Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Problems with aurora and others

Started by Orkie , May 17 2005 04:56 AM

  • Please log in to reply

#1
Orkie
Posted 17 May 2005 - 04:56 AM

Orkie

    Member

  • Member
  • PipPip
  • 32 posts
Logfile of HijackThis v1.99.1
Scan saved at 12:54:11, on 17-5-2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
c:\windows\system32\rlwxjh.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Apps\ActivBoard\OSD.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\Familie Wildeboer\Mijn documenten\Mijn ontvangen bestanden\hijackthis_199\HijackThis.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\OPScan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.packardbell.nl/center
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 69.50.173.4 lycos.com
O1 - Hosts: 69.50.173.4 www.lycos.com
O1 - Hosts: 69.50.173.4 altavista.com
O1 - Hosts: 69.50.173.4 www.altavista.com
O1 - Hosts: 69.50.173.4 amazon.com
O1 - Hosts: 69.50.173.4 www.amazon.com
O1 - Hosts: 69.50.173.4 aol.com
O1 - Hosts: 69.50.173.4 www.aol.com
O1 - Hosts: 69.50.173.4 earthlink.net
O1 - Hosts: 69.50.173.4 www.earthlink.net
O1 - Hosts: 69.50.173.4 ebay.com
O1 - Hosts: 69.50.173.4 www.ebay.com
O1 - Hosts: 69.50.173.4 go.com
O1 - Hosts: 69.50.173.4 www.go.com
O1 - Hosts: 69.50.173.4 google.com
O1 - Hosts: 69.50.173.4 www.google.com
O1 - Hosts: 69.50.173.4 icq.com
O1 - Hosts: 69.50.173.4 www.icq.com
O1 - Hosts: 69.50.173.4 lycos.com
O1 - Hosts: 69.50.173.4 www.lycos.com
O1 - Hosts: 69.50.173.4 msn.com
O1 - Hosts: 69.50.173.4 www.msn.com
O1 - Hosts: 69.50.173.4 yahoo.com
O1 - Hosts: 69.50.173.4 www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\System32\nso165.dll (file missing)
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: SurfairyBHO Class - {BB9AAAF3-4F8D-48B5-A565-FF3E58433DC2} - C:\Program Files\Surfairy\SurfairyHlp.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [tnaggc] c:\windows\system32\rlwxjh.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
O9 - Extra button: Suggestions - {2223664C-1942-4276-9A2D-E8D8F547C5D2} - res://EffiPeled (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=www.packardbell.nl/center
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by22fd.bay22....es/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113135563452
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod-service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
  • 0

Advertisements

#2
Orkie
Posted 17 May 2005 - 08:13 AM

Orkie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
*Edit*, very sorry

didn't know i shouldn't bump it :tazz:

Edited by Orkie, 17 May 2005 - 08:16 AM.

  • 0

#3
Metallica
Posted 17 May 2005 - 08:18 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Hi Orkie,

Find this file C:\WINDOWS\System32\drivers\etc\hosts and rename it to hosts.bak

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml


Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\System32\nso165.dll (file missing)

O2 - BHO: SurfairyBHO Class - {BB9AAAF3-4F8D-48B5-A565-FF3E58433DC2} - C:\Program Files\Surfairy\SurfairyHlp.dll

O4 - HKLM\..\Run: [tnaggc] c:\windows\system32\rlwxjh.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Regards,
  • 0

#4
Orkie
Posted 17 May 2005 - 11:41 AM

Orkie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts 
Thank you very much, Aurora is gone from my computer now, but i also get a strange error when I start my computer or when I open word, excel and stuff.

HIJACKTHIS LOG

Logfile of HijackThis v1.99.1
Scan saved at 19:32:01, on 17-5-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Apps\ActivBoard\OSD.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Familie Wildeboer\Mijn documenten\Mijn ontvangen bestanden\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.packardbell.nl/center
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=www.packardbell.nl/center
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by22fd.bay22....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113135563452
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod-service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe


Ewido Scan Log


---------------------------------------------------------
ewido security suite - Scan rapport
---------------------------------------------------------

+ Gemaakt op:   19:19:18, 17-5-2005
+ Rapport samenvatting:  4B51D359

+ Datum van de database:  17-5-2005
+ Versienummer van de scanner: v3.0

+ Duur:    166 min
+ Gescande bestanden:   146338
+ Snelheid:    14.66 Bestanden/Seconde
+ Geinfecteerde bestanden:   69
+ Verwijderde bestanden:   69
+ Bestanden in quarantaine gezet:  69
+ Bestanden die niet konden worden geopend: 0
+ Bestanden die niet konden worden schoongemaakt: 0

+ Binder:  Ja
+ Crypter:  Ja
+ Archieven:  Ja

+ Gescande items:
C:\

+ Scan resultaten:
C:\Documents and Settings\Familie Wildeboer\Cookies\familie wildeboer@atdmt[2].txt -> Spyware.Tracking-Cookie -> Schoongemaakt met een backup
C:\Documents and Settings\Familie Wildeboer\Cookies\familie wildeboer@mediaplex[1].txt -> Spyware.Tracking-Cookie -> Schoongemaakt met een backup
C:\Program Files\Norton Internet Security\Activatie keygen\KGNIS.EXE -> TrojanDropper.Delf.fd -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP12\A0005156.dll -> TrojanDownloader.Agent.kf -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP12\A0005158.exe -> Spyware.Serpo.g -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP12\A0005159.dll -> Spyware.Serch.a -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP12\A0005160.dll -> TrojanDownloader.Agent.ko -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP3\A0001791.exe -> Backdoor.Rbot -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP69\A0036997.exe -> Spyware.Sahat.m -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP69\A0037005.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP69\A0037009.exe -> Trojan.Stervis.b -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP69\A0037010.exe -> Trojan.Nail -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP69\A0037017.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP69\A0037031.exe -> Spyware.Sahat.o -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP69\A0037032.exe -> Spyware.Sahat.o -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP70\A0037036.dll -> Spyware.Beginto.c -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP70\A0037045.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP70\A0037047.dll -> Spyware.Sahat.l -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP70\A0037048.exe -> Spyware.Sahat.o -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP70\A0037053.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP70\A0037059.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP70\A0038051.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP71\A0038063.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP71\A0039051.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP71\A0039055.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP72\A0040051.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP72\A0040055.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP73\A0040074.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP73\A0041051.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP73\A0041057.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP73\A0042051.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP77\A0042063.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP77\A0042096.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP77\A0042102.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP77\A0042106.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP79\A0042146.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP79\A0042147.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP79\A0043142.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP79\A0044142.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP80\A0044147.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP86\A0045142.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP87\A0045174.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP87\A0045182.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP87\A0045186.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP87\A0045187.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP88\A0045215.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP88\A0045221.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP88\A0045225.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP88\A0046221.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP88\A0046232.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP88\A0047221.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP89\A0047246.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP91\A0047305.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP91\A0047313.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP91\A0047408.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP91\A0047412.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP92\A0047418.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP92\A0048408.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP92\A0049408.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP92\A0049412.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP93\A0049414.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP94\A0049646.dll -> Trojan.Agent.db -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP94\A0049647.dll -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP94\A0049650.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP94\A0050407.exe -> Trojan.Nail -> Schoongemaakt met een backup
C:\System Volume Information\_restore{B9D74B61-8F6F-4812-B796-75FF72E174CA}\RP94\A0050408.exe -> Trojan.Stervis.c -> Schoongemaakt met een backup
C:\WINDOWS\Bolger.dll_tobedeleted -> Spyware.BetterInternet -> Schoongemaakt met een backup
C:\WINDOWS\system32\rlwxjh.exe -> Trojan.Agent.cp -> Schoongemaakt met een backup
C:\WINDOWS\ytzwevfvu.exe -> Spyware.BetterInternet -> Schoongemaakt met een backup


::Einde rapport

Sorry for it being in dutch and all


My other error is this one:

MY ERROR

I always get it when I open word, excel or reboot. When it comes when i open word or excel I have to push the button once, then it comes again. Then i push the button for the second time and it starts word up like normal

Thank you all for helping me and sorry for my bad english

Edited by Orkie, 17 May 2005 - 11:46 AM.

  • 0

#5
Metallica
Posted 17 May 2005 - 12:18 PM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Don't worry Orkie. My Dutch is better then my English. :tazz:

Download and install: the Windows Installer CleanUp Utility

Remove every reference to NAV 2005

That should get rid of the errors.
You should also update XP and IE to SP2

Groetjes,
  • 0

#6
Orkie
Posted 17 May 2005 - 12:58 PM

Orkie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
Bedankt voor alle hulp,

I'm downloading the program now...

Waar in nederland woon je? :tazz: En nog een ander vraagje, weet jij hoe ik mijn computer sneller kan later opstarten/afsluiten?

Edited by Orkie, 17 May 2005 - 01:01 PM.

  • 0

#7
Metallica
Posted 17 May 2005 - 01:20 PM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Let's talk about faster booting and shutting down, once you have completed the last stage.

near Rotterdam

Grtz,
  • 0

#8
Orkie
Posted 17 May 2005 - 02:43 PM

Orkie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
Last stage done!

Now tell me ;)

I live near The Heague :tazz:
  • 0

#9
Metallica
Posted 17 May 2005 - 03:03 PM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Gimme proof :tazz: ( a log )

And tell me if the NAV errors have stopped.

Regards,
  • 0

#10
Orkie
Posted 18 May 2005 - 12:36 AM

Orkie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
NAV Errors have stopped, and here's my fresh log:

Logfile of HijackThis v1.99.1
Scan saved at 8:35:41, on 18-5-2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Apps\ActivBoard\OSD.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\Familie Wildeboer\Mijn documenten\Mijn ontvangen bestanden\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.packardbell.nl/center
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=www.packardbell.nl/center
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-24.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by22fd.bay22....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113135563452
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod-service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
  • 0

Advertisements

#11
Metallica
Posted 18 May 2005 - 01:16 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
No Servicepacks :tazz:
  • 0

#12
Orkie
Posted 18 May 2005 - 01:38 AM

Orkie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
Sorry, i missed that part of your message, downloading now...

Also got another problem, all of my sound is just gone :s This happened after I did what you asked me to do...

Edited by Orkie, 18 May 2005 - 01:43 AM.

  • 0

#13
Metallica
Posted 18 May 2005 - 01:41 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
:tazz:
  • 0

#14
Orkie
Posted 18 May 2005 - 01:44 AM

Orkie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 32 posts
Do you have MSN or something? So I can ask you some things about my computer?

Edited by Orkie, 18 May 2005 - 01:56 AM.

  • 0

#15
Metallica
Posted 18 May 2005 - 03:02 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Sorry. No can do.

The forums are for asking questions and being helped.
You can try if someone is in chat, but I can't access that from here since I am at work.

Regards,
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP