Logfile of HijackThis v1.99.1
Scan saved at 13:50:03, on 5-5-2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\COMMON FILES\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXE
C:\PROGRAM FILES\COMMON FILES\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\NL-BE\MSNAPPAU.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\BDMCON.EXE
C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\VSSERV.EXE
C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\BDOESRV.EXE
C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\BDNAGENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\IOMEGA\TOOLS\IMGICON.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\WUAUCLT.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HIJACK\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.hzomblgimffmyse.net/XRQCdBLmc77daoeT/6qzK6d5MhTKpUnc8Qszc_4Ia0pIukn0lgyoAaKWYiuwu2yO.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_19_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\NL-BE\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL
O2 - BHO: (no name) - {E68B0458-2DD0-0370-BEFC-CE9B58095E2A} - C:\WINDOWS\APPLICATION DATA\META POKE FAST\PLATFORM WMA.EXE (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\NL-BE\MSNTB.DLL
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_19_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\nl-be\msnappau.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [PrnSys Executable] C:\Program Files\Hewlett-Packard\hp print screen utility\PrnSys.exe
O4 - HKLM\..\Run: [bendeggsflagbind] C:\WINDOWS\All Users\Application Data\Camp Tool Bend Eggs\LongProc.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\SOFTWIN\BITDEF~1\BDMCON.EXE
O4 - HKLM\..\Run: [BitDefender Virus Shield] C:\Program Files\Softwin\BitDefender8\vsserv.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\bdnagent.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [CBWAttn] C:\PROGRA~1\BITWARE\CBWEXEC.EXE /Run C:\PROGRA~1\BITWARE\CBWATTN.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Program Files\Common Files\Softwin\BitDefender Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Program Files\Common Files\Softwin\BitDefender Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Program Files\Softwin\BitDefender8\bdinit.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [4 internet] C:\WINDOWS\APPLIC~1\MEALSP~1\Balm extra drive.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Startup: Iomega Startup Opties.lnk = C:\Program Files\Iomega\Tools\IMGSTART.EXE
O4 - Startup: IomegaWare.lnk = C:\Program Files\Iomega\Iomegaware\COMMANDER.EXE
O4 - Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
O4 - Startup: Iomega Backup Scheduler.lnk = C:\Program Files\Iomega\Iomega Backup\dtiom98.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm122
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab

Wel handig als je de volgende keer er even bij verteld wat er afspeeld op de PC.

Deïnstalleer "MessengerPlus"
Deïnstalleer "My Web Search" of "My Web Speedbar"

Start Hijackthis op en kies voor 'Do a system scan only'
Selecteer alleen de items die hieronder zijn genoemd:
[b:d824efbb21]R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.hzomblgimffmyse.net/XRQCdBLmc77daoeT/6qzK6d5MhTKpUnc8Qszc_4Ia0pIukn0lgyoAaKWYiuwu2yO.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
O2 - BHO: (no name) - {E68B0458-2DD0-0370-BEFC-CE9B58095E2A} - C:\WINDOWS\APPLICATION DATA\META POKE FAST\PLATFORM WMA.EXE (file missing)
O4 - HKLM\..\Run: [bendeggsflagbind] C:\WINDOWS\All Users\Application Data\Camp Tool Bend Eggs\LongProc.exe
O4 - HKCU\..\Run: [4 internet] C:\WINDOWS\APPLIC~1\MEALSP~1\Balm extra drive.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
[/b:d824efbb21]Sluit alle vensters behalve Hijackthis
Klik op 'Fix checked' om de items te verwijderen

Zorg dat de besturingssysteembestanden en verborgen bestanden zichtbaar zijn
De volgende directories verwijderen:[b:d824efbb21]
C:\WINDOWS\APPLICATION DATA\META POKE FAST\
C:\WINDOWS\APPLICATION DATA\MEALSP~1\
C:\WINDOWS\All Users\Application Data\Camp Tool Bend Eggs\
C:\PROGRAM FILES\MYWEBSEARCH\
[/b:d824efbb21]
Copieer onderstaande code
[code:1:d824efbb21]dir %Windir%\tasks\*.job /a:h > files.txt
notepad files.txt[/code:1:d824efbb21]
Plak de code in notepad en sla het op als [b:d824efbb21]findjob.bat[/b:d824efbb21]
Opslaan als type: [b:d824efbb21]Alle bestanden[/b:d824efbb21]
start het bestand findjob.bat

Post de output van findjob.bat tesamen met een nieuw log van Hijackthis

Sjaak

Het volume in station C heeft geen naam.
Het volumenummer is 0B3A-15FF
Map van C:\WINDOWS\TASKS.

0737DF~1 JOB 236 05-05-05 18:00 0737DF8997A59326.job
2FA01F~1 JOB 236 05-05-05 18:00 2FA01FE26E7F04F7.job
7DFF1E~1 JOB 236 05-05-05 18:00 7DFF1EBA903038CF.job
5630E6~1 JOB 236 05-05-05 18:00 5630E6B29040B9DF.job
26E644~1 JOB 236 05-05-05 18:00 26E6449191819800.job
24233D~1 JOB 236 05-05-05 18:00 24233D7A9112B227.job
B80188~1 JOB 236 05-05-05 18:00 B801881F9114F2DC.job
B6D4D3~1 JOB 236 05-05-05 18:00 B6D4D35B9180FD64.job
9BBE13~1 JOB 236 05-05-05 18:00 9BBE13E694AF3E07.job
20B468~1 JOB 236 05-05-05 18:00 20B468B094A927E5.job
AFD6B2~1 JOB 236 05-05-05 18:00 AFD6B2B66E7CAEB1.job
6A7DF3~1 JOB 236 05-05-05 18:00 6A7DF3A46E7F85FB.job
8D30FB~1 JOB 236 05-05-05 18:00 8D30FBBD6E7DF1F2.job
13 bestand(en) 3.068 bytes.
0 dir('s) 12.847,45 MB vrij


Logfile of HijackThis v1.99.1
Scan saved at 18:49:52, on 5-5-2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\COMMON FILES\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\NL-BE\MSNAPPAU.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\BDOESRV.EXE
C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\BDNAGENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\IOMEGA\TOOLS\IMGICON.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\WUAUCLT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXE
C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\VSSERV.EXE
C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\BDMCON.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\HIJACK\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_19_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\NL-BE\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\NL-BE\MSNTB.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_19_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\nl-be\msnappau.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [PrnSys Executable] C:\Program Files\Hewlett-Packard\hp print screen utility\PrnSys.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\SOFTWIN\BITDEF~1\BDMCON.EXE
O4 - HKLM\..\Run: [BitDefender Virus Shield] C:\Program Files\Softwin\BitDefender8\vsserv.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRAM FILES\SOFTWIN\BITDEFENDER8\bdnagent.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [CBWAttn] C:\PROGRA~1\BITWARE\CBWEXEC.EXE /Run C:\PROGRA~1\BITWARE\CBWATTN.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Program Files\Common Files\Softwin\BitDefender Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Program Files\Common Files\Softwin\BitDefender Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Program Files\Softwin\BitDefender8\bdinit.exe
O4 - HKLM\..\RunOnce: [MessengerPlusUninstall] C:\WINDOWS\command.com /C "C:\WINDOWS\TEMP\MsgPlusUninst.bat"
O4 - Startup: Iomega Startup Opties.lnk = C:\Program Files\Iomega\Tools\IMGSTART.EXE
O4 - Startup: IomegaWare.lnk = C:\Program Files\Iomega\Iomegaware\COMMANDER.EXE
O4 - Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
O4 - Startup: Iomega Backup Scheduler.lnk = C:\Program Files\Iomega\Iomega Backup\dtiom98.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab

Copieer onderstaande code:
[code:1:841da03827]
cd \%Windir%\tasks
del /a:h 0737DF8997A59326.job
del /a:h 2FA01FE26E7F04F7.job
del /a:h 7DFF1EBA903038CF.job
del /a:h 5630E6B29040B9DF.job
del /a:h 26E6449191819800.job
del /a:h 24233D7A9112B227.job
del /a:h B801881F9114F2DC.job
del /a:h B6D4D35B9180FD64.job
del /a:h 9BBE13E694AF3E07.job
del /a:h 20B468B094A927E5.job
del /a:h AFD6B2B66E7CAEB1.job
del /a:h 6A7DF3A46E7F85FB.job
del /a:h 8D30FBBD6E7DF1F2.job[/code:1:841da03827]

Sla het job als [b:841da03827]remjob.bat[/b:841da03827]
Opslaan als type: [b:841da03827]Alle bestanden[/b:841da03827]

Start remjob.bat.
Herstart de PC, start nogmaals het programma findjob.bat en post het resultaat.

Sjaak

er is een ongeldige schakeloptie. - /A:H

Ach, je hebt Windows Me.

Bij XP kan het wel in één keer.
Dan moet de eigenschappen van de bestanden eerst worden aangepast. Ze zijn verborgen.

Copieer de volgende code:
[code:1:bb392211f7]cd \%Windir%\tasks
attrib -h 0737DF8997A59326.job
attrib -h 2FA01FE26E7F04F7.job
attrib -h 7DFF1EBA903038CF.job
attrib -h 5630E6B29040B9DF.job
attrib -h 26E6449191819800.job
attrib -h 24233D7A9112B227.job
attrib -h B801881F9114F2DC.job
attrib -h B6D4D35B9180FD64.job
attrib -h 9BBE13E694AF3E07.job
attrib -h 20B468B094A927E5.job
attrib -h AFD6B2B66E7CAEB1.job
attrib -h 6A7DF3A46E7F85FB.job
attrib -h 8D30FBBD6E7DF1F2.job

del 0737DF8997A59326.job
del 2FA01FE26E7F04F7.job
del 7DFF1EBA903038CF.job
del 5630E6B29040B9DF.job
del 26E6449191819800.job
del 24233D7A9112B227.job
del B801881F9114F2DC.job
del B6D4D35B9180FD64.job
del 9BBE13E694AF3E07.job
del 20B468B094A927E5.job
del AFD6B2B66E7CAEB1.job
del 6A7DF3A46E7F85FB.job
del 8D30FBBD6E7DF1F2.job
[/code:1:bb392211f7]
Opslaan als [b:bb392211f7]remjob.bat[/b:bb392211f7] (oude dus vervangen)
Opslaan als Type: [b:bb392211f7]Alle bestanden[/b:bb392211f7]
En nu remjob.bat opstarten.

Sjaak

bestand niet gevonden, dus ik denk dat het opgelost is.

Alvast bedankt!

MessengerPlus mag weer worden geinstalleerd maar dan bij het installeren geen toestemming geven voor de sponsors.

Sjaak

[quote:85d0f2693e="steggel"]MessengerPlus mag weer worden geinstalleerd maar dan bij het installeren geen toestemming geven voor de sponsors.

Sjaak[/quote:85d0f2693e]

Dat is al lang gebeurd.

Die computer is een computer van een vriendin haar pa, en ik moest een printer instaleren, en ik zag massaal veel spyware, dus ik dacht, even een hijack logje plaatsen, en zorgen dat het terug opgekuist is. Die persoon was dan ook blij dat zijn computer weer in orde is(zonder vastlopers en dergelijke van de spyware) en heeft mij bedankt. MAAR, zonder jullie zou dit ook niet gelukt zijn. Daarom: THANK YOU

Sjaak, de volgende regel ook laten verwijderen:
[b:a99452ac0f]O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab[/b:a99452ac0f]

ik heb het bestand even gedownload op mijn desktop en gescand met jotti, en de volgende malware werd aangetoond: W32/Hexa.A

vr.gr.smeenk

Ai,

Die O16 stond nog niet op m'n lijstje.
Mag je dus nog worden gefixed met hijackthis als je weer achter die PC bent.

Gelijk maar de %temp% opschonen en Tijdelijke Internet-bestanden verwijderen.

Daarna ook nog maar eens virusscan uitvoeren.
Panda of Bitfender

Als laatste kan je nog Ad-aware en Spybot S&D uitvoeren.

Sjaak

[quote:225ce6b71e="steggel"]Ai,

Die O16 stond nog niet op m'n lijstje.
Mag je dus nog worden gefixed met hijackthis als je weer achter die PC bent.

Gelijk maar de %temp% opschonen en Tijdelijke Internet-bestanden verwijderen.

Daarna ook nog maar eens virusscan uitvoeren.
Panda of Bitfender

Als laatste kan je nog Ad-aware en Spybot S&D uitvoeren.

Sjaak[/quote:225ce6b71e]

Bitdefender staat op die computer. AVG stond er eerst op, maar ik heb die direct vervangen door Bitdefender.(niets gevonden)