    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Logitech SetPoint.lnk
    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\PASPortal.lnk.disabled
    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\SnagIt 8.lnk.disabled
    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Logitech Desktop Messenger.lnk


    — TASK SCHEDULER JOBS —

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job


    — File associations —

    .BAT files: ("%1" %*)
    .COM files: ("%1" %*)
    .EXE files: ("%1" %*)
    .HLP files: (%SystemRoot%\System32\winhlp32.exe %1)
    .INF files: (%SystemRoot%\System32\NOTEPAD.EXE %1)
    .INI files: (%SystemRoot%\System32\NOTEPAD.EXE %1)
    .JS files: (%SystemRoot%\System32\WScript.exe "%1" %*)
    .PIF files: ("%1" %*)
    .REG files: (regedit.exe "%1")
    .SCR files: ("%1" /S)
    .TXT files: (%SystemRoot%\system32\NOTEPAD.EXE %1)
    .VBS files: (%SystemRoot%\System32\WScript.exe "%1" %*)


    FINISHED
  • Herstart de computer.
    Maak een nieuwe hijackthislog en een nieuwe log met reglooks.
    Post beide logjes.

Beantwoord deze vraag

Dit is een gearchiveerde pagina. Antwoorden is niet meer mogelijk.