Archief - logje checke

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:58:32, on 22-6-2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Wim\AppData\Local\Temp\cbXrqQhE.dll,#1
O4 - HKCU\..\Run: [Host Process] C:\Users\Wim\svchost.exe
O4 - HKCU\..\Run: [f2691d0c] rundll32.exe "C:\Users\Wim\AppData\Local\Temp\fgwqufea.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/VistaMSNPUpldnl-be.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD42/JSCDL...-jc.cab&File=jinstall-6u6-windows-i586-jc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

--
End of file - 6888 bytes

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

ComboFix 08-06-20.4 - Wim 2008-06-22 14:49:10.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1043.18.1051 [GMT 2:00]
Gestart vanuit: C:\Users\Wim\Downloads\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((( Bestanden Gemaakt van 2008-05-22 to 2008-06-22 ))))))))))))))))))))))))))))))
.

Geen nieuwe bestanden aangemaakt in deze periode

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-22 12:50 --------- d-----w C:\Users\Wim\AppData\Roaming\LimeWire
2008-06-22 10:58 --------- d-----w C:\Program Files\Trend Micro
2008-06-22 10:49 --------- d-----w C:\Program Files\LimeWire
2008-06-21 17:57 489 ----a-w C:\Users\Wim\397.bat
2008-06-21 17:57 1,879,040 ----a-w C:\Users\Wim\winlogon.exe
2008-06-13 08:51 --------- d-----w C:\Program Files\Google
2008-06-13 08:47 --------- d-----w C:\Program Files\QuickTime
2008-06-13 08:46 --------- d-----w C:\ProgramData\Apple Computer
2008-06-13 08:46 --------- d-----w C:\ProgramData\Apple
2008-06-13 08:46 --------- d-----w C:\Program Files\Apple Software Update
2008-06-12 03:55 --------- d-----w C:\Program Files\Windows Mail
2008-06-11 04:15 --------- d-----w C:\ProgramData\Microsoft Help
2008-06-02 14:27 --------- d-----w C:\Users\Wim\AppData\Roaming\DivX
2008-06-02 14:10 --------- d-----w C:\Users\Wim\AppData\Roaming\vlc
2008-06-02 14:09 --------- d-----w C:\Program Files\VideoLAN
2008-06-02 13:53 --------- d-----w C:\Program Files\DivX
2008-06-02 13:53 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-05-29 19:32 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-05-26 21:06 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-25 12:42 --------- d-----w C:\Program Files\Common Files\Nero
2008-05-25 12:41 --------- d-----w C:\ProgramData\Nero
2008-05-25 12:41 --------- d-----w C:\Program Files\Nero
2008-05-25 12:24 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-25 12:11 --------- d-----w C:\Program Files\NeroInstall.bak
2008-05-25 12:10 --------- d-----w C:\Users\Wim\AppData\Roaming\Nero
2008-05-24 09:37 174 --sha-w C:\Program Files\desktop.ini
2008-05-24 09:33 --------- d-----w C:\Program Files\Windows Defender
2008-05-24 09:33 --------- d-----w C:\Program Files\Windows Calendar
2008-05-24 09:32 --------- d-----w C:\Program Files\Windows Sidebar
2008-05-24 09:26 8,192 ----a-w C:\Windows\System32\riched32.dll
2008-05-24 09:26 77,824 ----a-w C:\Windows\System32\rascfg.dll
2008-05-24 09:26 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-05-24 09:26 52,736 ----a-w C:\Windows\System32\rasdiag.dll
2008-05-24 09:26 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-05-24 09:26 384,000 ----a-w C:\Windows\System32\netcfgx.dll
2008-05-24 09:26 32,768 ----a-w C:\Windows\System32\rasmxs.dll
2008-05-24 09:26 286,208 ----a-w C:\Windows\System32\ipnathlp.dll
2008-05-24 09:26 22,016 ----a-w C:\Windows\System32\rasser.dll
2008-05-24 09:26 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-05-24 09:26 13,824 ----a-w C:\Windows\System32\icsunattend.exe
2008-05-24 09:25 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-05-24 09:25 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-05-24 09:25 694,784 ----a-w C:\Windows\System32\localspl.dll
2008-05-24 09:25 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-05-24 09:25 39,424 ----a-w C:\Windows\System32\ACCTRES.dll
2008-05-24 09:25 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-05-24 09:25 33,280 ----a-w C:\Windows\System32\traffic.dll
2008-05-24 09:25 205,824 ----a-w C:\Windows\System32\msoeacct.dll
2008-05-24 09:25 15,360 ----a-w C:\Windows\System32\pacerprf.dll
2008-05-24 09:25 134,656 ----a-w C:\Windows\System32\dps.dll
2008-05-24 09:25 13,824 ----a-w C:\Windows\System32\wshqos.dll
2008-05-24 09:23 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-05-24 09:23 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-05-24 09:23 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-05-24 09:23 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-05-24 09:23 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-05-24 09:23 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-05-24 09:23 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-05-24 09:23 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-05-24 09:23 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-05-24 09:23 2,923,520 ----a-w C:\Windows\explorer.exe
2008-05-24 09:23 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-05-24 09:23 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-05-24 09:21 49,664 ----a-w C:\Windows\System32\csrsrv.dll
2008-05-24 09:21 376,320 ----a-w C:\Windows\System32\winsrv.dll
2008-05-24 09:19 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-05-24 09:19 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-05-24 09:16 414,208 ----a-w C:\Windows\System32\msscp.dll
2008-05-24 09:15 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-05-24 09:15 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-05-24 09:15 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-05-24 09:15 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-05-24 09:14 86,016 ----a-w C:\Windows\System32\icfupgd.dll
2008-05-24 09:14 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-05-24 09:14 61,952 ----a-w C:\Windows\System32\cmifw.dll
2008-05-24 09:14 396,800 ----a-w C:\Windows\System32\MPSSVC.dll
2008-05-24 09:14 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll
2008-05-24 09:14 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-05-24 09:14 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll
2008-05-24 09:14 16,896 ----a-w C:\Windows\System32\wfapigp.dll
2008-05-24 09:14 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-05-24 09:13 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-05-24 09:13 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-05-24 09:13 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-05-24 09:13 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-05-24 09:13 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-05-24 09:13 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-05-24 09:13 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-05-24 09:13 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-05-24 09:12 2,048 ----a-w C:\Windows\System32\msxml3r.dll
2008-05-24 09:12 104,448 ----a-w C:\Windows\System32\DWWIN.EXE
2008-05-24 09:12 1,191,936 ----a-w C:\Windows\System32\msxml3.dll
2008-05-24 09:11 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-05-24 09:11 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-05-24 09:11 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-05-24 09:11 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-05-24 09:11 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-05-24 09:07 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-05-24 09:06 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-05-24 09:06 296,448 ----a-w C:\Windows\System32\gdi32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2008-03-20 00:36 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-05-24 11:03 1232896]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 03:54 507904]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 17:07 1828136]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
"Host Process"="C:\Users\Wim\svchost.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-02 22:46 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-02 22:46 92704]
"RtHDVCpl"="RtHDVCpl.exe" [2007-01-18 08:46 4349952 C:\Windows\RtHDVCpl.exe]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{939CA66D-4D24-4AB1-ABD3-267543F12131}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{E59D5181-9F75-496A-8D0D-51B6B0D89F10}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{9EB9709A-4EF3-44E1-8FD9-6CBB76503709}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{5726186D-8609-4D4A-B2CE-DF739C514794}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{C00630D7-0CEC-46CB-8D0E-06048FC028A2}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{977337BB-DCCE-4377-9271-E4E217ACF672}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{7FFFCAB3-ADF8-4049-8CB6-5FC164D6FCCB}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{7388A0DF-4982-4F73-B269-8DC508ED1670}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{98052ABF-4774-4C74-A6E6-431B0976D0CE}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{FFBFA2BA-1CB9-4523-A72B-9A8418EE2326}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{C48ECB3C-B017-4E6C-94E8-9AE4FBC0F796}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{DE21D318-951D-4F26-8820-892B7B68FEFB}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{FB6BDDF4-8E49-462E-A9FB-518D5DCB91B6}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{09190B26-DBC6-497D-9B0E-A0328D32FE73}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{7B8F3DE6-5A3C-49A0-B344-9B5CEBA881F4}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{733D5DA8-20F6-4EFE-8DC1-269A7A816352}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|


*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-22 14:50:56
Windows 6.0.6000 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Users\Wim\AppData\Local\Temp\fgwqufea.dll
.
Voltooingstijd: 2008-06-22 14:51:43
ComboFix-quarantined-files.txt 2008-06-22 12:51:32

Kan het bericht voor berichtnummer 0x2379 niet vinden in berichtenbestand voor Application.
Kan het bericht voor berichtnummer 0x2379 niet vinden in berichtenbestand voor Application.

188 --- E O F --- 2008-06-20 05:01:28

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:58:32, on 22-6-2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Wim\AppData\Local\Temp\cbXrqQhE.dll,#1
O4 - HKCU\..\Run: [Host Process] C:\Users\Wim\svchost.exe
O4 - HKCU\..\Run: [f2691d0c] rundll32.exe "C:\Users\Wim\AppData\Local\Temp\fgwqufea.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/VistaMSNPUpldnl-be.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD42/JSCDL...-jc.cab&File=jinstall-6u6-windows-i586-jc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

--
End of file - 6888 bytes

* Download en bewaar SDFix
op je bureaublad.

Dubbelklik op SDFix.exe en kies voor Install om het tooltje uit te pakken in een eigen map op je bureaubad. Herstart dan je pc in Veilige modus

• In veilige modus, open de SDFix map op je bureaublad en dubbelklik op RunThis.bat om het tooltje te starten.
• Typ Y om het clean proces te starten.
• het verwijdert alle Trojan Services of Registry Entries die met deze infectie te maken hebben, als het tooltje klaar is zal het jou vertellen om eender welke toets te drukken om je pc te herstarten, doe dit ook.
• Wanneer de pc herstart zal het tooltje opnieuw runnen en het opruimproces beëindigen en je de melding Finished tonen, druk dan op eender welke toets om het scriptje te beëindigen en je bureaublad zullen tevoorschijn komen.
• Wanneer je bureaublad icoontjes verschijnen zal het rapportje van SDFix openen en ook in de map bewaren onder de naam Report.txt.
• Kopieer en plak nu de inhoud van dat rapportje hier met een nieuw hijackthis logje.