spyware probleem….

Logfile of HijackThis v1.99.1

Scan saved at 17:33:19, on 26-7-2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:WINDOWSSystem32smss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:WINDOWSsystem32LEXBCES.EXE

C:WINDOWSsystem32spoolsv.exe

C:Program FilesCommon FilesSymantec SharedccSetMgr.exe

C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe

Program FilesNorton AntiVirusnavapsvc.exe

C:WINDOWSsystem32nvsvc32.exe

C:Program FilesAnalog DevicesSoundMAXSMAgent.exe

C:WINDOWSSystem32svchost.exe

C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe

C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe

Program FilesNorton AntiVirusSAVScan.exe

C:WINDOWSExplorer.EXE

C:WINDOWSsystem32wscntfy.exe

C:Program FilesMicrosoft IntelliType Protype32.exe

C:Program FilesAlcatelSpeedTouch USBDragdiag.exe

C:WINDOWSsystem32DeltTray.exe

C:WINDOWSsystem32lexpps.exe

C:Program FilesInternet Exploreriexplore.exe

Program FilesSmart Protector ProSmartProtectorPro.exe

C:Program FilesMSN MessengerMsnMsgr.Exe

Program Filesmozilla.orgMozillamozilla.exe

DOCUME~1BEN~1.YOULOCALS~1TempRar$EX00.813HijackThis.exe

R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.startpagina.nl/

R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.startpagina.nl

R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Koppelingen

O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll

O2 – BHO: Microsoft MSJava 32 – {43F7497C-7687-4DEA-A057-F21BD81BC896} – C:WINDOWSSystem32msjava32.dll

O2 – BHO: CNavExtBho Class – {BDF3E430-B101-42AD-A544-FADC6B084872} – Program FilesNorton AntiVirusNavShExt.dll

O2 – BHO: (no name) – {DBE50CC4-7BE7-261B-B1FB-16993618FED2} – DOCUME~1PeterAPPLIC~1ADMINP~1regsbows.exe (file missing)

O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – Program FilesNorton AntiVirusNavShExt.dll

O4 – HKLM..Run: [NAV CfgWiz] C:Program FilesCommon FilesSymantec SharedCfgWiz.exe /GUID NAV /CMDLINE “REBOOT”

O4 – HKLM..Run: [type32] “C:Program FilesMicrosoft IntelliType Protype32.exe”

O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup

O4 – HKLM..Run: [SpeedTouch USB Diagnostics] “C:Program FilesAlcatelSpeedTouch USBDragdiag.exe” /icon

O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit

O4 – HKLM..Run: [DeltTray] DeltTray.exe

O4 – HKLM..Run: [ClockNewTimeMapi] Documenten en SettingsAll Users.WINDOWSApplication DataMultiBoldClockNewMedia Third.exe

O4 – HKCU..Run: [spywatch] Program FilesBulletProofSoft.comSpywareRemoverSpyWatch.exe /STARTUP

O4 – HKCU..Run: [SPSTEALT] “Program FilesSmart Protector ProSmartProtectorPro.exe” /stealt

O4 – Global Startup: Microsoft Office.lnk = Program FilesMicrosoft OfficeOffice10OSA.EXE

O9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0binnpjpi150.dll

O9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0binnpjpi150.dll

O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe

O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe

O9 – Extra button: MyCom – {F3089D1A-4498-4987-AE6B-59DE9A67B282} – http://www.mycom.nl (file missing) (HKCU)

O16 – DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) – http://spaces.msn.com//PhotoUpload/MsnPUpld.cab

O16 – DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) – http://secure2.comned.com/signuptemplates/securelogin-devel.cab

O17 – HKLMSystemCCSServicesTcpip..{D62B5CF3-6875-48C1-9035-CC1A5DA49CB9}: NameServer = 62.58.50.5 62.58.50.6

O23 – Service: Ati HotKey Poller – Unknown owner – C:WINDOWSSystem32Ati2evxx.exe

O23 – Service: ATI Smart – Unknown owner – C:WINDOWSsystem32ati2sgag.exe

O23 – Service: Symantec Event Manager (ccEvtMgr) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe

O23 – Service: Symantec Password Validation (ccPwdSvc) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe

O23 – Service: Symantec Settings Manager (ccSetMgr) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccSetMgr.exe

O23 – Service: LexBce Server (LexBceS) – Lexmark International, Inc. – C:WINDOWSsystem32LEXBCES.EXE

O23 – Service: Macromedia Licensing Service – Unknown owner – C:Program FilesCommon FilesMacromedia SharedServiceMacromedia Licensing.exe

O23 – Service: Norton AntiVirus Auto-Protect (navapsvc) – Symantec Corporation – Program FilesNorton AntiVirusnavapsvc.exe

O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:WINDOWSsystem32nvsvc32.exe

O23 – Service: SAVScan – Symantec Corporation – Program FilesNorton AntiVirusSAVScan.exe

O23 – Service: ScriptBlocking Service (SBService) – Symantec Corporation – C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe

O23 – Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) – Analog Devices, Inc. – C:Program FilesAnalog DevicesSoundMAXSMAgent.exe

O23 – Service: SymWMI Service (SymWSC) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe

ik heb het nog niet weg kunnen krijgen…… ik ben er wel 8er dat het iets met iexplore.exe te maken heeft. dit start automatisch op. als ik dit proces beeindig start het weer op…