Archief - Log (Xinstall.exe malware)

Logfile of HijackThis v1.99.1
Scan saved at 20:53:50, on 19/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PRINTV~1\pvmodule.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Desktop Sidebar\dsidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\msgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\{30B16893-0707-2067-1206-050929050020}\Update.exe
C:\Documents and Settings\powerbits\Bureaublad\eigen map\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\MI-2510T Optical Combi Tilt Mouse\moffice.exe
O4 - HKLM\..\Run: [TQ566808] "D:\Setup.exe"
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e8.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_e8.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e8.exe
O4 - HKLM\..\Run: [PVModule] C:\PROGRA~1\PRINTV~1\pvmodule.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://xonsky.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: ShellScrap - C:\WINDOWS\system32\ktl4l73q1.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Klik om te vergroten...

Combofix zei:

powerbits - 06-09-20 12:55:45.04 Service Pack 2
ComboFix 06.09.20 - Running from: "C:\Program Files\Mozilla Firefox"

((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))

REGISTRY ENTRIES REMOVED:

[HKEY_CLASSES_ROOT\CLSID\{DF889709-6356-4DFB-A3D7-28C2C45B90BC}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DF889709-6356-4DFB-A3D7-28C2C45B90BC}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DF889709-6356-4DFB-A3D7-28C2C45B90BC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DF889709-6356-4DFB-A3D7-28C2C45B90BC}\InprocServer32]
@="C:\\WINDOWS\\system32\\wrbcheck.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{FD183CF2-4374-411F-BFF2-6BF2C92A13A6}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FD183CF2-4374-411F-BFF2-6BF2C92A13A6}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FD183CF2-4374-411F-BFF2-6BF2C92A13A6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FD183CF2-4374-411F-BFF2-6BF2C92A13A6}\InprocServer32]
@="C:\\WINDOWS\\system32\\wdcltui.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{0053DC94-A6FA-4320-803C-F56D5A7144AD}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0053DC94-A6FA-4320-803C-F56D5A7144AD}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0053DC94-A6FA-4320-803C-F56D5A7144AD}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0053DC94-A6FA-4320-803C-F56D5A7144AD}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


Granting sedebugprivilege to Administrators ... successful


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\dfndrff_e7.exe
C:\dfndrff_e8.exe
C:\dfndrff_e9.exe
C:\drsmartload.exe
C:\deskbar.exe
C:\deskbar7.exe
C:\deskbar8.exe
C:\kybrdff_e7.exe
C:\kybrdff_e8.exe
C:\kybrdff_e9.exe
C:\nwnmff_e7.exe
C:\warebundlenewer.exe
C:\Documents and Settings\powerbits\Local Settings\Temporary Internet Files\Content.IE5\H8OFPX4P\dfndrff_e[1].exe
C:\Documents and Settings\powerbits\Local Settings\Temporary Internet Files\Content.IE5\A17OT03E\drsmartload1135a[1].exe
C:\Documents and Settings\powerbits\Local Settings\Temporary Internet Files\Content.IE5\H8OFPX4P\kybrdff_e[1].exe
C:\Documents and Settings\powerbits\Local Settings\Temporary Internet Files\Content.IE5\VJTNVTOW\nwnmff_e[1].exe
C:\Documents and Settings\powerbits\Local Settings\Temporary Internet Files\Content.IE5\VJTNVTOW\nwnmff_e[2].exe
C:\WINDOWS\system32\ismini.exe
C:\WINDOWS\system32\isnotify.exe
C:\WINDOWS\system32\issearch.exe
C:\mte3ndi6odoxng.exe
C:\ucmoreiex.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\system32\ixt0.dll
C:\Program Files\Inetget2
C:\Program Files\Ipwins
C:\Program Files\network monitor
C:\Program Files\ToolBar888
C:\Program Files\windows
C:\WINDOWS\system32\components
C:\Program Files\Common Files\{30B16893-0708-2067-1206-050929050020}
C:\Program Files\Deskbar
C:\Program Files\Common Files\{30B16893-0707-2067-1206-050929050020}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\WINDOWS\FNTS~1
C:\QooBox\Purity\WINDOWS\FNTS~1\F?nts


((((((((((((((((((((((((((((((( Files Created from 2006-08-20 to 2006-09-20 ))))))))))))))))))))))))))))))))))


2006-09-20 12:44 676,081 --a------ C:\deskbar_e9.exe
2006-09-20 12:19 235,857 -r--s---- C:\WINDOWS\system32\n8l80i3ue8.dll
2006-09-20 12:19 235,019 -r--s---- C:\WINDOWS\system32\wrbcheck.dll
2006-09-19 21:14 86,068 --a------ C:\WINDOWS\system32\oylgqjoi.dll
2006-09-19 21:14 743,331 ---hs---- C:\WINDOWS\system32\qrutv.bak1
2006-09-19 21:14 577,588 ---hs---- C:\WINDOWS\system32\vturq.dll
2006-09-19 21:08 94,208 --a------ C:\WINDOWS\system32\uhvjsul.dll
2006-09-19 21:08 72,704 --a------ C:\WINDOWS\system32\unaoakg.dll
2006-09-19 21:08 40,973 ---hs---- C:\WINDOWS\system32\vtuvtqr.dll
2006-09-19 20:40 235,019 -r--s---- C:\WINDOWS\system32\mydrv.dll
2006-09-19 20:40 233,582 -r--s---- C:\WINDOWS\system32\irj2l51o1.dll
2006-09-19 18:47 96,768 --a------ C:\WINDOWS\system32\dxclib303562752.dll
2006-09-19 18:47 365,568 --a------ C:\WINDOWS\system32\bkd.exe
2006-09-19 18:47 32,768 --a------ C:\DXC1205b.exe
2006-09-19 18:45 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-09-18 19:37 20,480 --a------ C:\drsmartload45a45a45a.exe
2006-09-18 18:37 578,560 --a------ C:\Installer4.exe
2006-09-05 20:25 99,368 --a------ C:\WINDOWS\system32\MABRYOBJ.DLL
2006-09-05 20:25 188,416 --a------ C:\WINDOWS\system32\HTTPX.DLL
2006-08-20 14:50 299,008 --a------ C:\WINDOWS\uninst.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-20 12:58 -------- dr------- C:\Program Files\Common Files
2006-09-20 12:55 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-20 12:54 -------- d-------- C:\Documents and Settings\powerbits\Application Data\Skype
2006-09-20 12:51 -------- d-------- C:\Program Files\MSN Messenger
2006-09-20 12:45 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-20 12:43 -------- d-------- C:\Program Files\SpeedFan
2006-09-19 22:29 -------- d-------- C:\Documents and Settings\powerbits\Application Data\Desktop Sidebar
2006-09-19 21:12 777472 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-09-19 21:12 4992 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2006-09-19 21:12 4288 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-09-19 21:12 27904 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-09-19 21:12 23424 --a------ C:\WINDOWS\system32\drivers\avgmfrs.sys
2006-09-19 21:12 -------- d-------- C:\Program Files\Grisoft
2006-09-19 21:12 -------- d-------- C:\Documents and Settings\powerbits\Application Data\AVG7
2006-09-19 19:31 -------- d-------- C:\Documents and Settings\powerbits\Application Data\Xfire
2006-09-19 18:54 -------- d-------- C:\Program Files\Hitman Pro
2006-09-19 18:53 122280 --a------ C:\Documents and Settings\powerbits\Application Data\Dxcknwrd.dll
2006-09-19 18:47 -------- d-------- C:\Program Files\DeluxeCommunications
2006-09-19 18:45 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-09-19 18:44 -------- d-------- C:\Program Files\PrintView
2006-09-18 22:02 -------- d-------- C:\Program Files\TrackMania Nations ESWC
2006-09-17 19:02 -------- d-------- C:\Program Files\mIRC
2006-09-17 17:57 -------- d-------- C:\Program Files\EA GAMES
2006-09-16 16:49 -------- d-------- C:\Program Files\Messenger Plus! Live
2006-09-13 21:59 -------- d-------- C:\Program Files\Soldier of Fortune II - Double Helix
2006-09-13 17:27 -------- d-------- C:\Documents and Settings\powerbits\Application Data\Identities
2006-09-13 12:20 -------- d---s---- C:\Program Files\Xfire
2006-09-10 00:27 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-09-09 22:32 -------- d-------- C:\Program Files\Activision
2006-09-09 18:04 -------- d---s---- C:\Documents and Settings\powerbits\Application Data\Microsoft
2006-09-09 18:04 -------- d-------- C:\Program Files\Valve
2006-09-06 14:59 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2006-09-06 14:59 -------- d-------- C:\Program Files\DAEMON Tools
2006-09-06 14:44 223128 --a------ C:\WINDOWS\system32\drivers\vaxscsi.sys
2006-09-06 14:16 96256 --a------ C:\WINDOWS\system32\drivers\sptd4029.sys
2006-09-06 14:16 643072 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2006-09-06 13:37 -------- d-------- C:\Program Files\m3ga_tool
2006-09-03 14:35 -------- dr------- C:\Program Files\Common Files\Microsoft Shared
2006-09-03 14:35 -------- d-------- C:\Program Files\Microsoft Works
2006-09-03 14:35 -------- d-------- C:\Program Files\Microsoft Visual Studio
2006-09-02 18:09 49152 --a------ C:\WINDOWS\system32\redboxsd.dll
2006-09-02 18:09 27648 --a------ C:\WINDOWS\system32\redboxun.exe
2006-09-02 13:22 -------- d-------- C:\Program Files\Real Alternative
2006-09-02 13:22 -------- d-------- C:\Program Files\Media Player Classic
2006-09-02 13:22 -------- d-------- C:\Documents and Settings\powerbits\Application Data\Real
2006-09-02 13:22 -------- d-------- C:\Documents and Settings\powerbits\Application Data\Media Player Classic
2006-08-21 14:28 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 11:14 128896 --------- C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-20 14:53 -------- d-------- C:\Program Files\Electronic Arts
2006-08-14 23:33 -------- d-------- C:\Program Files\WarRock
2006-08-13 15:27 -------- d-------- C:\Program Files\Common Files\DirectX
2006-08-13 12:29 -------- d-------- C:\Program Files\Wolfenstein - Enemy Territory
2006-08-12 21:56 -------- d-------- C:\Program Files\Common Files\Adobe
2006-08-12 21:56 -------- d-------- C:\Program Files\Adobe
2006-08-12 21:54 -------- d-------- C:\Documents and Settings\powerbits\Application Data\Adobe
2006-08-12 11:43 -------- d-------- C:\Program Files\Internet Explorer
2006-08-11 19:58 -------- d-------- C:\Program Files\Skype
2006-08-07 17:51 -------- d-------- C:\Program Files\xirc
2006-08-02 21:00 -------- d-------- C:\Program Files\GIMP-2.0
2006-08-02 20:59 -------- d-------- C:\Program Files\Common Files\GTK
2006-08-01 20:58 -------- d-------- C:\Documents and Settings\powerbits\Application Data\Macromedia
2006-08-01 20:36 -------- d-------- C:\Program Files\Common Files\Macromedia
2006-08-01 20:34 -------- d-------- C:\Program Files\Macromedia
2006-07-31 15:56 -------- d-------- C:\Program Files\Infogrames
2006-07-31 15:42 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-07-31 15:42 -------- d-------- C:\Program Files\EACOM
2006-07-31 15:40 -------- d-------- C:\Program Files\EA SPORTS
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-27 15:27 -------- d-------- C:\Program Files\Desktop Sidebar
2006-07-27 15:26 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-27 00:06 -------- d-------- C:\Program Files\Globe Software
2006-07-23 22:28 -------- d-------- C:\Program Files\LimeWire Pro
2006-07-23 22:24 -------- d-------- C:\Program Files\Java
2006-07-23 22:20 -------- d-------- C:\Program Files\LimeWire
2006-07-23 20:19 -------- d-------- C:\Program Files\K-Lite Codec Pack
2006-07-21 10:29 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-07-20 19:03 62592 --a------ C:\WINDOWS\system32\drivers\moufiltr.sys
2006-07-20 19:03 -------- d-------- C:\Program Files\Trust
2006-06-25 19:30 8 --a------ C:\Documents and Settings\powerbits\Application Data\usb.dat.bin
2006-06-22 07:17 69120 --a------ C:\WINDOWS\system32\ciodm.dll
2006-06-22 07:17 1440768 --a------ C:\WINDOWS\system32\query.dll
2006-06-12 22:03 568 --a------ C:\Documents and Settings\powerbits\Application Data\Hattrick Team Manager.lnk


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Creative Detector"="C:\\Program Files\\Creative\\MediaSource\\Detector\\CTDetect.exe /R"
"SIDEBAR"="\"C:\\Program Files\\Desktop Sidebar\\dsidebar.exe\""
"Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"Steam"="\"C:\\Program Files\\Valve\\Steam\\Steam.exe\" -silent"
"DeluxeCommunications"="C:\\Program Files\\DeluxeCommunications\\Dxc.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALi5289"="C:\\Program Files\\ULI5289\\ALi5289.exe"
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE"
"McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\" /StartedFromRunKey"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"Network Associates Error Reporting Service"="\"C:\\Program Files\\Common Files\\Network Associates\\TalkBack\\TBMon.exe\""
"SoundMan"="SOUNDMAN.EXE"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_07\\bin\\jusched.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"FLMOFFICE4DMOUSE"="C:\\Program Files\\Trust\\MI-2510T Optical Combi Tilt Mouse\\moffice.exe"
"TQ566808"="\"D:\\Setup.exe\""
"PVModule"="C:\\PROGRA~1\\PRINTV~1\\pvmodule.exe"
"DeluxeCommunications"="C:\\Program Files\\DeluxeCommunications\\Dxc.exe"
"uhvjsul.dll"="C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\uhvjsul.dll,mrpmvyf"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,9a,00,00,00,00,00,00,00,ea,03,00,00,e2,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"Spyware Doctor"=""

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"Spyware Doctor"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\!ewido]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ewido"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\GhostStartTrayApp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GhostStartTrayApp"
"hkey"="HKLM"
"command"="C:\\Program Files\\Norton SystemWorks\\Norton Ghost\\GhostStartTrayApp.exe"
"inimapping"="0"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturq
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winuns32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\One Button Checkup van Norton SystemWorks.job
C:\WINDOWS\tasks\Symantec Drmc.job
C:\WINDOWS\tasks\Symantec NetDetect.job

Completion time: Wed 20/09/2006 12:59:04.46
ComboFix.txt
ComboFix2.txt

Klik om te vergroten...

Logfile of HijackThis v1.99.1
Scan saved at 13:04:57, on 20/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\PRINTV~1\pvmodule.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Desktop Sidebar\dsidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\powerbits\Bureaublad\eigen map\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\MI-2510T Optical Combi Tilt Mouse\moffice.exe
O4 - HKLM\..\Run: [TQ566808] "D:\Setup.exe"
O4 - HKLM\..\Run: [PVModule] C:\PROGRA~1\PRINTV~1\pvmodule.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [uhvjsul.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\uhvjsul.dll,mrpmvyf
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://xonsky.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: dxclib303562752.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Klik om te vergroten...

• 
  Na de installatie, open Ewido Anti-Spyware 4.0:
  * onder "Status", klik op Change state naast "Resident shield".
  * onder "Update", klik op de Start update knop.
  * onder "Scanner", tab "Settings":
  • - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine.
    - onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
  Sluit Ewido. Laat het nog niet scannen.

• open ewido en klik op de Scanner tab bovenaan en klik dan op Complete System Scan. Deze scan zal heel je systeem afcannen dus dit kan een tijdje duren
• Ewido zal alle geïnfecteerde objecten aan de linkerkant tonen. Waneer de scan gedaan is, zal het alles naar de 'Quarantine' optie zetten. klik dan op de Apply all actions knop. Ewido zal dan het volgend bericht tonen aan de rechterkant: "All actions have been applied"
• Klik dan op "Save Report", en dan op "Save Report As". dit zal een rapport maken Wees zeker dat je het rapport makkelijk kunt terugvinden (ijvoorbeeld op je bureaublad).

Xonsky zei:

OK mijn vriend had deze topic voor mij gemaakt maar ik denk dat het best is dat ik verder ga hiermee.

als ik die status wil changen krijg ik een foutmelding:
Failed to activate resident shield.

Klik om te vergroten...

Smitrem zei:

smitRem © log file
version 3.2

by noahdfear


Microsoft Windows XP [versie 5.1.2600]
"IE"="6.0000"

Running from
C:\Documents and Settings\powerbits\Bureaublad\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Appinitdll check ........ Thank you Grinler!

dumphive.exe (C)2000-2004 Markus Stephany
REGEDIT4

[Windows]
"AppInit_DLLs"="dxclib303562752.dll"
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!


checking for drsmartload2 key


drsmartload2 key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
AlfaCleaner uninstaller NOT present
SpyFalcon uninstaller NOT present
SpywareQuake uninstaller NOT present
SpywareSheriff uninstaller NOT present
Trust Cleaner uninstaller NOT present
SpyHeal uninstaller NOT present
VirusBurst uninstaller NOT present
BraveSentry uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~

Online Security Guide.url
Security Troubleshooting.url


~~~ Favorites ~~~

Antivirus Test Online.url


~~~ system32 folder ~~~

amcompat.tlb
nscompat.tlb
logfiles


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 936 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN!

Klik om te vergroten...

Ewido zei:

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 15:02:40 23/09/2006

+ Scan result:



C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\DXC1205b.exe -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\Program Files\DeluxeCommunications\DxcBho.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\Program Files\DeluxeCommunications\DxcCore.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[1180] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[1388] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[1416] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[280] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[332] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[344] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[492] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[552] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
[600] C:\WINDOWS\system32\dxclib303562752.dll -> Adware.SurfSide : Cleaned with backup (quarantined).
C:\quarantine\5wypy15j.PIF.Vir -> Backdoor.MSNMaker.q : Error during cleaning.
C:\quarantine\E342E9CAd01.Vir -> Backdoor.MSNMaker.q : Error during cleaning.
C:\Program Files\m3ga_tool\m3ga_tool.exe -> Backdoor.Nucledor.101 : Cleaned with backup (quarantined).
C:\drsmartload45a45a45a.exe -> Downloader.Adload.ds : Cleaned with backup (quarantined).
C:\Program Files\Mozilla Firefox\drsmartload1135a.exe -> Downloader.Adload.fo : Cleaned with backup (quarantined).
C:\Documents and Settings\powerbits\Xinstall.exe -> Dropper.PurityScan.ag : Cleaned with backup (quarantined).
C:\quarantine\Xinstall.exe.Vir -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.0 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.1 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.10 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.11 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.12 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.13 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.14 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.15 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.16 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.17 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.18 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.19 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.2 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.20 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.21 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.22 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.23 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.24 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.25 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.26 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.27 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.28 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.29 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.3 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.30 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.31 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.32 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.33 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.4 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.5 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.6 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.7 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.8 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall.exe.Vir.9 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.0 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.1 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.10 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.11 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.12 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.13 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.14 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.15 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.16 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.17 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.18 -> Dropper.PurityScan.ag : Cleaned with backup (quarantined).
C:\quarantine\Xinstall[1].exe.Vir.19 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.2 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.20 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.21 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.22 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.23 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.24 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.25 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.26 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.27 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.28 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.3 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.4 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.5 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.6 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.7 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.8 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[1].exe.Vir.9 -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[2].exe.Vir -> Dropper.PurityScan.ag : Error during cleaning.
C:\quarantine\Xinstall[2].exe.Vir.0 -> Dropper.PurityScan.ag : Error during cleaning.
C:\Documents and Settings\powerbits\Mijn documenten\Mijn Downloads\hdd.exe -> Not-A-Virus.BadJoke.DOS.Water.a : Cleaned with backup (quarantined).
:mozilla.44:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.45:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.46:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.47:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.48:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.49:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.50:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.51:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.52:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.53:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.54:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.55:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup (quarantined).
:mozilla.100:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.101:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.102:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.103:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.104:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.56:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.57:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.58:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.59:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.26:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.27:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.28:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.29:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.30:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.31:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.112:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.113:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.114:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.115:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.116:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.36:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.37:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.38:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.39:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.40:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.127:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.141:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup (quarantined).
:mozilla.125:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.70:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.71:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.72:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.73:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.74:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.75:C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
C:\Documents and Settings\powerbits\Mijn documenten\Mijn Downloads\photo223.PIF -> Worm.Licat.c : Cleaned with backup (quarantined).
C:\Documents and Settings\powerbits\Local Settings\Temporary Internet Files\Content.IE5\VJTNVTOW\sprY[1].exe -> Worm.VB.aj : Cleaned with backup (quarantined).
C:\Program Files\Mozilla Firefox\sprY.exe -> Worm.VB.aj : Cleaned with backup (quarantined).


::Report end

Klik om te vergroten...

panda zei:

Incident Status Location

Virus:Trj/DisableKey.A Disinfected Operating system
Adware:Adware/SaveNow Not disinfected C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll
Virus:Trj/DisableKey.A Disinfected Operating system
Adware:adware/dollarrevenue Not disinfected c:\windows\keyboard1.dat
Adware:adware/savenow Not disinfected Windows Registry
Adware:adware/ucmore Not disinfected Windows Registry
Adware:adware/whenusearch Not disinfected Windows Registry
Adware:Adware/ActiveSearch Not disinfected C:\deskbar_e9.exe[deskbar.exe][deskbar.dll]
Adware:Adware/Maxifiles Not disinfected C:\Documents and Settings\powerbits\alfa.exe
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\powerbits\Application Data\Mozilla\Firefox\Profiles\vq31ojrf.default\cookies.txt[.metriweb.be/]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\powerbits\Bureaublad\smitRem\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\powerbits\Bureaublad\smitRem.exe[smitRem/Process.exe]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\powerbits\Cookies\powerbits@realmedia[1].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\powerbits\Mijn documenten\Mijn Downloads\smitRem(2).exe[smitRem/Process.exe]
Hacktool:HackTool/Flood Not disinfected C:\Kopie van Extreme +\sys\dlls\nHTMLn.dll
Adware:Adware/Maxifiles Not disinfected C:\Program Files\Lavasoft\Ad-Aware SE Personal\alfa.exe
Hacktool:HackTool/Flood Not disinfected C:\Program Files\mIRC\sys\dlls\nHTMLn.dll
Adware:Adware/Maxifiles Not disinfected C:\Program Files\Mozilla Firefox\alfa.exe
Adware:Adware/SaveNow Not disinfected C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\chrome\whenu_ff.jar[content/overlay.js]
Potentially unwanted tool:Application/Processor Not disinfected C:\Program Files\Mozilla Firefox\smitRem\Process.exe
Adware:Adware/CommAd Not disinfected C:\WINDOWS\cG93ZXJiaXRz\w36atrL2urlW.vbs
Virus:Trj/DisableKey.A Disinfected C:\WINDOWS\system32\uhvjsul.dll
Virus:Trj/DisableKey.A Disinfected C:\WINDOWS\system32\unaoakg.dll

Klik om te vergroten...

• Klik op Avenger.zip om het uit te pakken naar je bureaublad

• Onder "Script file to execute" kies "Input Script Manually".
• Klik op het vergrootglas icoontje die een niew venster zal openen met de naam "View/edit script"
• Kopieer en plak volgend volledig vetgedrukt erin:
  

  Files to delete:
  C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll c:\windows\keyboard1.dat
  C:\deskbar_e9.exe
  C:\Documents and Settings\powerbits\alfa.exe
  C:\Program Files\Lavasoft\Ad-Aware SE Personal\alfa.exe
  C:\Program Files\Mozilla Firefox\alfa.exe
  C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\chrome\whenu_ff.jar
  
  Folders to delete:
  C:\WINDOWS\cG93ZXJiaXRz
  C:\quarantine

  Klik om te vergroten...

  
  Opgelet: Bovenstaande code werd enkel gemaakt voor deze computer/situatie/user. Indien je deze code op een andere computer gebruikt kan het schade toebrengen!
• Klik Done
• Daarna klik op het Groen verkeerslicht om het script uit te voeren
• Antwoord "Yes/Ja" wanneer daarnaar gevraagd wordt.

• Uw computer herstarten. ( In gevallen waar het script een code bevat met "Drivers to Unload", dan zal The Avenger tweemaal uw systeem herstarten)
• Na herstart, zal het vlug een zwart command window openen. Dit is normaal.
• Na herstart, zal het een log maken die zal openen met de resultaten van The Avenger. Deze log zal te vinden zijn op C:\avenger.txt
• The Avenger maakt ook backups aan met alle bestanden, etc., die eerder werden verwijderd door The Avenger, deze backups bevinden zich op volgende plaats: C:\avenger\backup.zip.

avenger.txt zei:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\sjugmysr

*******************

Script file located at: \??\C:\Program Files\kngwlgbb.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll c:\windows\keyboard1.dat for deletion
Deletion of file C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll c:\windows\keyboard1.dat failed!

Could not process line:
C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll c:\windows\keyboard1.dat
Status: 0xc0000033

File C:\deskbar_e9.exe deleted successfully.
File C:\Documents and Settings\powerbits\alfa.exe deleted successfully.
File C:\Program Files\Lavasoft\Ad-Aware SE Personal\alfa.exe deleted successfully.
File C:\Program Files\Mozilla Firefox\alfa.exe deleted successfully.
File C:\Program Files\Mozilla Firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\chrome\whenu_ff.jar deleted successfully.
Folder C:\WINDOWS\cG93ZXJiaXRz deleted successfully.
Folder C:\quarantine deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Klik om te vergroten...

Logfile of HijackThis v1.99.1
Scan saved at 17:05:01, on 23/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PRINTV~1\pvmodule.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Desktop Sidebar\dsidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\POWERB~1\LOCALS~1\Temp\Tijdelijke map 2 voor hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\MI-2510T Optical Combi Tilt Mouse\moffice.exe
O4 - HKLM\..\Run: [TQ566808] "D:\Setup.exe"
O4 - HKLM\..\Run: [PVModule] C:\PROGRA~1\PRINTV~1\pvmodule.exe
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://xonsky.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: dxclib303562752.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Klik om te vergroten...