TusH
17 February 2006, 07:35
Hoi,
Pestpatrol heeft het volgende gevonden na een scan :
Scan of 15/02/2006 22:38:15
Pests found: 7
Area scanned: C:\, D:\, E:\
User Name:
MAC Address: 00-0C-6E-62-14-98
Computer Name: PC
Volume Name: Systeem
File System Name: NTFS
Volume Serial No: 616950013
Windows Version: Windows XP
Product Edition: Corporate
PestPatrol.exe: 27/12/2004 4.4.4.81
PPClean.exe: 10/02/2006 4.5.9.128
Pest Database: 11/02/2006
PestPatrolCL.exe: 15/12/2004 4.4.4.80
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Deutsch\Software van andere bedrijven\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\English\Third Party Software\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Espa_ol\Software de terceros\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Fran_ais\Logiciel tiers\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Italiano\Software di terze parti\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Japanese\Third Party Software\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 1f83ca753f9ff42def1c8ef731d7320b Date: 3/10/2005 10:47:46 File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: NetVizor 4.12
Pest Info: Category: Key Logger Author: Spytech Software Release Date: 1/31/2006 0:00:00 Background Info: Click here
File Info: In File: E:\Torrentdownload\Pinnacle Hollywood FX PRO 5.1\Pinnacle.Hollywood.FX.Pro.v5.1.Retail\Setup\Ho llywoodFX.exe PVT: -2068849803 MD5: a8a1b7a082b5ed135eecf4b7d6959667 Date: 7/10/2003 20:34:32 File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Ik heb voor alle zekerheid maar een logje gemaakt.
Als jullie dit eens zouden willen bekijken, doen jullie me een groot plezier.
Hartelijk dank :good:
Logfile of HijackThis v1.99.1
Scan saved at 16:00:41, on 16/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
C:\Program Files\devolo\informer\devinf.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\MARCSA~1\LOCALS~1\Temp\Rar$EX00.812\Hi jackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zdnet.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "c:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt1_x.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {10132C0C-B4E5-11D5-AB9E-444553540000} (PCVRA.VRPCA) - http://www.visualradio.de/download/VRPCA.CAB
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {17D0C64A-5283-4125-8256-105694C274ED} (MozillaPluginHostCtrl Class) - http://www.maerklin-info.de/specials/anim/bigboy_web/bigboy/spx33.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111788046281
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131336301805
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webcam.nl/AxisCamControl.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://asp07.photoprintit.de/microsite/1287/defaults/activex/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{7ADDA2DA-1202-48E2-A5CA-6C58762FCE61}: NameServer = 193.74.208.65 194.119.228.67
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
GreetZ,
TusH
Pestpatrol heeft het volgende gevonden na een scan :
Scan of 15/02/2006 22:38:15
Pests found: 7
Area scanned: C:\, D:\, E:\
User Name:
MAC Address: 00-0C-6E-62-14-98
Computer Name: PC
Volume Name: Systeem
File System Name: NTFS
Volume Serial No: 616950013
Windows Version: Windows XP
Product Edition: Corporate
PestPatrol.exe: 27/12/2004 4.4.4.81
PPClean.exe: 10/02/2006 4.5.9.128
Pest Database: 11/02/2006
PestPatrolCL.exe: 15/12/2004 4.4.4.80
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Deutsch\Software van andere bedrijven\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\English\Third Party Software\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Espa_ol\Software de terceros\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Fran_ais\Logiciel tiers\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Italiano\Software di terze parti\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 76468cec053e662a97349f69424efbef Date: 8/09/2005 15:00:20 Company Name: 2d3 Ltd File Description: Setup Launcher File Version: 1.20.8111 Internal Name: setup.exe Legal Copyright: Copyright (C) 2003 InstallShield Software Corp. File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: WinWhatWhere
Pest Info: Category: Key Logger Author: [WinWhatWhere] Release Date: 12/21/2004 0:00:00 Background Info: Click here
File Info: In File: E:\Temp\Premiere 2\Adobe Premiere Pro V2.0\Japanese\Third Party Software\2d3 SteadyMove\setup.exe PVT: -1645976524 MD5: 1f83ca753f9ff42def1c8ef731d7320b Date: 3/10/2005 10:47:46 File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Pest: NetVizor 4.12
Pest Info: Category: Key Logger Author: Spytech Software Release Date: 1/31/2006 0:00:00 Background Info: Click here
File Info: In File: E:\Torrentdownload\Pinnacle Hollywood FX PRO 5.1\Pinnacle.Hollywood.FX.Pro.v5.1.Retail\Setup\Ho llywoodFX.exe PVT: -2068849803 MD5: a8a1b7a082b5ed135eecf4b7d6959667 Date: 7/10/2003 20:34:32 File Analysis: Look up with MD5 (recommended) or PVT.
Certainty: Suspected Threatens: Confidentiality, Integrity, Availability, Liability Risk: Moderate - this file can be executed! Advice: Delete
Action: Ignored
~~~
Ik heb voor alle zekerheid maar een logje gemaakt.
Als jullie dit eens zouden willen bekijken, doen jullie me een groot plezier.
Hartelijk dank :good:
Logfile of HijackThis v1.99.1
Scan saved at 16:00:41, on 16/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
C:\Program Files\devolo\informer\devinf.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\MARCSA~1\LOCALS~1\Temp\Rar$EX00.812\Hi jackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zdnet.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "c:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt1_x.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {10132C0C-B4E5-11D5-AB9E-444553540000} (PCVRA.VRPCA) - http://www.visualradio.de/download/VRPCA.CAB
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {17D0C64A-5283-4125-8256-105694C274ED} (MozillaPluginHostCtrl Class) - http://www.maerklin-info.de/specials/anim/bigboy_web/bigboy/spx33.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111788046281
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131336301805
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webcam.nl/AxisCamControl.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://asp07.photoprintit.de/microsite/1287/defaults/activex/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{7ADDA2DA-1202-48E2-A5CA-6C58762FCE61}: NameServer = 193.74.208.65 194.119.228.67
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
GreetZ,
TusH