Nationaal Computer Forum

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:06:52, on 7-9-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
c:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\program files\intel\wireless\bin\s24evmon.exe
c:\windows\explorer.exe
c:\program files\lavasoft\ad-aware\aawservice.exe
c:\windows\system32\spoolsv.exe
c:\program files\intel\wireless\bin\evteng.exe
c:\program files\intel\intel matrix storage manager\iaantmon.exe
c:\program files\java\jre6\bin\jqs.exe
c:\program files\common files\lightscribe\lssrvc.exe
c:\program files\eset\nod32krn.exe
c:\program files\intel\wireless\bin\regsrvc.exe
c:\program files\cyberlink\shared files\richvideo.exe
c:\program files\microsoft sql server\90\shared\sqlwriter.exe
c:\windows\system32\svchost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\acer\empowering technology\elock\service\elockserv.exe
c:\windows\system32\wuauclt.exe
c:\program files\intel\intel matrix storage manager\iaanotif.exe
c:\program files\synaptics\syntp\syntpenh.exe
c:\windows\rthdcpl.exe
c:\program files\cyberlink\powerdvd\pdvdserv.exe
c:\windows\system32\igfxtray.exe
c:\windows\system32\hkcmd.exe
c:\windows\system32\igfxpers.exe
c:\acer\empowering technology\epresentation\epresentation.exe
c:\windows\system32\igfxsrvc.exe
c:\acer\empowering technology\epower\epower_dmc.exe
c:\acer\empowering technology\edatasecurity\edsloader.exe
c:\acer\empowering technology\erecovery\eragent.exe
c:\progra~1\launch~1\lmanager.exe
c:\program files\winamp\winampa.exe
c:\program files\eset\nod32kui.exe
c:\program files\citrix\ica client\concentr.exe
c:\windows\system32\ctfmon.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\program files\citrix\ica client\wfcrun32.exe
c:\acer\empowering technology\acer.empowering.framework.launcher.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wuauclt.exe
c:\docume~1\comput~1\locals~1\temp\rtkbtmnt.exe
c:\program files\lavasoft\ad-aware\aawtray.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\trend micro\hijackthis\hijackthis.exe
r1 - hkcu\software\microsoft\internet explorer\main,search page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
r0 - hkcu\software\microsoft\internet explorer\main,start page = http://go.microsoft.com/fwlink/?linkid=69157
r1 - hklm\software\microsoft\internet explorer\main,default_page_url = http://go.microsoft.com/fwlink/?linkid=69157
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = http://go.microsoft.com/fwlink/?linkid=54896
r1 - hklm\software\microsoft\internet explorer\main,search page = http://go.microsoft.com/fwlink/?linkid=54896
r0 - hklm\software\microsoft\internet explorer\main,start page = http://go.microsoft.com/fwlink/?linkid=69157
r1 - hkcu\software\microsoft\internet explorer\searchurl,(default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
r1 - hkcu\software\microsoft\internet connection wizard,shellnext = http://nl.intl.acer.yahoo.com/
r0 - hkcu\software\microsoft\internet explorer\toolbar,linksfoldername = koppelingen
o2 - bho: adobe pdf reader link helper - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\acroiehelper.dll
o2 - bho: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file)
o2 - bho: windows live aanmelden - help - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: java(tm) plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
o2 - bho: jqsiestartdetectorimpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
o3 - toolbar: acer edatasecurity management - {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\edstoolbar.dll
o4 - hklm\..\run: [preload] c:\windows\runxmlpl.exe
o4 - hklm\..\run: [iaanotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
o4 - hklm\..\run: [syntpenh] c:\program files\synaptics\syntp\syntpenh.exe
o4 - hklm\..\run: [rthdcpl] rthdcpl.exe
o4 - hklm\..\run: [azmixersel] c:\program files\realtek\installshield\azmixersel.exe
o4 - hklm\..\run: [mspy2002] c:\windows\system32\ime\pintlgnt\imscinst.exe /sync
o4 - hklm\..\run: [remotecontrol] c:\program files\cyberlink\powerdvd\pdvdserv.exe
o4 - hklm\..\run: [languageshortcut] c:\program files\cyberlink\powerdvd\language\language.exe
o4 - hklm\..\run: [igfxtray] c:\windows\system32\igfxtray.exe
o4 - hklm\..\run: [hotkeyscmds] c:\windows\system32\hkcmd.exe
o4 - hklm\..\run: [persistence] c:\windows\system32\igfxpers.exe
o4 - hklm\..\run: [acer epresentation hpd] c:\acer\empowering technology\epresentation\epresentation.exe
o4 - hklm\..\run: [epower_dmc] c:\acer\empowering technology\epower\epower_dmc.exe
o4 - hklm\..\run: [boot] c:\acer\empowering technology\epower\boot.exe
o4 - hklm\..\run: [elockmonitor] c:\acer\empowering technology\elock\monitor\launchmonitor.exe
o4 - hklm\..\run: [edatasecurity loader] c:\acer\empowering technology\edatasecurity\edsloader.exe 0
o4 - hklm\..\run: [erecoveryservice] c:\acer\empowering technology\erecovery\eragent.exe
o4 - hklm\..\run: [lmanager] c:\progra~1\launch~1\lmanager.exe
o4 - hklm\..\run: [plfset] rundll32.exe c:\windows\plfset.dll,plfdefsetting
o4 - hklm\..\run: [winampagent] c:\program files\winamp\winampa.exe
o4 - hklm\..\run: [nod32kui] c:\program files\eset\nod32kui.exe /waitservice
o4 - hklm\..\run: [quicktime task] c:\program files\quicktime\qttask.exe -atboottime
o4 - hklm\..\run: [bvrpliveupdate] c:\program files\avanquest update\engine\setup.exe -s /patch,/srcupdatec:\docume~1\alluse~1\applic~1\sonyer~1\sonyer~1\li veup~1\listof~1.dat
o4 - hklm\..\run: [connectioncenter] c:\program files\citrix\ica client\concentr.exe /startup
o4 - hklm\..\run: [adobe reader speed launcher] c:\program files\adobe\reader 8.0\reader\reader_sl.exe
o4 - hklm\..\run: [adobe arm] c:\program files\common files\adobe\arm\1.0\adobearm.exe
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [msnmsgr] c:\program files\windows live\messenger\msnmsgr.exe /background
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'lokale service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'netwerkservice')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - global startup: acer empowering technology.lnk = ?
o8 - extra context menu item: e&xport to microsoft excel - res://c:\progra~1\micros~2\office10\excel.exe/3000
o8 - extra context menu item: e&xporteren naar microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o9 - extra button: in weblog opnemen - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - c:\program files\windows live\writer\writerbrowserextension.dll
o9 - extra 'tools' menuitem: &in weblog opnemen met windows live writer - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - c:\program files\windows live\writer\writerbrowserextension.dll
o9 - extra button: onderzoek - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o16 - dpf: {4f1e5b1a-2a80-42ca-8532-2d05cb959537} (msn photo upload tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/msnpupld.cab
o16 - dpf: {5c051655-fcd5-4969-9182-770ea5aa5565} (solitaire showdown class) - http://messenger.zone.msn.com/binary/solitaireshowdown.cab56986.cab
o16 - dpf: {6e5e167b-1566-4316-b27f-0ddab3484cf7} (image uploader control) - http://partyflock.nl/components/imageuploader4.cab
o16 - dpf: {c3f79a2b-b9b4-4a66-b012-3ee46475b072} (messengerstatsclient class) - http://messenger.zone.msn.com/binary/messengerstatspaclient.cab56907.cab
o16 - dpf: {cb50428b-657f-47df-9b32-671f82aa73f7} (photodex presenter ax control) - http://www.photodex.com/pxplay.cab
o16 - dpf: {e77f23eb-e7ab-4502-8f37-247dbaf1a147} (windows live hotmail photo upload tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/msnpupld.cab
o16 - dpf: {edfcb7cb-942c-4822-af14-f0b687409848} (image uploader control) - http://cache.hyves-static.net/statics/aurigma/imageuploader4.cab
o23 - service: application driver auto removal service (01) (appdrvrem01) - protection technology - c:\windows\system32\appdrvrem01.exe
o23 - service: elock service (elockservice) - - c:\acer\empowering technology\elock\service\elockserv.exe
o23 - service: intel(r) proset/wireless event log (evteng) - intel corporation - c:\program files\intel\wireless\bin\evteng.exe
o23 - service: intel(r) matrix storage event monitor (iaantmon) - intel corporation - c:\program files\intel\intel matrix storage manager\iaantmon.exe
o23 - service: installdriver table manager (idrivert) - macrovision corporation - c:\program files\common files\installshield\driver\11\intel 32\idrivert.exe
o23 - service: java quick starter (javaquickstarterservice) - sun microsystems, inc. - c:\program files\java\jre6\bin\jqs.exe
o23 - service: lavasoft ad-aware service - lavasoft - c:\program files\lavasoft\ad-aware\aawservice.exe
o23 - service: lightscribeservice direct disc labeling service (lightscribeservice) - hewlett-packard company - c:\program files\common files\lightscribe\lssrvc.exe
o23 - service: nod32 kernel service (nod32krn) - eset - c:\program files\eset\nod32krn.exe
o23 - service: intel(r) proset/wireless registry service (regsrvc) - intel corporation - c:\program files\intel\wireless\bin\regsrvc.exe
o23 - service: cyberlink richvideo service(crvs) (richvideo) - unknown owner - c:\program files\cyberlink\shared files\richvideo.exe
o23 - service: remote packet capture protocol v.0 (experimental) (rpcapd) - cace technologies - c:\program files\winpcap\rpcapd.exe
o23 - service: intel(r) proset/wireless service (s24eventmonitor) - intel corporation - c:\program files\intel\wireless\bin\s24evmon.exe
--
end of file - 10934 bytes