What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser Hijacked, can someone help me

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi guys,

I think my browser has been hijacked. I'am using Mozilla Firefox.

My logfile is the following:

Logfile of HijackThis v1.99.1
Scan saved at 22:07:24, on 11-12-06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\PCCIOMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\TSC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\ANVSHELL.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\POP3TRAP.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\WEBTRAP.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\PICASA2\PICASAMEDIADETECTOR.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MULTIMEDIA CARD READER\SHWICON98.EXE
C:\WINDOWS\DIT.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.03.0000.1005\NL\MSNAPPAU.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\DISTILLR\ACROTRAY.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOBNZ08.EXE
C:\PROGRAM FILES\PALMONE\HOTSYNC.EXE
C:\WINDOWS\DVZCOMMON\DVZMSGR.EXE
C:\WINDOWS\DITEXP.EXE
C:\PROGRAM FILES\NIKON\NKVIEW4\NKVWMON.EXE
C:\PROGRAM FILES\FOTOSTATION EASY\FOTOSTATION EASY AUTOLAUNCH.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOEVM08.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE
C:\MIJN DOCUMENTEN\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.5000.1021\NL\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.03.0000.1005\EN-XU\STMAIN.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.5000.1021\NL\MSNTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Taakcontrole] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [OmgStartup] C:\Program Files\Common Files\Sony Shared\OpenMG\OmgStartup.exe
O4 - HKLM\..\Run: [PCCIOMON.EXE] "C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EXE"
O4 - HKLM\..\Run: [pop3trap.exe] "C:\Program Files\Trend PC-cillin 2000\pop3trap.exe"
O4 - HKLM\..\Run: [WebTrap.exe] "C:\Program Files\Trend PC-cillin 2000\WebTrap.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Sunkist] C:\Program Files\Multimedia Card Reader\shwicon98.exe
O4 - HKLM\..\Run: [CICache] CICache.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.03.0000.1005\nl\msnappau.exe"
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~1.EXE -r
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [PCCIOMON.EXE] "C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EXE"
O4 - Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Startup: NkVwMon.exe.lnk = C:\Program Files\Nikon\NkView4\NkVwMon.exe
O4 - Startup: FotoStation Easy AutoLaunch.lnk = C:\Program Files\FotoStation Easy\FotoStation Easy AutoLaunch.exe
O8 - Extra context menu item: Sothink SWF Catcher - C:\PROGRAM FILES\COMMON FILES\SOURCETEC\SWF CATCHER\InternetExplorer.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\PROGRAM FILES\COMMON FILES\SOURCETEC\SWF CATCHER\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\PROGRAM FILES\COMMON FILES\SOURCETEC\SWF CATCHER\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_10\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_10\BIN\SSV.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 85.255.113.204,85.255.112.232
Post #3
Welcome to the forum.

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

—————

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 85.255.113.204,85.255.112.232

Click on Fix Checked and exit HijackThis.

———————

Next:

Please download SUPERAntiSpyware Home Edition (free)

Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click "Yes",
let it through your firewall!
Under "Configuration and Preferences", click the "Preferences" button.
Click the "Scanning Control" tab.
Under "Scanner Options" make sure the following are checked:
1>> Close browsers before scanning
2>> Scan for tracking cookies
3>> Terminate memory threats before quarantining.
4>> Please leave the others unchecked.
5>> Click the Close button to leave the control center screen.

On the main screen, under "Scan for Harmful Software" click "Scan your
computer".
On the left check "C:\Fixed Drive".
On the right, under "Complete Scan", choose "Perform Complete Scan".
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click "OK".
Make sure everything in the white box has a check next to it, then click "Next".
It will quarantine what it found and if it asks if you want to reboot, click
"Yes".

To retrieve the removal information for me please do the following:
1>> After reboot, double-click the "SUPERAntispyware icon" on your desktop.
2>> Click "Preferences". Click the "Statistics/Logs tab".
3>> Under "Scanner Logs", double-click "SUPERAntiSpyware Scan Log".
4>> It will open in your default text editor (such as Notepad/Wordpad).
5>> Please highlight everything in the notepad, then right-click and choose copy.
6>> Click close and close again to exit the program.

Now please paste the "removal information" along with a fresh "HijackThis log" in your reply. If it's a large log, you may need several replies to post it.
Good Luck, MrC
Post #4
Thanx very much for your help, I must say I was a bit impatient so I did a online virusscan at: http://housecall.trendmicro.com/ and it found some virusses. Anyway I also followed your instructions.

Cheers, Peter

herewith the log:

SUPERAntiSpyware Scan Log
Generated 12/17/2006 at 01:53 AM

Application Version : 3.4.1000

Core Rules Database Version : 3149
Trace Rules Database Version: 1165

Scan type : Complete Scan
Total Scan Time : 01:29:51

Memory items scanned : 257
Memory threats detected : 0
Registry items scanned : 2745
Registry threats detected : 0
File items scanned : 80635
File threats detected : 83

Adware.Tracking Cookie
C:\WINDOWS\Profiles\frsgr\Cookies\robin@msnportal.112.2o7[1].txt
C:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
C:\WINDOWS\Profiles\frsgr\Cookies\robin@doubleclick[2].txt
C:\WINDOWS\Profiles\frsgr\Cookies\[removed]-sys[1].txt
C:\WINDOWS\Profiles\frsgr\Cookies\robin@serving-sys[1].txt
c:\WINDOWS\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Cookies\[removed][1].txt
c:\WINDOWS\Cookies\[removed][1].txt
c:\WINDOWS\Cookies\robin@yadro[1].txt
c:\WINDOWS\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\Robin\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\f34rg\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\f34rg\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\f34rg\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\fr44\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\fr44\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\fr44\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\fwc5\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\fwc5\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\fwc5\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\robin@windowsmedia[2].txt
c:\WINDOWS\Profiles\frsgr\Cookies\robin@yadro[2].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\robin@belnk[1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\robin@mediazone[2].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][2].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\robin@m1.webstats4u[2].txt
c:\WINDOWS\Profiles\frsgr\Cookies\robin@indextools[1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed]-ebcn[1].txt
c:\WINDOWS\Profiles\frsgr\Cookies\robin@indextools[3].txt
c:\WINDOWS\Profiles\frsgr\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\sdrtsh\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\sdrtsh\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\sdrtsh\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\sdrtsh\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\sdrtsh\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\v8t7\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\v8t7\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\v8t7\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\v8t7\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\v8t7\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\vnhr5t\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\vnhr5t\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\vnhr5t\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\vnhr5t\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\vnhr5t\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\hfrsdty\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\hfrsdty\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\hfrsdty\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\hfrsdty\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\hfrsdty\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\fd565ee\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\fd565ee\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\fd565ee\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\fd565ee\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\fd565ee\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\rtuftkuiypo\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\rtuftkuiypo\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\rtuftkuiypo\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\rtuftkuiypo\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\rtuftkuiypo\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\8r6df\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\8r6df\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\8r6df\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\8r6df\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\8r6df\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\rtyyyyft\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\rtyyyyft\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\rtyyyyft\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\rtyyyyft\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\rtyyyyft\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\ygtfifdd\Cookies\robin@www2.ad2click[1].txt
c:\WINDOWS\Profiles\ygtfifdd\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\ygtfifdd\Cookies\[removed][1].txt
c:\WINDOWS\Profiles\ygtfifdd\Cookies\robin@yadro[1].txt
c:\WINDOWS\Profiles\ygtfifdd\Cookies\[removed][1].txt

Adware.MyWay
C:\PROGRAM FILES\SOURCETEC\SOTHINK SWF DECOMPILER\MYSEARCH\MYSETP.EXE
Post #5
And herewith my new Hijacklog:

Logfile of HijackThis v1.99.1
Scan saved at 22:45:13, on 18-12-06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\PCCIOMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\ANVSHELL.EXE
C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\POP3TRAP.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\WEBTRAP.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\PICASA2\PICASAMEDIADETECTOR.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MULTIMEDIA CARD READER\SHWICON98.EXE
C:\WINDOWS\DIT.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.03.0000.1005\NL\MSNAPPAU.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
C:\WINDOWS\DITEXP.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\DISTILLR\ACROTRAY.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOBNZ08.EXE
C:\PROGRAM FILES\PALMONE\HOTSYNC.EXE
C:\WINDOWS\DVZCOMMON\DVZMSGR.EXE
C:\PROGRAM FILES\NIKON\NKVIEW4\NKVWMON.EXE
C:\PROGRAM FILES\FOTOSTATION EASY\FOTOSTATION EASY AUTOLAUNCH.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOEVM08.EXE
C:\WINDOWS\SYSTEM\HPZIPM12.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAM FILES\PALMONE\PALM.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\MIJN DOCUMENTEN\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.5000.1021\NL\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.03.0000.1005\EN-XU\STMAIN.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.5000.1021\NL\MSNTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Taakcontrole] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [OmgStartup] C:\Program Files\Common Files\Sony Shared\OpenMG\OmgStartup.exe
O4 - HKLM\..\Run: [PCCIOMON.EXE] "C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EXE"
O4 - HKLM\..\Run: [pop3trap.exe] "C:\Program Files\Trend PC-cillin 2000\pop3trap.exe"
O4 - HKLM\..\Run: [WebTrap.exe] "C:\Program Files\Trend PC-cillin 2000\WebTrap.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Sunkist] C:\Program Files\Multimedia Card Reader\shwicon98.exe
O4 - HKLM\..\Run: [CICache] CICache.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.03.0000.1005\nl\msnappau.exe"
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\COMMON~1\ADAPTE~1\CREATECD\CREATE~1.EXE -r
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [PCCIOMON.EXE] "C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EXE"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
O4 - Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Startup: NkVwMon.exe.lnk = C:\Program Files\Nikon\NkView4\NkVwMon.exe
O4 - Startup: FotoStation Easy AutoLaunch.lnk = C:\Program Files\FotoStation Easy\FotoStation Easy AutoLaunch.exe
O8 - Extra context menu item: Sothink SWF Catcher - C:\PROGRAM FILES\COMMON FILES\SOURCETEC\SWF CATCHER\InternetExplorer.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\PROGRAM FILES\COMMON FILES\SOURCETEC\SWF CATCHER\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\PROGRAM FILES\COMMON FILES\SOURCETEC\SWF CATCHER\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_10\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_10\BIN\SSV.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - http://download.ewido.net/ewidoOnlineScan.cab
O20 - Winlogon Notify: !SASWinLogon - C:\PROGRAM FILES\SUPERANTISPYWARE\SASWINLO.DLL
Post #7
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI