Archief - check log plz

heb al cwshredder, ad-aware, panda antivirus geprobeerd en ben zo wa hopeloos, want mijne pc werkt nog steeds ni gelijk dat moet
kheb ook al met msconfig alles afgezet bij startup (versnelt het rebooten )


Logfile of HijackThis v1.99.1
Scan saved at 20:21:07, on 19/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\RGVzdHJv\command.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Documents and Settings\Destro\Desktop\HijackThis.exe

R3 - Default URLSearchHook is missing
O3 - Toolbar: Burn4Free Toolbar - {70DE7956-479D-4eb7-8641-2B45774C350E} - C:\Program Files\Burn4Free Toolbar\v2.0.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [MSConfig] C:\Documents and Settings\Destro\Desktop\Programma's\msconfig.exe /auto
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\k4pm0e71eh.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVzdHJv\command.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe

Het is misschien geen goed idee om alle startup items uit te schakelen. Mogelijk heb je ook de foute bestanden uitgevinkt. Hierdoor zijn ze misschien niet zichtbaar maar ze staan er nog wel steeds op.

merci vo de snelle respond
heb alles aangevinkt en bij het opstarten heeft panda al een virus verweiderd - daarnaa deze log gemaakt


Logfile of HijackThis v1.99.1
Scan saved at 20:56:19, on 19/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\RGVzdHJv\command.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\avciman.exe
C:\Documents and Settings\Destro\Desktop\Hijackthis\HijackThis.exe

O3 - Toolbar: Burn4Free Toolbar - {70DE7956-479D-4eb7-8641-2B45774C350E} - C:\Program Files\Burn4Free Toolbar\v2.0.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msresearch] C:\windows\msresearch.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [Qzsrjhb] C:\WINDOWS\system32\w?wexec.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Corl] "C:\Program Files\emal\raaa.exe" -vt tzt
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\hr0s05d7e.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVzdHJv\command.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe

Download L2mfix op een van deze links:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Bewaar het bestand op het bureablad en dubbelklik l2mfix.exe. Klik op de Install knop en volg de instructies. Open de l2mfix map die nu op het bureaublad staat. Dubbelklik l2mfix.bat en selecteer optie #1 voor Run Find Log (typ 1 en vervolgens enter) De PC wordt gescand. Na ongeveer 2 minuten zal er een kladblokbestand openen. Kopieer de inhoud van dit logje en post het hier.

BELANGRIJK: Selecteer optie 2 NIET zolang dit niet gevraagd wordt !!!!

probleempjen, als ik die file download en instaleer zegt em
'Cannot open l2mfix/Process.exe'
en direct na te instaleren zegt panda antivirus da em een hacking tool heeft geneutraliseerd

opties?

Even proberen:

schakel panda even uit en download de tool.
Panda terug inschakelen

gelukt
inhoud log:

L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Reinstall]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\hr0s05d7e.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{10224B5F-514E-94DF-F937-B31D3CBAB4D6}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{65756541-C65C-11CD-0000-4B656E696100}"="Panda Antivirus"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="Catalyst Context Menu extension"
"{2CA1AD2D-3DE0-409B-8DF9-D24BAC031075}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2CA1AD2D-3DE0-409B-8DF9-D24BAC031075}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2CA1AD2D-3DE0-409B-8DF9-D24BAC031075}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2CA1AD2D-3DE0-409B-8DF9-D24BAC031075}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2CA1AD2D-3DE0-409B-8DF9-D24BAC031075}\InprocServer32]
@="C:\\WINDOWS\\system32\\KF-PMKN.DLL"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
aacups.dll Wed 19 Oct 2005 20:25:30 ..S.R 235.572 230,05 K
ati2cqag.dll Wed 31 Aug 2005 3:42:50 A.... 233.472 228,00 K
ati2dvag.dll Wed 31 Aug 2005 4:42:54 A.... 238.592 233,00 K
ati2edxx.dll Wed 31 Aug 2005 4:37:22 A.... 39.936 39,00 K
ati2evxx.dll Wed 31 Aug 2005 4:37:12 A.... 46.080 45,00 K
ati3duag.dll Wed 31 Aug 2005 4:28:36 A.... 2.429.824 2,32 M
atiddc.dll Wed 31 Aug 2005 4:35:46 A.... 53.248 52,00 K
atidemgr.dll Wed 31 Aug 2005 6:33:32 A.... 258.048 252,00 K
atiiiexx.dll Wed 31 Aug 2005 7:08:36 A.... 307.200 300,00 K
atikvmag.dll Wed 31 Aug 2005 4:10:36 A.... 147.456 144,00 K
atioglx1.dll Wed 31 Aug 2005 5:57:50 A.... 6.684.672 6,38 M
atioglxx.dll Wed 31 Aug 2005 4:57:00 A.... 4.718.592 4,50 M
atipdlxx.dll Wed 31 Aug 2005 4:37:44 A.... 106.496 104,00 K
atitvo32.dll Wed 31 Aug 2005 3:47:46 A.... 17.408 17,00 K
ativvaxx.dll Wed 31 Aug 2005 4:23:04 A.... 600.672 586,59 K
atmtd.dll Wed 19 Oct 2005 16:35:24 A.... 687.592 671,48 K
browseui.dll Sat 3 Sep 2005 1:52:04 A.... 1.019.904 996,00 K
catsrv.dll Tue 26 Jul 2005 6:39:42 A.... 225.792 220,50 K
catsrvut.dll Tue 26 Jul 2005 6:39:44 A.... 625.152 610,50 K
cdfview.dll Sat 3 Sep 2005 1:52:04 A.... 151.040 147,50 K
cdosys.dll Sat 10 Sep 2005 3:53:42 A.... 2.067.968 1,97 M
clbcatex.dll Tue 26 Jul 2005 6:39:44 A.... 110.080 107,50 K
clbcatq.dll Tue 26 Jul 2005 6:39:44 A.... 498.688 487,00 K
cmdlin~1.dll Tue 27 Sep 2005 21:10:34 A.... 98.304 96,00 K
colbact.dll Tue 26 Jul 2005 6:39:44 A.... 60.416 59,00 K
comrepl.dll Tue 26 Jul 2005 6:39:44 A.... 97.792 95,50 K
comsvcs.dll Tue 26 Jul 2005 6:39:44 A.... 1.267.200 1,21 M
comuid.dll Tue 26 Jul 2005 6:39:46 A.... 540.160 527,50 K
d3dx9_27.dll Fri 22 Jul 2005 19:59:04 A.... 2.319.568 2,21 M
danim.dll Sat 3 Sep 2005 1:52:04 A.... 1.053.696 1,00 M
dxtrans.dll Sat 3 Sep 2005 1:52:04 A.... 205.312 200,50 K
es.dll Tue 26 Jul 2005 6:39:46 A.... 243.200 237,50 K
extmgr.dll Sat 3 Sep 2005 1:52:04 ..... 55.808 54,50 K
f4l0le~1.dll Wed 19 Oct 2005 18:49:30 ..S.R 234.272 228,78 K
hr0s05~1.dll Wed 19 Oct 2005 20:52:18 ..S.R 233.600 228,13 K
iepeers.dll Sat 3 Sep 2005 1:52:04 A.... 251.392 245,50 K
inseng.dll Sat 3 Sep 2005 1:52:04 A.... 96.256 94,00 K
ir48l5~1.dll Wed 19 Oct 2005 20:54:00 ..S.R 235.445 229,93 K
ivsso.dll Wed 19 Oct 2005 20:01:16 ..S.R 235.477 229,96 K
kf-pmkn.dll Wed 19 Oct 2005 20:54:00 ..S.R 233.600 228,13 K
legitc~1.dll Mon 29 Aug 2005 13:27:12 A.... 520.968 508,76 K
linkinfo.dll Thu 1 Sep 2005 3:41:54 A.... 19.968 19,50 K
mj4sdmod.dll Wed 19 Oct 2005 19:42:38 ..S.R 234.272 228,78 K
mqafd.dll Wed 19 Oct 2005 18:38:28 ..S.R 234.272 228,78 K
msdtcprx.dll Tue 26 Jul 2005 6:39:46 A.... 425.472 415,50 K
msdtctm.dll Tue 26 Jul 2005 6:39:48 A.... 945.152 923,00 K
msdtcuiu.dll Tue 26 Jul 2005 6:39:48 A.... 161.280 157,50 K
mshtml.dll Wed 5 Oct 2005 2:26:00 A.... 3.015.168 2,88 M
mshtmled.dll Sat 3 Sep 2005 1:52:06 A.... 448.512 438,00 K
msrating.dll Sat 3 Sep 2005 1:52:06 A.... 146.432 143,00 K
mstime.dll Sat 3 Sep 2005 1:52:06 A.... 530.432 518,00 K
mtxclu.dll Tue 26 Jul 2005 6:39:48 A.... 66.560 65,00 K
mtxoci.dll Tue 26 Jul 2005 6:39:48 A.... 91.136 89,00 K
ndtshell.dll Wed 19 Oct 2005 19:50:02 ..... 235.477 229,96 K
netman.dll Mon 22 Aug 2005 20:29:46 A.... 197.632 193,00 K
nwwks.dll Thu 11 Aug 2005 17:10:00 A.... 65.024 63,50 K
oemdspif.dll Wed 31 Aug 2005 4:37:34 A.... 73.728 72,00 K
ole32.dll Tue 26 Jul 2005 6:39:48 A.... 1.285.120 1,22 M
olecli32.dll Tue 26 Jul 2005 6:39:48 A.... 74.752 73,00 K
olecnv32.dll Tue 26 Jul 2005 6:39:50 A.... 37.888 37,00 K
pncrt.dll Tue 16 Aug 2005 17:18:54 A.... 278.528 272,00 K
pndx5016.dll Tue 16 Aug 2005 17:18:54 A.... 6.656 6,50 K
pndx5032.dll Tue 16 Aug 2005 17:18:54 A.... 5.632 5,50 K
pngfilt.dll Sat 3 Sep 2005 1:52:06 A.... 39.424 38,50 K
qrvd.dll Wed 19 Oct 2005 19:57:18 ..S.R 236.510 230,96 K
quartz.dll Tue 30 Aug 2005 5:54:26 A.... 1.287.168 1,23 M
rmoc3260.dll Tue 16 Aug 2005 17:18:58 A.... 176.167 172,04 K
rpcss.dll Tue 26 Jul 2005 6:39:50 A.... 397.824 388,50 K
sdsinv.dll Wed 19 Oct 2005 16:31:52 ..S.R 234.272 228,78 K
shdocvw.dll Sat 3 Sep 2005 1:52:06 A.... 1.483.776 1,41 M
shell32.dll Fri 23 Sep 2005 5:05:30 A.... 8.450.560 8,06 M
shlwapi.dll Sat 3 Sep 2005 1:52:06 A.... 473.600 462,50 K
sintf16.dll Tue 16 Aug 2005 0:52:46 A.... 12.067 11,78 K
sintf32.dll Tue 16 Aug 2005 0:52:46 A.... 17.212 16,81 K
sintfnt.dll Tue 16 Aug 2005 0:52:46 A.... 21.840 21,33 K
symsrv.dll Wed 19 Oct 2005 20:04:10 ..... 236.510 230,96 K
txflog.dll Tue 26 Jul 2005 6:39:50 A.... 101.376 99,00 K
umpnpmgr.dll Tue 23 Aug 2005 5:35:42 A.... 123.392 120,50 K
urlmon.dll Sat 3 Sep 2005 1:52:06 A.... 608.768 594,50 K
wininet.dll Sat 3 Sep 2005 1:52:06 A.... 658.432 643,00 K
winsrv.dll Thu 1 Sep 2005 3:41:54 A.... 291.840 285,00 K
xolehlp.dll Tue 26 Jul 2005 6:39:50 A.... 11.776 11,50 K

82 items found: 82 files (10 H/S), 0 directories.
Total of file sizes: 52.927.557 bytes 50,47 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 9CB9-235D

Directory of C:\WINDOWS\System32

19/10/2005 20:53 233.600 KF-PMKN.DLL
19/10/2005 20:53 235.445 ir48l5hu1.dll
19/10/2005 20:52 233.600 hr0s05d7e.dll
19/10/2005 20:25 235.572 aacups.dll
19/10/2005 20:01 235.477 ivsso.dll
19/10/2005 19:57 236.510 qrvd.dll
19/10/2005 19:42 234.272 mj4sdmod.dll
19/10/2005 18:49 234.272 f4l0le3m1h.dll
19/10/2005 18:38 234.272 mqafd.dll
19/10/2005 16:31 234.272 sdsinv.dll
12/10/2005 14:11 <DIR> dllcache
03/08/2005 23:58 <DIR> Microsoft
10 File(s) 2.347.292 bytes
2 Dir(s) 215.326.179.328 bytes free

Sluit alle programma's, dit gedeelte vereist een heropstart van de PC.

Open de l2mfix map op je bureaublad en dubbelklik op l2mfix.bat. Kies optie #2 Run Fix (typ 2 en vervolgens enter). Druk op een toets om de PC te herstarten. Het is mogelijk dat na de herstart het bureaublad en de icoontjes verdwijnen. L2mfix zal nu de PC verder scannen. Na de scan verschijnt er een kladblokbestand. Kopieer de inhoud van dit bestand en post het in deze thread samen met een nieuw HJT log.

BELANGRIJK: Run geen andere bestanden in de L2mfix map zolang dit niet gevraagd wordt!
Indien na de herstart de icoontjes niet verdwijnen of de log verschijnt niet: dubbelklik dan op het second.bat bestand om verder te gaan met de fix.

was op tweedaagse met school, maar ben terug
ff update
heb ondertussen al is gescanned met hitman pro 2.2.1 en hij heeft precies hier en daar iets gevonden

doe ik nog steeds de L2mfix.bat ect?

Yep,
Gewoon doorgaan met de fix en nadien de logjes posten

L2mfix log:
L2Mfix 1.04a

Running From:
C:\Documents and Settings\Destro\Desktop\Installers\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

Setting Directory
C:\Documents and Settings\Destro\Desktop\Installers\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Destro\Desktop\Installers\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 268 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1900 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\aacups.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cuyptui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\f4l0le3m1h.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ivsso.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jlcript.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jwsh400.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KF-PMKN.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kodfo.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kqdhu1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mj4sdmod.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mqafd.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ndtshell.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\qrvd.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ricss.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sdsinv.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sYmsrv.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\aacups.dll
Successfully Deleted: C:\WINDOWS\system32\aacups.dll
deleting: C:\WINDOWS\system32\cuyptui.dll
Successfully Deleted: C:\WINDOWS\system32\cuyptui.dll
deleting: C:\WINDOWS\system32\f4l0le3m1h.dll
Successfully Deleted: C:\WINDOWS\system32\f4l0le3m1h.dll
deleting: C:\WINDOWS\system32\ivsso.dll
Successfully Deleted: C:\WINDOWS\system32\ivsso.dll
deleting: C:\WINDOWS\system32\jlcript.dll
Successfully Deleted: C:\WINDOWS\system32\jlcript.dll
deleting: C:\WINDOWS\system32\jwsh400.dll
Successfully Deleted: C:\WINDOWS\system32\jwsh400.dll
deleting: C:\WINDOWS\system32\KF-PMKN.DLL
Successfully Deleted: C:\WINDOWS\system32\KF-PMKN.DLL
deleting: C:\WINDOWS\system32\kodfo.dll
Successfully Deleted: C:\WINDOWS\system32\kodfo.dll
deleting: C:\WINDOWS\system32\kqdhu1.dll
Successfully Deleted: C:\WINDOWS\system32\kqdhu1.dll
deleting: C:\WINDOWS\system32\mj4sdmod.dll
Successfully Deleted: C:\WINDOWS\system32\mj4sdmod.dll
deleting: C:\WINDOWS\system32\mqafd.dll
Successfully Deleted: C:\WINDOWS\system32\mqafd.dll
deleting: C:\WINDOWS\system32\ndtshell.dll
Successfully Deleted: C:\WINDOWS\system32\ndtshell.dll
deleting: C:\WINDOWS\system32\qrvd.dll
Successfully Deleted: C:\WINDOWS\system32\qrvd.dll
deleting: C:\WINDOWS\system32\ricss.dll
Successfully Deleted: C:\WINDOWS\system32\ricss.dll
deleting: C:\WINDOWS\system32\sdsinv.dll
Successfully Deleted: C:\WINDOWS\system32\sdsinv.dll
deleting: C:\WINDOWS\system32\sYmsrv.dll
Successfully Deleted: C:\WINDOWS\system32\sYmsrv.dll
deleting: C:\WINDOWS\system32\guard.tmp


Zipping up files for submission:
adding: aacups.dll (164 bytes security) (deflated 5%)
adding: cuyptui.dll (164 bytes security) (deflated 4%)
adding: f4l0le3m1h.dll (164 bytes security) (deflated 4%)
adding: ivsso.dll (164 bytes security) (deflated 5%)
adding: jlcript.dll (164 bytes security) (deflated 5%)
adding: jwsh400.dll (164 bytes security) (deflated 5%)
adding: KF-PMKN.DLL (164 bytes security) (deflated 4%)
adding: kodfo.dll (164 bytes security) (deflated 5%)
adding: kqdhu1.dll (164 bytes security) (deflated 5%)
adding: mj4sdmod.dll (164 bytes security) (deflated 4%)
adding: mqafd.dll (164 bytes security) (deflated 4%)
adding: ndtshell.dll (164 bytes security) (deflated 5%)
adding: qrvd.dll (164 bytes security) (deflated 5%)
adding: ricss.dll (164 bytes security) (deflated 5%)
adding: sdsinv.dll (164 bytes security) (deflated 4%)
adding: sYmsrv.dll (164 bytes security) (deflated 5%)
adding: guard.tmp (164 bytes security) (deflated 5%)
adding: clear.reg (164 bytes security) (deflated 37%)
adding: echo.reg (164 bytes security) (deflated 13%)
adding: direct.txt (164 bytes security) (deflated 2%)
adding: lo2.txt (164 bytes security) (deflated 82%)
adding: readme.txt (164 bytes security) (deflated 52%)
adding: test.txt (164 bytes security) (deflated 78%)
adding: test2.txt (164 bytes security) (deflated 18%)
adding: test3.txt (164 bytes security) (deflated 18%)
adding: test5.txt (164 bytes security) (deflated 18%)
adding: xfind.txt (164 bytes security) (deflated 71%)
adding: backregs/90844680-775D-441F-8686-92F53641653E.reg (164 bytes security) (deflated 70%)
adding: backregs/98C00BC9-12C6-4246-93D6-FCDD8BC9C298.reg (164 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!
Warning (option /rgaci)) - There is no ACE to remove!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

Restoring Windows Update Certificates.:

deleting local copy: aacups.dll
deleting local copy: cuyptui.dll
deleting local copy: f4l0le3m1h.dll
deleting local copy: ivsso.dll
deleting local copy: jlcript.dll
deleting local copy: jwsh400.dll
deleting local copy: KF-PMKN.DLL
deleting local copy: kodfo.dll
deleting local copy: kqdhu1.dll
deleting local copy: mj4sdmod.dll
deleting local copy: mqafd.dll
deleting local copy: ndtshell.dll
deleting local copy: qrvd.dll
deleting local copy: ricss.dll
deleting local copy: sdsinv.dll
deleting local copy: sYmsrv.dll
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\d6j0lg1m16.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\aacups.dll
C:\WINDOWS\system32\cuyptui.dll
C:\WINDOWS\system32\f4l0le3m1h.dll
C:\WINDOWS\system32\ivsso.dll
C:\WINDOWS\system32\jlcript.dll
C:\WINDOWS\system32\jwsh400.dll
C:\WINDOWS\system32\KF-PMKN.DLL
C:\WINDOWS\system32\kodfo.dll
C:\WINDOWS\system32\kqdhu1.dll
C:\WINDOWS\system32\mj4sdmod.dll
C:\WINDOWS\system32\mqafd.dll
C:\WINDOWS\system32\ndtshell.dll
C:\WINDOWS\system32\qrvd.dll
C:\WINDOWS\system32\ricss.dll
C:\WINDOWS\system32\sdsinv.dll
C:\WINDOWS\system32\sYmsrv.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{90844680-775D-441F-8686-92F53641653E}"=-
"{98C00BC9-12C6-4246-93D6-FCDD8BC9C298}"=-
[-HKEY_CLASSES_ROOT\CLSID\{90844680-775D-441F-8686-92F53641653E}]
[-HKEY_CLASSES_ROOT\CLSID\{98C00BC9-12C6-4246-93D6-FCDD8BC9C298}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************


HJT

Logfile of HijackThis v1.99.1
Scan saved at 15:33:25, on 21/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Destro\Desktop\Programma's\Hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\d6j0lg1m16.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVzdHJv\command.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

De infectie is nog steeds niet verdwenen!
Er wordt op dit ogenblik gewerkt aan een update van de fix maar die is nog niet klaar.

Ik zie een entry van SpySweeper in de HJT log. Kan je die nog gebruiken? Zo ja dan mag je SpySweeper updaten en laten scannen. Het is mogelijk dat deze de infectie ook kan verwijderen.

Daarna herstarten en HJT log plaatsen.

had het al gemerkt da het ne kloot van ne trojan/virus is
volgens cwshredder : vx2.Look2me
spysweeper heb ek via die hitman pro compilatie
zal het nog eens runnen

idd Look2me

vandaar L2mfix

lol, nu hebbek da pas door :') l-2-m
achja
die update van L2mfix, voor waneer denk je da die zal zijn?
of was het een wilde gok: 'op dit ogenblik'

Men is er volop aan bezig. Wordt waarschijnlijk deze nacht getest heb ik gelezen. Wanneer dan de echte fix verschijnt weet ik niet precies.
Maar ik heb gezien dat SpySweeper de infectie verwijdert dus proberen maar. Indien dit niet het geval is zal ik verder opzoek gaan naar een alternatief. Zolang Look2me aanwezig is, is het niet de moeite om andere dingen te fixen. Deze infectie werkt als een spywaremagneet...

ic
heb het juist gedaan... ma mijne tijdens het posten van deze post heb ik al terug ne popup gekregen *yay*
ff veilige modus mssg?

Kijk eens even of spysweeper op de volgende manier geconfigureerd is:

Options > Sweep Options en vink aan: Sweep all Folders on Selected drives. en Local Disc C. onder What to Sweep, vink je alles aan

klik op Sweep en laat het je systeem volledig scannen

wanneer het scannen gedaan is, klik dan op Remove. en daarna op Select All en daarna Next

bij 'Results', ga naar Session Log tabblad. klik dan op Save to File en bewaar de log waar je het gemakkelijk terugvind
Exit Spy Sweeper.

kopieer en plak dan de log hier als je volgend antwoord met een nieuw hijackthis log

En eerst herstarten alvorens je een nieuw HJT log plaatst.

will do - ben met sweepen bezig

er is ook ne icannews da altyd terugkomt - oorzaak ook L2m?
zal logs posten na restart