Ik krijg meldingen van "zogenaamde" anti-spyware dat ik last heb van spyware, vervolgens wordt het mij belet gebruik te maken van mijn internetverbindingen, ook is er zo'n irritante search bar geinstaleerd.
Wie kan mij helpen….

Dit is mijn Hijack-log:

Logfile of HijackThis v1.98.2
Scan saved at 0:16:54, on 27-3-2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\XPsys.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ALGU.EXE
C:\WINDOWS\System32\SPOOLSV32.EXE
C:\WINDOWS\25796.exe
C:\Documents and Settings\Jack\Mijn documenten\Mijn Downloads\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php
O1 - Hosts: auto.search.msn.com 127.0.0.1
O2 - BHO: ATDP Class - {E3D3AFEE-2172-4ef5-8509-1638AFFF0374} - C:\WINDOWS\atlass.dll
O3 - Toolbar: SToolbar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\stlbd.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ALGU] C:\WINDOWS\System32\ALGU.EXE
O4 - HKCU\..\Run: [SPOOLSV32] C:\WINDOWS\System32\SPOOLSV32.EXE
O4 - HKCU\..\Run: [SVCHOST] C:\WINDOWS\System32\7.exe
O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {2A895427-6C8E-46FB-B987-940B9E64F9A1} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2A895427-6C8E-46FB-B987-940B9E64F9A1} - (no file) (HKCU)
O13 - DefaultPrefix: http://106.nowfind.net/gall.php?url=
O13 - WWW Prefix: http://106.nowfind.net/gall.php?url=
O13 - Home Prefix: http://106.nowfind.net/gall.php?url=
O13 - Mosaic Prefix: http://106.nowfind.net/gall.php?url=
O15 - Trusted Zone: *.frame.crazywinnings.com
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab
O16 - DPF: {018A066F-584A-422F-AC4C-0B1F5FE5C040} (VacPro.olanda_ver3) - http://advnt01.com/dialer/olanda_ver3.CAB
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E252E6E-A7BA-4E08-A813-0A3D5D87CD46}: NameServer = 62.251.0.6 62.251.0.7

Logfile of HijackThis v1.98.2

eerst even nog je hjt updaten. we zijn al bij 1.99.1

Zegt dit je iets:
Eclickz.dll - eClickz toolbar,

Ik vond dit in verband met ALGU.EXE, atlass.dll en waarschijnlijk ook 25796.exe:
http://webhelper4u.com/CWS/CWSdropper_exe.html

en die nowfind.net hijack lijkt wel een beetje op het volgende:
http://www.techsupportforum.com/computer/topic/43577-1.html

Er zit van alles in dit log. Zoals al is gezegd, de laatste versie van hijackthis is V1.99.1 dus eerst even updaten.
Start Hijackthis en klik op 'Open the Misc Tool section'
Sleep dan de schuifbalk een stukje naar beneden en klik op 'Check for update online'

Deïnstalleer Security iGuard.
Start-> Configuratiescherm-> Software.
selecteer "Security iGuard" en verwijderd deze.

Copieer de onderstaande code en plak dat in Notepad:
[code:1:7ee3cb92fc]
REGEDIT4

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\frame.crazywinnings.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\frame.crazywinnings.com]
"*"=dword:00000004[/code:1:7ee3cb92fc]
Sla het op het bureaublad als [b:7ee3cb92fc]fix.reg[/b:7ee3cb92fc]
Opslaan als type: [b:7ee3cb92fc]Alle bestanden[/b:7ee3cb92fc]
Gebruik het nog niet.

Print onderstaande instructie uit, want de opschoning gaat in VEILIGE mode worden uitgevoerd.
Kijk hier hoe dat moet.

In veilige mode start je hijackthis en selecteer de volgende items:
[b:7ee3cb92fc]
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php
O1 - Hosts: auto.search.msn.com 127.0.0.1
O2 - BHO: ATDP Class - {E3D3AFEE-2172-4ef5-8509-1638AFFF0374} - C:\WINDOWS\atlass.dll
O3 - Toolbar: SToolbar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\stlbd.dll
O4 - HKCU\..\Run: [ALGU] C:\WINDOWS\System32\ALGU.EXE
O4 - HKCU\..\Run: [SPOOLSV32] C:\WINDOWS\System32\SPOOLSV32.EXE
O4 - HKCU\..\Run: [SVCHOST] C:\WINDOWS\System32\7.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {2A895427-6C8E-46FB-B987-940B9E64F9A1} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2A895427-6C8E-46FB-B987-940B9E64F9A1} - (no file) (HKCU)
O13 - DefaultPrefix: http://106.nowfind.net/gall.php?url=
O13 - WWW Prefix: http://106.nowfind.net/gall.php?url=
O13 - Home Prefix: http://106.nowfind.net/gall.php?url=
O13 - Mosaic Prefix: http://106.nowfind.net/gall.php?url=
O16 - DPF: {018A066F-584A-422F-AC4C-0B1F5FE5C040} (VacPro.olanda_ver3) - http://advnt01.com/dialer/olanda_ver3.CAB
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -[/b:7ee3cb92fc]
Sluit alle vensters behalve Hijackthis
Klik op 'Fix checked' om de items te verwijderen

Maak opnieuw een scan om te controleren dat alle hierbovengenoemde items zijn verdwenen.

Dubbelklik op het bestand fix.reg en laat het aan het register toevoegen.

Zorg dat de besturingssysteembestanden en verborgen bestanden zichtbaar zijn
De volgende bestanden verwijderen:
C:\WINDOWS\atlass.dll
C:\WINDOWS\stlbd.dll
C:\WINDOWS\System32\ALGU.EXE
C:\WINDOWS\System32\SPOOLSV32.EXE
C:\WINDOWS\System32\7.exe
C:\WINDOWS\XPsys.exe
C:\WINDOWS\25796.exe

Maak de Temp-map leeg: Start -> Uitvoeren tik in: %TEMP%
Selecteer alle bestanden en verwijder ze.

Herstart de PC in normale mode, maak een log en post deze.

Sjaak

Ik ben er aan bezig, de nieuwe log volgt zo….

Ondanks bovengenoemde acties blijven de regels met "106 nowfind…" terug komen en worden porn-dialers geinstaleerd…

Bijgaand mijn laatste log:


Logfile of HijackThis v1.99.1
Scan saved at 16:47:28, on 27-3-2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\yahoo.exe
C:\WINDOWS\yahoo.exe
C:\WINDOWS\yahoo.exe
C:\WINDOWS\yahoo.exe
C:\WINDOWS\yahoo.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WebSiteViewer\126081.dlr
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Jack\Mijn documenten\Mijn Downloads\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php
O1 - Hosts: auto.search.msn.com 127.0.0.1
O2 - BHO: (no name) - {0F9561D0-03B2-44a3-89A6-E95E417CBA25} - C:\WINDOWS\cerbmod.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O13 - DefaultPrefix: http://106.nowfind.net/gall.php?url=
O13 - WWW Prefix: http://106.nowfind.net/gall.php?url=
O13 - Home Prefix: http://106.nowfind.net/gall.php?url=
O13 - Mosaic Prefix: http://106.nowfind.net/gall.php?url=
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E252E6E-A7BA-4E08-A813-0A3D5D87CD46}: NameServer = 62.251.0.6 62.251.0.7
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Jack,

Waar is je anti-virus software?
Maak eerst nog maar een online virusscan
Bitdefender scan of Housecall of Panda

Sjaak

Moet deze ook gefixt worden?
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)

[quote:29d50fc5c1="smeenk"]Moet deze ook gefixt worden?
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)[/quote:29d50fc5c1]
Die had al met het fix.reg bestandje weg moeten zijn.
Het probleem van de popups wordt veroorzaakt door de bestanden in de volgende directory:
C:\Program Files\WebSiteViewer\

Ik zie geen items in de startup. Vandaar dat er eerst maar een online scan moet worden uitgevoerd.
Ook het programma Yahoo.exe lijkt mij niet OK.

Sjaak

Voor het verwijderen van WebSiteViewer:

Download en installeer CCleaner
Nog niet gebruiken.

Download HSFix
Unzip de bestanden in een directory bijv. C:\HSFix\
Start de PC in VEILIGE mode en start het programma HSFix.bat.

Er wordt een log gemaakt C:\hslog.txt.

Start Ccleaner en klik op Ccleaner opstarten (rechts onderaan)
Reboot je pc terug normaal.
Post de inhoud van dit log tesamen met een nieuw log van Hijackthis

Sjaak

Bovenstaande post even aangepast.

Sjaak

Bijgaand de 2 log files……
Helaas blijft het zich activeren.


Horseserver Removal Tool v1.05
by Atri
-
-
1. Registry Fix Started
-
Registry fix complete
-
2. Deleted Services
-
-
3. Finding files Located on system
-
WebSiteViewer
-
4. Deleting files that were found.
-
-
5. Checking for and Removing Winupdate
-
-
-



Logfile of HijackThis v1.99.1
Scan saved at 18:49:22, on 27-3-2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\ibs0.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Jack\Mijn documenten\Mijn Downloads\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://106.nowfind.net/clickpps.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://106.nowfind.net/clickpps.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://106.nowfind.net/clickpps.php
O1 - Hosts: auto.search.msn.com 127.0.0.1
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O13 - DefaultPrefix: http://106.nowfind.net/gall.php?url=
O13 - WWW Prefix: http://106.nowfind.net/gall.php?url=
O13 - Home Prefix: http://106.nowfind.net/gall.php?url=
O13 - Mosaic Prefix: http://106.nowfind.net/gall.php?url=
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E252E6E-A7BA-4E08-A813-0A3D5D87CD46}: NameServer = 62.251.0.6 62.251.0.7
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Heb je al een online scan uitgevoerd?

Sjaak

Had je deze ook al geprobeerd te verwijderen? Dit is een antispywareprogramma met een slechte reputatie!

O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe