Archief - jojotje86: MSN virus

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
j

jojotje86

Legacy Member
Q4S - 06-09-23 12:49:16.57 Service Pack 2
ComboFix 06.09.23.2 - Running from: "C:\Documents and Settings\Q4S\Bureaublad"

((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\dxclib303562752.dll
C:\Documents and Settings\Q4S\Application Data\Dxcdmns.dll
C:\Documents and Settings\Q4S\Application Data\Dxcknwrd.dll
C:\WINDOWS\system32\bkd.exe
C:\Program Files\DeluxeCommunications\Dxc.exe
C:\Program Files\DeluxeCommunications\DxcBho.dll
C:\Program Files\DeluxeCommunications\DxcCore.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\drsmartload1135a.exe
C:\WINDOWS\drsmartload2.dat
C:\WINDOWS\teller2.chk
C:\drsmartload.exe
C:\drsmartload45a45a45d.exe
C:\deskbar.exe
C:\kybrdff_e11.exe
C:\nwnmff_e11.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Program Files\network monitor
C:\Program Files\Deskbar
C:\Program Files\Common Files\{B8699240-0B28-2067-0818-040309140020}


((((((((((((((((((((((((((((((( Files Created from 2006-08-23 to 2006-09-23 ))))))))))))))))))))))))))))))))))


2006-09-22 23:03 945,936 --a------ C:\WINDOWS\system32\msjava.dll
2006-09-22 23:03 63,248 --a------ C:\WINDOWS\system32\javaprxy.dll
2006-09-22 23:03 49,424 --a------ C:\WINDOWS\system32\clspack.exe
2006-09-22 23:03 46,352 --a------ C:\WINDOWS\setdebug.exe
2006-09-22 23:03 404,752 --a------ C:\WINDOWS\system32\javart.dll
2006-09-22 23:03 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2006-09-22 23:03 286,992 --a------ C:\WINDOWS\system32\vmhelper.dll
2006-09-22 23:03 21,264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2006-09-22 23:03 187,152 --a------ C:\WINDOWS\system32\javacypt.dll
2006-09-22 23:03 172,304 --a------ C:\WINDOWS\system32\jview.exe
2006-09-22 23:03 171,792 --a------ C:\WINDOWS\system32\wjview.exe
2006-09-22 23:03 171,280 --a------ C:\WINDOWS\system32\jit.dll
2006-09-22 23:03 154,384 --a------ C:\WINDOWS\system32\msawt.dll
2006-09-22 23:03 15,120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2006-09-22 23:03 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2006-09-22 23:03 113 --a------ C:\WINDOWS\system32\zonedon.reg
2006-09-22 23:03 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2006-09-22 19:59 676,081 --a------ C:\deskbar_e11.exe
2006-09-22 19:19 20,480 --a------ C:\WINDOWS\system32\sprK.exe
2006-09-22 16:50 28,672 --a------ C:\WINDOWS\system32\mny.exe
2006-09-22 00:13 77,824 --a------ C:\WINDOWS\system32\driverif.dll
2006-09-22 00:13 75,776 --a------ C:\WINDOWS\zllsputility.exe
2006-09-22 00:13 733,236 --a------ C:\WINDOWS\system32\vete.dll
2006-09-22 00:13 12,288 --a------ C:\WINDOWS\system32\vetntmsg.dll
2006-09-21 21:45 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-09-21 21:29 20,480 --a------ C:\WINDOWS\system32\sprT.exe
2006-09-21 21:29 138,862 --a------ C:\WINDOWS\system32\alfa.exe
2006-09-21 21:29 1,233 --a------ C:\WINDOWS\system32\cnpbcc26.sys
2006-09-21 21:28 32,768 --a------ C:\DXC1205b.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-23 12:52 -------- d-------- C:\Program Files\Common Files
2006-09-23 12:38 -------- d-------- C:\Program Files\MSN Messenger
2006-09-22 23:32 -------- d-------- C:\Program Files\Telenet EasyCare
2006-09-22 23:05 -------- d-------- C:\Program Files\Common Files\Motive
2006-09-22 23:04 -------- d-------- C:\Program Files\Motive
2006-09-22 21:09 -------- d-------- C:\Program Files\NoAdware4
2006-09-22 00:12 -------- d-------- C:\Program Files\Zone Labs
2006-09-21 23:50 -------- d-------- C:\Program Files\Internet Explorer
2006-09-21 23:49 76560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2006-09-21 21:45 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-09-17 18:57 -------- d-------- C:\Documents and Settings\Q4S\Application Data\Xfire
2006-09-17 11:30 -------- d---s---- C:\Program Files\Xfire
2006-09-12 14:13 -------- d-------- C:\Program Files\Championship Manager 5
2006-09-04 12:27 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-09-02 18:17 -------- d-------- C:\Program Files\VentriloMIX
2006-09-02 18:11 -------- d-------- C:\Program Files\Ventrilo
2006-08-30 16:48 -------- d-------- C:\Program Files\TrackMania Nations ESWC
2006-08-21 14:28 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 11:14 128896 --------- C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-18 18:02 -------- d-------- C:\Documents and Settings\Q4S\Application Data\AdobeUM
2006-08-16 18:06 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-08-16 18:03 -------- d-------- C:\Documents and Settings\Q4S\Application Data\Apple Computer
2006-08-16 18:02 -------- d-------- C:\Program Files\QuickTime
2006-07-27 15:26 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-21 10:29 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="\"c:\\valve\\steam\\steam.exe\" -silent"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe"
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"SoundMan"="SOUNDMAN.EXE"
"BigDogPath"="C:\\WINDOWS\\VM_STI.EXE BenQ Web Camera"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb10.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"PvAgent"="C:\\Pvsw\\Bin\\PvAgent.exe"
"HP Software Update"="C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033"
"LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"Motive SmartBridge"="C:\\PROGRA~1\\TELENE~1\\SMARTB~1\\MotiveSB.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonceex]
@=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Symantec NetDetect.job
C:\WINDOWS\tasks\XoftSpy.job

Completion time: Sat 23/09/2006 12:53:12.50
ComboFix.txt
ComboFix2.txt
j

jojotje86

Legacy Member
Q4S - 06-09-23 15:57:11,40 Service Pack 2
ComboFix 06.09.23.2 - Running from: "C:\Documents and Settings\Q4S\Bureaublad"

((((((((((((((((((((((((((((((( Files Created from 2006-08-23 to 2006-09-23 ))))))))))))))))))))))))))))))))))


2006-09-22 23:03 945,936 --a------ C:\WINDOWS\system32\msjava.dll
2006-09-22 23:03 63,248 --a------ C:\WINDOWS\system32\javaprxy.dll
2006-09-22 23:03 49,424 --a------ C:\WINDOWS\system32\clspack.exe
2006-09-22 23:03 46,352 --a------ C:\WINDOWS\setdebug.exe
2006-09-22 23:03 404,752 --a------ C:\WINDOWS\system32\javart.dll
2006-09-22 23:03 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2006-09-22 23:03 286,992 --a------ C:\WINDOWS\system32\vmhelper.dll
2006-09-22 23:03 21,264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2006-09-22 23:03 187,152 --a------ C:\WINDOWS\system32\javacypt.dll
2006-09-22 23:03 172,304 --a------ C:\WINDOWS\system32\jview.exe
2006-09-22 23:03 171,792 --a------ C:\WINDOWS\system32\wjview.exe
2006-09-22 23:03 171,280 --a------ C:\WINDOWS\system32\jit.dll
2006-09-22 23:03 154,384 --a------ C:\WINDOWS\system32\msawt.dll
2006-09-22 23:03 15,120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2006-09-22 23:03 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2006-09-22 23:03 113 --a------ C:\WINDOWS\system32\zonedon.reg
2006-09-22 23:03 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2006-09-21 21:45 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-23 15:52 -------- d-------- C:\Program Files\Common Files
2006-09-23 14:56 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-23 14:32 -------- d-------- C:\Documents and Settings\Q4S\Application Data\Lavasoft
2006-09-23 14:29 -------- d-------- C:\Program Files\Lavasoft
2006-09-23 12:57 -------- d-------- C:\Program Files\MSN Messenger
2006-09-22 23:32 -------- d-------- C:\Program Files\Telenet EasyCare
2006-09-22 23:05 -------- d-------- C:\Program Files\Common Files\Motive
2006-09-22 23:04 -------- d-------- C:\Program Files\Motive
2006-09-22 21:09 -------- d-------- C:\Program Files\NoAdware4
2006-09-21 23:50 -------- d-------- C:\Program Files\Internet Explorer
2006-09-21 23:49 76560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2006-09-21 21:45 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-09-17 18:57 -------- d-------- C:\Documents and Settings\Q4S\Application Data\Xfire
2006-09-17 11:30 -------- d---s---- C:\Program Files\Xfire
2006-09-12 14:13 -------- d-------- C:\Program Files\Championship Manager 5
2006-09-04 12:27 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-09-02 18:17 -------- d-------- C:\Program Files\VentriloMIX
2006-09-02 18:11 -------- d-------- C:\Program Files\Ventrilo
2006-08-30 16:48 -------- d-------- C:\Program Files\TrackMania Nations ESWC
2006-08-21 14:28 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 11:14 128896 --------- C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-18 18:02 -------- d-------- C:\Documents and Settings\Q4S\Application Data\AdobeUM
2006-08-16 18:06 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-08-16 18:03 -------- d-------- C:\Documents and Settings\Q4S\Application Data\Apple Computer
2006-08-16 18:02 -------- d-------- C:\Program Files\QuickTime
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-27 15:26 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-21 10:29 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="\"c:\\valve\\steam\\steam.exe\" -silent"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="C:\\WINDOWS\\System32\\\\NeroCheck.exe"
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"SoundMan"="SOUNDMAN.EXE"
"BigDogPath"="C:\\WINDOWS\\VM_STI.EXE BenQ Web Camera"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb10.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"PvAgent"="C:\\Pvsw\\Bin\\PvAgent.exe"
"HP Software Update"="C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033"
"LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Motive SmartBridge"="C:\\PROGRA~1\\TELENE~1\\SMARTB~1\\MotiveSB.exe"
"!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonceex]
@=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Symantec NetDetect.job
C:\WINDOWS\tasks\XoftSpy.job

Completion time: Sat 23/09/2006 15:58:37.50
ComboFix.txt
ComboFix2.txt
ComboFix3.txt

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 15:50:17 23/09/2006

+ Scan result:



C:\!KillBox\DXC1205b.exe -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\Downloads\TacticalOpsSetup-dm[1].exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\!KillBox\mny.exe -> Downloader.Adload.fq : Cleaned with backup (quarantined).
C:\Documents and Settings\Q4S\Local Settings\Temporary Internet Files\Content.IE5\C84L43AD\mny[1].exe -> Downloader.Adload.fq : Cleaned with backup (quarantined).
C:\Documents and Settings\Q4S\mny.exe -> Downloader.Adload.fq : Cleaned with backup (quarantined).
C:\Documents and Settings\Q4S\Cookies\q4s@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
C:\Documents and Settings\Q4S\Cookies\q4s@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\!KillBox\sprT.exe -> Worm.Licat.c : Cleaned with backup (quarantined).
C:\Documents and Settings\Q4S\sprT.exe -> Worm.Licat.c : Cleaned with backup (quarantined).


::Report end
J

Jurgenv1

Legacy Member
Heb het naar hier gesplitst, an ik nu van jou alleen een ieuw hijackthis logje zien + een nieuw logje van combofix?
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan