Ik heb Trojan gedraaid en nog eens Startuplist gedraaid!
zie hieronder en bijlage!!
StartupList report, 1-1-03, 22:03:44
StartupList version: 1.50
Started from : C:\WINDOWS\TEMP\RAR$EX00.044\STARTUPLIST.EXE
Detected: Windows 98 Gold (Win9x 4.10.1998)
Detected: Internet Explorer v5.00 (5.00.2314.1000)
* Using default options
==================================================
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\ALCATEL\SPEEDTOUCH USB\DRAGDIAG.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSRES.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\TROJANHUNTER 2.5\TH_GUARD.EXE
C:\PROGRAM FILES\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.044\STARTUPLIST.EXE
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\WINDOWS\Start Menu\Programma's\Opstarten]
Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SpeedTouch USB Diagnostics = "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
SystemTray = SysTray.Exe
Taakcontrole = c:\windows\taskmon.exe
ScanRegistry = c:\windows\scanregw.exe /autorun
sysres = sysres.exe
LoadQM = loadqm.exe
THGuard = "C:\PROGRAM FILES\TROJANHUNTER 2.5\TH_GUARD.EXE"
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sysres = Sysres.exe
--------------------------------------------------
Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)
[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}
[PerUser_LinkBar_URLs] *
StubPath = c:\windows\COMMAND\sulfnbk.exe /L
[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=
run=
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll
--------------------------------------------------
Checking for EXPLORER.EXE instances:
C:\WINDOWS\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
--------------------------------------------------
C:\WINDOWS\WININIT.INI listing:
(Created 1/1/2003, 21:54:50)
[rename]
C:\WINDOWS\VDEGES~1.TCF=C:\WINDOWS\VDEGES~1.EXE
--------------------------------------------------
C:\WINDOWS\WININIT.BAK listing:
(Created 15/12/2002, 21:35:34)
[rename]
NUL=C:\WINDOWS\DOWNLO~1\IEGATOR.DLL
NUL=
[rename]
NUL=
--------------------------------------------------
C:\AUTOEXEC.BAT listing:
@ECHO OFF
mode con codepage prepare=((850) c:\windows\COMMAND\ega.cpi)
mode con codepage select=850
PATH C:\PROGRA~1\ESAFE\PROTECT
--------------------------------------------------
C:\CONFIG.SYS listing:
DOS=HIGH,UMB
device=c:\windows\COMMAND\display.sys con=(ega,,1)
Country=031,850,c:\windows\COMMAND\country.sys
--------------------------------------------------
C:\WINDOWS\DOSSTART.BAT listing:
@echo off
REM
REM
--------------------------------------------------
Checking for superhidden extensions:
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\PROGRAM FILES\ESAFE\PROTECT\espie.dll - {2F4F8CC3-FF89-11D1-9F63-0020182D7E20}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Toepassing Optimalisatie Start.job
Onderhoud-Schijfcontrole.job
Onderhoud-Schijfopruiming.job
--------------------------------------------------
Enumerating Download Program Files:
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE =
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE =
http://windowsupdate.microsoft.com/R899/V31Controls/x86/w98/en/actsetup.cab
[{8522F9B3-38C5-4AA4-AE40-7401F1BBC851}]
CODEBASE =
http://hjem.sol.no/windowsmooi/mp3_plugin.exe
[{11111111-1111-1111-1111-111111111111}]
CODEBASE =
http://209.25.173.4/php/scott12/scott12.php
[{4E15D681-1D20-11D4-8B72-000021DA1956}]
CODEBASE =
http://www.fotovanjehuis.nl/start/foto.exe
[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE =
http://www.apple.com/qtactivex/qtplugin.cab
[{018B7EC3-EECA-11D3-8E71-0000E82C6C0D}]
CODEBASE =
http://c2.mp3-2002.com/freedownload.exe
[HouseCall Besturing]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE =
http://a840.g.akamai.net/7/840/537/2002112801/housecall.antivirus.com/housecall/xscan53.cab
[BrowseFolderPopup Class]
CODEBASE =
http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
[Video Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\VIDEOX.DLL
CODEBASE =
http://spystream.babenet.com/cabs/videox.cab
[plug Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\CHARGI~1.DLL
CODEBASE =
http://dist02.chargitdial.com/chargitplug.dll
[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN51.OCX
CODEBASE =
http://www.housecall.nl/housecall/xscan4.cab
[{A45F39DC-3608-4237-8F0E-139F1BC49464}]
CODEBASE =
http://216.187.80.232/files/900017/101375/sex-viewer.exe
[sys Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE =
http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
[TDServer Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\TDSERVER.OCX
CODEBASE =
http://www.bitstream.com/wfplayer/tdserver.cab
[{A1DC3241-B122-195F-B21A-000000000000}]
CODEBASE =
http://www.blowsearch.com/TB/The_Ultimate_Browser_Enhancer.exe
[DialXSCtl Object]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\DIAL.OCX
CODEBASE =
http://x0.nl/install/dial.ocx
[{50A28604-52F2-11D6-8F0F-5254AB11D5C2}]
CODEBASE =
http://directplugin.com/dialers/109620.exe
[Loader Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MACONNECT.DLL
CODEBASE =
http://connect.online-dialer.com/MaConnect.cab
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\SHOCKWAVE 8\DOWNLOAD.DLL
CODEBASE =
http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE =
http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37607.450787037
[Fairtale.Class1]
CODEBASE =
http://www.fairtale.com/dialer/fairtale.cab
[IEAnimBehaviorFactory Class]
InProcServer32 = C:\Program Files\Common Files\Microsoft Shared\msorun\MSORUN.DLL
CODEBASE =
http://download.microsoft.com/download/vizact2000/Install/10/WIN98Me/EN-US/msorun.cab
--------------------------------------------------
Enumerating Winsock LSP files:
Protocol #1: C:\PROGRAM FILES\ESAFE\PROTECT\EspSock2.Dll
Protocol #2: C:\PROGRAM FILES\ESAFE\PROTECT\EspSock2.Dll
Protocol #9: C:\PROGRAM FILES\ESAFE\PROTECT\EspSock2.Dll
--------------------------------------------------
End of report, 9.772 bytes
Report generated in 3,315 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only