Archief - [bootfix] Zit msn virus er nog op?

Beste,

ik was dinsdag begonnen met het verwijderen van dit virus volgens de tutorial van jurgenv1 en ben er vandaag mee geëindigd. Ik doe dit op de PC van mijn vriendin omdat haar broer het virus heeft binnengehaald. Hoewel ik hem had gezegd dat hij msn niet meer mocht installeren heeft hij dit toch gedaan voordat ik alle stappen had uitgevoerd. Kunnen jullie even controleren of het virus nog op de PC staat?

Grtz,
Duffman

ps: sorry voor zinsbouw als hij onduidelijk is maar vrijdag na't school ist cafédag ...



ComboFix 06.11.27W - Running from: "C:\"

((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))

REGISTRY ENTRIES REMOVED:

[HKEY_CLASSES_ROOT\clsid\{289DBEBA-01B2-48D9-A868-4FA8A7FBE9A9}]
@=""

[HKEY_CLASSES_ROOT\clsid\{289DBEBA-01B2-48D9-A868-4FA8A7FBE9A9}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{289DBEBA-01B2-48D9-A868-4FA8A7FBE9A9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{289DBEBA-01B2-48D9-A868-4FA8A7FBE9A9}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\clsid\{4AD0E57B-26D1-4FA6-A424-9FA62D7B9066}]
@=""

[HKEY_CLASSES_ROOT\clsid\{4AD0E57B-26D1-4FA6-A424-9FA62D7B9066}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{4AD0E57B-26D1-4FA6-A424-9FA62D7B9066}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{4AD0E57B-26D1-4FA6-A424-9FA62D7B9066}\InprocServer32]
@="C:\\WINDOWS\\system32\\wsnscard.dll"
"ThreadingModel"="Apartment"

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


Granting sedebugprivilege to Administrators ... successful


((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\Bo\Application Data\Dxcknwrd.dll
C:\Documents and Settings\Kim\Application Data\Dxcknwrd.dll
C:\Documents and Settings\Robin\Application Data\Dxcknwrd.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\deskbar_e10.exe
C:\Program Files\Common Files\{1C2CB7FA-0AE8-2067-0628-040304100020}
C:\Program Files\Common Files\{1C2CB7FA-0AE9-2067-0628-040304100020}
C:\Program Files\Common Files\{3C2CB7FA-0AE8-2067-0628-040304100020}
C:\Program Files\Common Files\{3C2CB7FA-0AE9-2067-0628-040304100020}


((((((((((((((((((((((((((((((( Files Created from 2006-11-01 to 2006-12-01 ))))))))))))))))))))))))))))))))))


2006-11-30 20:33 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2006-11-30 18:53 <DIR> d-------- C:\WINDOWS\PB-SETUP
2006-11-25 21:21 502,368 --a------ C:\WINDOWS\system32\drivers\amon.sys
2006-11-25 21:21 274,432 --a------ C:\WINDOWS\system32\imon.dll
2006-11-25 21:21 <DIR> d-------- C:\Program Files\ESET
2006-11-25 20:46 1,886 --a------ C:\usetup.exe
2006-11-24 17:35 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2006-11-24 17:08 <DIR> d-------- C:\Program Files\Bots
2006-11-24 16:29 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe
2006-11-24 16:29 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll
2006-11-24 16:29 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll
2006-11-24 16:29 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll
2006-11-24 16:29 194,320 --a------ C:\WINDOWS\system32\qcut.dll
2006-11-24 16:29 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll
2006-11-24 16:29 10,240 --a------ C:\WINDOWS\system32\vidx16.dll
2006-11-24 16:29 <DIR> d-------- C:\Program Files\Disney Interactive
2006-11-23 19:51 <DIR> d-------- C:\Program Files\Warthog
2006-11-20 19:19 <DIR> d-------- C:\Program Files\MindJET
2006-11-17 11:34 <DIR> d-------- C:\Program Files\Guitar Pro 5
2006-11-17 09:02 3,584 --a------ C:\WINDOWS\system32\wmfhotfix.dll
2006-11-13 16:57 667,648 --a------ C:\WINDOWS\system32\dinput8.dll
2006-11-12 22:16 <DIR> d-------- C:\Documents and Settings\Kim\Application Data\ATI
2006-11-12 21:04 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-11-12 21:00 <DIR> d-------- C:\Program Files\ATI Technologies
2006-11-12 20:47 <DIR> dr--s---- C:\WINDOWS\assembly
2006-11-12 20:46 <DIR> d-------- C:\WINDOWS\Microsoft.NET
2006-11-12 20:44 <DIR> d-------- C:\ATI
2006-11-12 20:30 <DIR> d-------- C:\Program Files\18 WoS Across America
2006-11-10 22:14 225,280 --a------ C:\WINDOWS\system32\rewire.dll
2006-11-10 22:14 <DIR> d-------- C:\Program Files\VstPlugins
2006-11-10 22:13 <DIR> d-------- C:\Program Files\Image-Line
2006-11-08 21:38 <DIR> d-------- C:\Program Files\iMesh Applications
2006-11-08 16:02 <DIR> d-------- C:\Program Files\iTunes
2006-11-08 15:58 <DIR> d-------- C:\Program Files\Apple Software Update
2006-11-07 22:03 <DIR> d-------- C:\Documents and Settings\Kim\Application Data\vlc
2006-11-07 17:24 <DIR> d-------- C:\WINDOWS\Minidump
2006-11-07 16:28 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll
2006-11-07 16:28 974,848 --a------ C:\WINDOWS\system32\dxdiag.exe
2006-11-07 16:28 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys
2006-11-07 16:28 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe
2006-11-07 16:28 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll
2006-11-07 16:28 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll
2006-11-07 16:28 79,360 --a------ C:\WINDOWS\system32\dpwsockx.dll
2006-11-07 16:28 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll
2006-11-07 16:28 76,800 --a------ C:\WINDOWS\system32\dmscript.dll
2006-11-07 16:28 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll
2006-11-07 16:28 723,968 --a------ C:\WINDOWS\system32\dpnet.dll
2006-11-07 16:28 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys
2006-11-07 16:28 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll
2006-11-07 16:28 648,704 --a------ C:\WINDOWS\system32\dinput.dll
2006-11-07 16:28 64,512 --a------ C:\WINDOWS\system32\amstream.dll
2006-11-07 16:28 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll
2006-11-07 16:28 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll
2006-11-07 16:28 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys
2006-11-07 16:28 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys
2006-11-07 16:28 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys
2006-11-07 16:28 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll
2006-11-07 16:28 48,512 --a------ C:\WINDOWS\system32\drivers\stream.sys
2006-11-07 16:28 470,528 --a------ C:\WINDOWS\system32\qdvd.dll
2006-11-07 16:28 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll
2006-11-07 16:28 4,608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys
2006-11-07 16:28 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-11-07 16:28 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys
2006-11-07 16:28 381,952 --a------ C:\WINDOWS\system32\dsound.dll
2006-11-07 16:28 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll
2006-11-07 16:28 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll
2006-11-07 16:28 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll
2006-11-07 16:28 33,280 --a------ C:\WINDOWS\system32\dmloader.dll
2006-11-07 16:28 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll
2006-11-07 16:28 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll
2006-11-07 16:28 316,928 --a------ C:\WINDOWS\system32\qdv.dll
2006-11-07 16:28 31,744 --a------ C:\WINDOWS\system32\pid.dll
2006-11-07 16:28 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll
2006-11-07 16:28 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll
2006-11-07 16:28 292,864 --a------ C:\WINDOWS\system32\ddraw.dll
2006-11-07 16:28 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe
2006-11-07 16:28 27,136 --a------ C:\WINDOWS\system32\dmband.dll
2006-11-07 16:28 257,024 --a------ C:\WINDOWS\system32\qcap.dll
2006-11-07 16:28 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll
2006-11-07 16:28 230,400 --a------ C:\WINDOWS\system32\dplayx.dll
2006-11-07 16:28 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll
2006-11-07 16:28 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll
2006-11-07 16:28 181,248 --a------ C:\WINDOWS\system32\dmime.dll
2006-11-07 16:28 18,944 --a------ C:\WINDOWS\system32\encapi.dll
2006-11-07 16:28 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys
2006-11-07 16:28 18,432 --a------ C:\WINDOWS\system32\dswave.dll
2006-11-07 16:28 16,896 --a------ C:\WINDOWS\system32\msyuv.dll
2006-11-07 16:28 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe
2006-11-07 16:28 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys
2006-11-07 16:28 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys
2006-11-07 16:28 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys
2006-11-07 16:28 132,608 --a------ C:\WINDOWS\system32\devenum.dll
2006-11-07 16:28 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys
2006-11-07 16:28 13,312 --a------ C:\WINDOWS\system32\msdmo.dll
2006-11-07 16:28 122,880 --a------ C:\WINDOWS\system32\dmusic.dll
2006-11-07 16:28 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll
2006-11-07 16:28 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys
2006-11-07 16:28 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll
2006-11-07 16:28 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys
2006-11-07 16:28 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys
2006-11-07 16:28 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll
2006-11-07 16:28 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll
2006-11-07 16:28 1,769,472 --a------ C:\WINDOWS\system32\dxdiagn.dll
2006-11-07 16:28 1,703,936 --a------ C:\WINDOWS\system32\d3d9.dll
2006-11-07 16:28 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll
2006-11-07 16:28 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll
2006-11-07 16:28 1,201,152 --a------ C:\WINDOWS\system32\d3d8.dll
2006-11-07 16:28 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll
2006-11-05 17:24 <DIR> d-------- C:\Program Files\Planet Poker
2006-11-05 17:23 <DIR> d-------- C:\WINDOWS\PlayerStats
2006-11-05 10:36 29,696 --a------ C:\WINDOWS\mickey32.dll
2006-11-05 10:36 232,784 --a------ C:\WINDOWS\Matrix Code.scr
2006-11-05 10:36 2,285,222 --a------ C:\WINDOWS\Matrix Code.exe
2006-11-05 10:36 <DIR> d-------- C:\Program Files\AWS
2006-11-05 10:35 <DIR> d-------- C:\Program Files\Screensavers.com
2006-11-05 02:09 977,920 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-11-05 02:09 97,280 --a------ C:\WINDOWS\system32\txflog.dll
2006-11-05 02:09 82,432 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-11-05 02:09 64,512 --a------ C:\WINDOWS\system32\mtxclu.dll
2006-11-05 02:09 64,512 --a------ C:\WINDOWS\system32\colbact.dll
2006-11-05 02:09 596,480 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-11-05 02:09 499,200 --a------ C:\WINDOWS\system32\comuid.dll
2006-11-05 02:09 442,880 --a------ C:\WINDOWS\system32\rpcrt4.dll
2006-11-05 02:09 365,568 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-11-05 02:09 226,816 --a------ C:\WINDOWS\system32\es.dll
2006-11-05 02:09 225,280 --a------ C:\WINDOWS\system32\catsrv.dll
2006-11-05 02:09 214,528 --a------ C:\WINDOWS\system32\rpcss.dll
2006-11-05 02:09 150,528 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-11-05 02:09 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-11-05 02:09 1,177,088 --a------ C:\WINDOWS\system32\comsvcs.dll
2006-11-05 02:09 1,105,408 --a------ C:\WINDOWS\system32\ole32.dll
2006-11-05 02:08 593,408 --a------ C:\WINDOWS\system32\h323msp.dll
2006-11-05 02:08 552,960 --a------ C:\WINDOWS\system32\rtcdll.dll
2006-11-05 02:08 48,640 --a------ C:\WINDOWS\system32\browser.dll
2006-11-05 02:08 455,680 --a------ C:\WINDOWS\system32\ipnathlp.dll
2006-11-05 02:08 36,864 --a------ C:\WINDOWS\system32\mf3216.dll
2006-11-05 01:59 <DIR> d-------- C:\Program Files\VideoLAN
2006-11-04 18:38 <DIR> d-------- C:\Program Files\Common Files\TerraGame Shared
2006-11-04 18:06 <DIR> d-------- C:\Program Files\Ubisoft
2006-11-02 11:07 <DIR> d-------- C:\Program Files\Bethesda Softworks


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-01 18:13 -------- d-------- C:\Program Files\Common Files
2006-12-01 18:10 -------- d-------- C:\Program Files\Mozilla Firefox
2006-12-01 18:07 -------- d-------- C:\Documents and Settings\Kim\Application Data\Azureus
2006-12-01 16:13 -------- d-------- C:\Program Files\Messenger
2006-12-01 16:13 -------- d-------- C:\Program Files\Hitman Pro
2006-11-30 20:33 -------- d-------- C:\Program Files\MSN Messenger
2006-11-30 20:33 -------- d-------- C:\Program Files\MSN
2006-11-28 17:01 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-11-27 20:23 139489 --a------ C:\mc2.V00exe
2006-11-27 20:23 -------- d-------- C:\Program Files\SpywareBlaster
2006-11-27 20:22 -------- d-------- C:\Program Files\Spyware Doctor
2006-11-26 20:32 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-26 13:02 -------- d-------- C:\Program Files\Windows Media Player
2006-11-25 21:35 139489 --a------ C:\WINDOWS\mc2.Vexe
2006-11-25 21:23 139489 --a------ C:\mc2.Vexe
2006-11-25 20:49 -------- d-------- C:\Program Files\Spybot - Search & Destroy
2006-11-24 16:24 -------- d-------- C:\Program Files\GameSpy Arcade
2006-11-16 16:07 -------- d-------- C:\Program Files\Wolfenstein - Enemy Territory
2006-11-12 20:46 -------- d-------- C:\Program Files\Internet Explorer
2006-11-10 19:23 -------- d-------- C:\Program Files\Rockstar Games
2006-11-10 16:56 -------- d---s---- C:\Documents and Settings\Kim\Application Data\Microsoft
2006-11-08 16:02 -------- d-------- C:\Program Files\iPod
2006-11-08 16:00 -------- d-------- C:\Program Files\QuickTime
2006-11-07 16:35 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-11-05 17:39 -------- d-------- C:\Program Files\Microsoft Games
2006-11-05 02:09 -------- d-------- C:\Program Files\NetMeeting
2006-11-01 09:01 -------- d-------- C:\Program Files\Soldier of Fortune II - Double Helix
2006-10-31 21:54 -------- d-------- C:\Program Files\Common Files\Blizzard Entertainment
2006-10-31 13:14 -------- d-------- C:\Program Files\Microsoft Office
2006-10-31 13:13 -------- d-------- C:\Program Files\Maxis
2006-10-28 13:38 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2006-10-24 20:18 -------- d-------- C:\Documents and Settings\Kim\Application Data\Apple Computer
2006-10-22 18:45 -------- d-------- C:\Program Files\EA GAMES
2006-10-22 17:36 -------- d-------- C:\Program Files\Common Files\DirectX
2006-10-21 18:25 -------- d-------- C:\Program Files\Empire Interactive
2006-10-20 15:34 -------- d-------- C:\Program Files\SLD Codec Pack
2006-10-16 21:48 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-14 09:33 -------- d-------- C:\Program Files\LimeWire
2006-10-10 17:56 -------- d-------- C:\Documents and Settings\Kim\Application Data\Adobe
2006-10-10 17:49 -------- d-------- C:\Program Files\DivX
2006-10-08 00:52 -------- d-------- C:\Program Files\Telemeter 3.0
2006-10-07 22:05 -------- d-------- C:\Program Files\Azureus
2006-09-23 21:26 2 -rahs-ot- C:\WINDOWS\winstart.bat
2006-09-23 18:35 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-09-19 15:43 109360 --a------ C:\WINDOWS\system32\GEARAspi.dll
2006-09-09 17:41 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-09-09 16:35 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2006-09-09 16:35 348160 --a------ C:\WINDOWS\system32\msvcr71.dll
2006-09-09 14:49 62 --ahs---- C:\Documents and Settings\Kim\Application Data\desktop.ini
2006-09-09 13:47 724992 --a------ C:\WINDOWS\iun6002.exe
2006-09-09 13:00 0 -rahs---- C:\MSDOS.SYS
2006-09-09 13:00 0 -rahs---- C:\IO.SYS
2006-09-09 13:00 0 --a------ C:\CONFIG.SYS
2006-09-09 13:00 0 --a------ C:\AUTOEXEC.BAT


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"Lexmark X74-X75"="\"C:\\Program Files\\Lexmark X74-X75\\lxbbbmgr.exe\""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"snpstd"="C:\\WINDOWS\\vsnpstd.exe"
"AdobeVersionCue"="C:\\Program Files\\Adobe\\Adobe Version Cue\\ControlPanel\\VersionCueTray.exe"
"Telemeter 3.0"="\"C:\\Program Files\\Telemeter 3.0\\telemeter3.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
"Hitman Pro Expiration Helper"="\"C:\\Program Files\\Hitman Pro\\xphelper.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2\AntiRepl]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2\AntiRepl\0]
"Operation"=dword:00000001
"Target"="\\??\\C:\\DOCUME~1\\Kim\\LOCALS~1\\Temp\\drmtemp1.htm"
"Source"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2\AntiRepl\1]
"Operation"=dword:00000001
"Target"="\\??\\C:\\DOCUME~1\\Kim\\LOCALS~1\\Temp\\drmtemp2.htm"
"Source"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2\AntiRepl\2]
"Operation"=dword:00000001
"Target"="\\??\\C:\\DOCUME~1\\Kim\\LOCALS~1\\Temp\\drmtemp3.htm"
"Source"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2\AntiRepl\3]
"Operation"=dword:00000000
"Target"="\\??\\C:\\WINDOWS\\System32\\wmasf.dll"
"Source"="\\??\\C:\\WINDOWS\\System32\\SETDE.tmp"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2\AntiRepl\4]
"Operation"=dword:00000000
"Target"="\\??\\C:\\WINDOWS\\System32\\wmvcore.dll"
"Source"="\\??\\C:\\WINDOWS\\System32\\SETEE.tmp"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2\AntiRepl\5]
"Operation"=dword:00000000
"Target"="\\??\\C:\\WINDOWS\\System32\\wmpshell.dll"
"Source"="\\??\\C:\\WINDOWS\\System32\\SET12A.tmp"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Spyware Doctor"=""

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Spyware Doctor"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\defender]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dfndrff_e12"
"hkey"="HKLM"
"command"="C:\\\\dfndrff_e12.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeluxeCommunications]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Dxc"
"hkey"="HKLM"
"command"="C:\\Program Files\\DeluxeCommunications\\Dxc.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keyboard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="kybrdff_e12"
"hkey"="HKLM"
"command"="C:\\\\kybrdff_e12.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

Completion time: 06-12-01 18:16:55.10
C:\ComboFix.txt ... 06-12-01 18:16

* Download en unzip Killbox naar je bureaublad.
Klik op killbox.exe.
Selecteer de optie "Delete on reboot".
In het veld "Full Path of File to Delete" kopieer en plak je het volgende:

C:\usetup.exe


Klik op de knop: single file (!Belangrijk!)

Daarna, Klik op de rode cirkel met het wit kruisje erin.
Killbox zal zeggen dat deze file zal verwijderd worden on reboot.. vraagt om nu te rebooten. Klik YES.

Je pc moet nu rebooten.

* Post dan een nieuw hijackthis logje hier.

Logfile of HijackThis v1.99.1
Scan saved at 1:55:20, on 3/12/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\MUSICA~1\mac.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\Kim\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.imesh.com/search/index.html?src=ssb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.imesh.com/search/index.html?src=ssb
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "C:\Program Files\Hitman Pro\xphelper.exe"
O4 - HKLM\..\Run: [Music Alarm Clock] C:\PROGRA~1\MUSICA~1\mac.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab50997.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe



Ik hoop dat het virus eraf is. Kan iemand toch nog eens dubbel checken. Misschien heb ik iets over het hoofd gezien.

Grtz,
Duffman-

Heb je ook nog het rapport van AVG antispyware?