Archief - Enorme Schade!

Ik start na school mijn pc op en ineens dit allemaal:

Bureaublad: rood "your privacy is in danger! Download privacy protection software now"
deze pictogrammen stonden er ook:
Error Cleaner
Privacy Protector
Spyware&Malware Protection

"system alert" => uit taakbalk
system detected viruses ...

"windows intersnet explorer - popup/kadertje"
notice: if your computer is infected .......
do you want to install trustedantivirus to scan your pc for malware now (recommended)

Deuscleaneronline dat automatisch opent en ik niet kan sluiten, want er komt altijd iets om te downloaden en dit krijg ik niet weg (op IE + FF automatisch)

In IE is er een extra taakbalk + andere startpagina

(dit allemaal wijst dus op malware zeker?)

Ik ben nu aan het scannen met: avg antivirus/spyware + advanced windowscare v2 + spybot search&destroy + lavasoft + online trend micro


HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:39, on 2008-01-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\SysAidServer\firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\SysAidServer\firebird\bin\fbserver.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\LSUpdateManager.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\PROGRA~1\Grisoft\AVG7\avgwb.dat
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
G:\Instalatie Files (alles)\HiJackThis\HijackThis.exe
C:\ComboFix\vfind.cfexe
C:\WINDOWS\system32\find.exe
C:\WINDOWS\system32\findstr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: XTN Monitor - {0BB25A64-41B8-4051-A627-A8B9F2DA6FD2} - C:\WINDOWS\ddwlxtqowd.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: The enqvwkp - {92162A1C-A9E3-4C0C-BCDC-2996E8406887} - C:\WINDOWS\enqvwkp.dll
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.2.89.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://chalkh.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131226272330
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158601619265
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://chalkh.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F551} (Flatcast Viewer 4.15) - http://www.flatcast.com/de/download/NpFv415.dll
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4899/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O21 - SSODL: bmlvqkn - {3AA95204-0B50-4B54-9F41-4254121710D4} - C:\WINDOWS\bmlvqkn.dll
O21 - SSODL: agrlmvp - {C117AA22-AEBB-4972-A653-FABFF6BAA114} - C:\WINDOWS\agrlmvp.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\SysAidServer\firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\SysAidServer\firebird\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 11430 bytes




Bedankt!

Ondertussen heb ik mijn pc herstart (na enkele scans)
Er is véél verwijdert met Spybot + met de rest ook wel

Wat is er nu:
* Eerst had ik mijn gewone bureauachtergrond nog, dan werd ie wit en dan terug diezelfde rode met die tekst.
* Ook had ik de pictogrammen van error, privacy, spyware verwijdert, maar die staan er weer.
* Kadertje dat zegt: "kan file:///C:/WINDOWS/privacy_danger_index.htm niet vinden
Dit was/is de locatie waar deze rode afbeelding zich bevond.. (ps ik kan op deze klikken)

Nog eens alles aan het scannen.
Heb al 1Gig tijdelijke bestanden kunnen verwijderen dit wil dus zeggen dat iets mijn download aan het opdoen is. (pas van vandaag reset )

In Spybot SD heb ik een file gehad (+nu nog eens) die Smitfraud C noemt
Dus heb ik dat progje maar eens gedownload.
"Download SmitfraudFix (by S!Ri) en plaats het op je bureaublad.

Dubbelklik op smitfraudfix.exe.
Kies optie #1 - Search door 1 te typen en druk dan op "Enter".
Post de inhoud van de logfile die opent."
Dit is nu bezig

Logfile:

SmitFraudFix v2.274

Scan done at 17:24:03.43, 2008-01-15
Run from C:\Documents and Settings\user\Bureaublad\SmitfraudFix
OS: Microsoft Windows XP [versie 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\SysAidServer\firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\SysAidServer\firebird\bin\fbserver.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\IObit\Advanced WindowsCare V2\Awcl.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\ntvdm.exe
C:\ComboFix\vfind.cfexe
C:\WINDOWS\system32\find.exe
C:\WINDOWS\system32\findstr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\privacy_danger FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\user\FAVORI~1

C:\DOCUME~1\user\FAVORI~1\Online Security Test.url FOUND !
C:\DOCUME~1\user\FAVORI~1\Error Cleaner.url FOUND !
C:\DOCUME~1\user\FAVORI~1\Privacy Protector.url FOUND !
C:\DOCUME~1\user\FAVORI~1\Spyware?Malware Protection.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

C:\DOCUME~1\user\BUREAU~1\Error Cleaner.url FOUND !
C:\DOCUME~1\user\BUREAU~1\Privacy Protector.url FOUND !
C:\DOCUME~1\user\BUREAU~1\Spyware?Malware Protection.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm"
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Pakketplanner-minipoort
DNS Server Search Order: 195.130.130.1
DNS Server Search Order: 195.130.130.129

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.129.161 195.130.130.161
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=195.130.129.161 195.130.130.161
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

In Spybod SD staat er nu:
-Tradedoubler
-Doubleclick
-Nous-Tech.UCleaner
-Smitfraud-C.
-Smitfraud-C.MSVPS

WindowsCare:
- er bijven bij de spyware scan steeds 2 dingen staan die ik niet kan verwijderen

COMBOFIX LOGJE:

ComboFix 07-07-30.2 - "user" 2008-01-15 17:04:52.7 [GMT 1:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.Waar


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\user\BUREAU~1.\Error Cleaner.url
C:\DOCUME~1\user\BUREAU~1.\Privacy Protector.url
C:\DOCUME~1\user\BUREAU~1.\Spyware&Malware Protection.url
C:\DOCUME~1\user\FAVORI~1.\Error Cleaner.url
C:\DOCUME~1\user\FAVORI~1.\Privacy Protector.url
C:\DOCUME~1\user\FAVORI~1.\Spyware&Malware Protection.url
C:\WINDOWS\dat.txt
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt


((((((((((((((((((((((((( Files Created from 2007-12-15 to 2008-01-15 )))))))))))))))))))))))))))))))


2008-01-15 17:24 2,262 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-15 17:23 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-15 17:23 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-15 17:23 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-15 17:23 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-15 17:23 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-15 17:23 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-15 16:39 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-15 16:30 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-14 22:03 81,920 --a------ C:\WINDOWS\fxtqdrl.exe
2008-01-14 22:03 253,952 --a------ C:\WINDOWS\ddwlxtqowd.dll
2008-01-14 22:03 229,376 --a------ C:\WINDOWS\bmlvqkn.dll
2008-01-14 22:03 217,088 --a------ C:\WINDOWS\agrlmvp.dll
2008-01-14 22:03 172,032 --a------ C:\WINDOWS\enqvwkp.dll
2008-01-14 22:02 348,160 --a------ C:\WINDOWS\system32\eSellerateEngine.dll
2008-01-14 19:59 <DIR> d-------- C:\Program Files\MixVibes6
2008-01-14 17:11 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-01-14 17:11 548,864 --a------ C:\WINDOWS\system32\msvcp80.dll
2008-01-14 17:11 479,232 --a------ C:\WINDOWS\system32\msvcm80.dll
2008-01-14 17:11 <DIR> d-------- C:\Program Files\MyXOFT
2008-01-14 17:11 <DIR> d-------- C:\DOCUME~1\user\DSS DJ Data
2008-01-14 17:06 78,112 --a------ C:\WINDOWS\system32\drivers\MMRTKRNL.SYS
2008-01-14 17:06 344,576 --a------ C:\WINDOWS\system32\MMRTKRNL.DLL
2008-01-14 16:54 <DIR> d-------- C:\Program Files\ALCATech
2008-01-14 16:47 <DIR> d-------- C:\Program Files\DJ Mix Pro
2008-01-13 20:28 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\NetMedia Providers
2008-01-07 18:47 <DIR> d-------- C:\Program Files\Dialang
2008-01-03 13:54 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2008-01-03 13:54 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2008-01-03 13:54 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2008-01-03 13:54 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2008-01-03 13:54 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2008-01-03 13:54 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2008-01-03 13:54 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2008-01-03 13:54 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2008-01-03 13:52 <DIR> d-------- C:\Program Files\Activision
2008-01-03 00:56 <DIR> d-------- C:\Program Files\Norton Security Scan
2008-01-03 00:56 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-12-30 13:30 <DIR> d-------- C:\Program Files\WS_FTP
2007-12-27 20:10 <DIR> d-------- C:\Program Files\Webteh
2007-12-27 20:10 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\BSplayer Pro
2007-12-27 20:10 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\BSplayer
2007-12-20 18:47 <DIR> d-------- C:\Program Files\PokerStars
2007-12-18 16:26 <DIR> d-------- C:\Program Files\Mozilla Thunderbird


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-01-15 17:05 90080 --a------ C:\WINDOWS\system32\perfc013.dat
2008-01-15 17:05 486728 --a------ C:\WINDOWS\system32\perfh013.dat
2008-01-15 16:16 12632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-01-14 21:50 --------- dr------- C:\Program Files\Sam
2008-01-14 20:52 --------- dr------- C:\Program Files\prog. pictogrammen
2008-01-13 20:21 --------- d-------- C:\Program Files\VstPlugins
2008-01-13 20:21 --------- d-------- C:\Program Files\Sony
2008-01-13 20:20 --------- d-------- C:\Program Files\Sony Setup
2008-01-13 14:08 --------- d-------- C:\DOCUME~1\user\APPLIC~1\SolidDocuments
2008-01-12 15:38 --------- d-------- C:\Program Files\AllToAVI
2008-01-12 12:10 --------- d-------- C:\Program Files\Windows Live Safety Center
2008-01-11 22:03 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-11 22:03 107832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-01-11 22:03 --------- d-------- C:\Program Files\mIRC
2008-01-07 18:47 --------- d--h----- C:\Program Files\InstallShield Installation Information
2008-01-05 09:52 --------- d-------- C:\Program Files\ASUS
2007-12-31 13:52 --------- d-------- C:\Program Files\Opera
2007-12-16 16:31 --------- d-------- C:\Program Files\Ableton
2007-12-16 16:10 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Ableton
2007-12-15 15:56 --------- d-------- C:\Program Files\VirtualDJ
2007-12-14 21:54 --------- d-------- C:\Program Files\HooTech
2007-12-12 13:03 --------- dr------- C:\Program Files\ward
2007-12-09 09:00 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Media Player Classic
2007-12-07 14:11 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Vso
2007-12-06 18:48 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-12-06 18:18 1324 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-06 18:18 1100 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-04 20:37 --------- d-------- C:\DOCUME~1\user\APPLIC~1\MailWasherPro
2007-12-02 13:30 --------- d-------- C:\Program Files\Pontifex Demo
2007-11-26 16:46 --------- d-------- C:\Program Files\TGTSoft
2007-11-24 18:59 --------- d-------- C:\Program Files\MixMeister Fusion + Video
2007-11-24 18:59 --------- d-------- C:\DOCUME~1\user\APPLIC~1\MixMeister Technology
2007-11-21 14:05 --------- d-------- C:\Program Files\Common Files\DirectX
2007-11-19 21:40 --------- d-------- C:\Program Files\Alt OGG to MP3 converter
2007-11-07 10:30 727040 --a------ C:\WINDOWS\system32\lsasrv.dll
2007-10-29 23:45 1291776 --a------ C:\WINDOWS\system32\quartz.dll
2007-10-28 11:23 95 --a------ C:\AUTOEXEC.BAT
2007-10-25 09:28 222720 --a------ C:\WINDOWS\system32\wmasf.dll
2007-01-08 17:01 87608 --a------ C:\DOCUME~1\user\APPLIC~1\ezpinst.exe
2007-01-08 17:01 47360 --a------ C:\DOCUME~1\user\APPLIC~1\pcouffin.sys
2006-11-05 14:16 1982 --a------ C:\Program Files\PeL.zir
2006-11-05 14:15 1982 --a------ C:\Program Files\PeL.zir.bak
2006-05-14 12:02:08 88 --sh--r C:\WINDOWS\system32\0BAE5EC053.sys
2006-05-02 16:37:48 56 --sh--r C:\WINDOWS\system32\53C05EAE0B.sys
2006-10-30 10:05:56 6,060 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0BB25A64-41B8-4051-A627-A8B9F2DA6FD2}]
2008-01-14 18:22 253952 --a------ C:\WINDOWS\ddwlxtqowd.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Telemeter 3.0"="C:\Program Files\Telemeter 3.0\telemeter3.exe" [2007-04-15 23:38]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 11:59]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-07 18:07]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 05:03]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-08-16 15:19]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=0 (0x0)
"NoColorChoice"=0 (0x0)
"NoSizeChoice"=0 (0x0)
"NoDispBackgroundPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)
"NoDispCPL"=0 (0x0)
"NoVisualStyleChoice"=0 (0x0)
"NoDispSettingsPage"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)
"NoActiveDesktopChanges"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoSaveSettings"=0 (0x0)
"NoThemesTab"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bmlvqkn"= {3AA95204-0B50-4B54-9F41-4254121710D4} - C:\WINDOWS\bmlvqkn.dll [2008-01-14 18:22 229376]
"agrlmvp"= {C117AA22-AEBB-4972-A653-FABFF6BAA114} - C:\WINDOWS\agrlmvp.dll [2008-01-14 18:22 217088]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Snelle start.lnk
backup=C:\WINDOWS\pss\Adobe Reader Snelle start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^BHODemon 2.0.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\BHODemon 2.0.lnk
backup=C:\WINDOWS\pss\BHODemon 2.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Registration .LNK]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Registration .LNK
backup=C:\WINDOWS\pss\Registration .LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Registration-Studio 8.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Registration-Studio 8.lnk
backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
"C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead Photo Express Calendar Checker]
C:\Program Files\Ulead Systems\Ulead Photo Express 5 SE\calcheck.exe

R0 MMRTKRNL;MMRTKRNL;C:\WINDOWS\system32\drivers\mmrtkrnl.sys
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x);C:\WINDOWS\system32\drivers\sfvfs02.sys
R1 AmdK8;Stuurprogramma voor AMD-processor;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 AsIO;AsIO;C:\WINDOWS\system32\drivers\AsIO.sys
R1 PCLEPCI;PCLEPCI;\??\C:\WINDOWS\system32\drivers\pclepci.sys
R1 PQNTDrv;PQNTDrv;C:\WINDOWS\system32\drivers\PQNTDrv.sys
R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\SysAidServer\firebird\bin\fbguard.exe -s
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\SysAidServer\firebird\bin\fbserver.exe -s
R3 MarvinBus;Pinnacle Marvin Bus;C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
R3 ms_mpu401;Microsoft MPU-401 MIDI UART-stuurprogramma;C:\WINDOWS\system32\drivers\msmpu401.sys
R3 MTsensor;ATK0110 ACPI UTILITY;C:\WINDOWS\system32\DRIVERS\ASACPI.sys
R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys
S3 61883;61883-eenheidsapparaat;C:\WINDOWS\system32\DRIVERS\61883.sys
S3 ASAPIW2K;ASAPIW2K;C:\WINDOWS\system32\drivers\Asapiw2k.sys
S3 ASPI;Advanced SCSI Programming Interface Driver;\??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys
S3 Avc;AVC-apparaat;C:\WINDOWS\system32\DRIVERS\avc.sys
S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
S3 CO_Mon;CO_Mon;\??\C:\WINDOWS\system32\Drivers\CO_Mon.sys
S3 DCamUSBNovatek;USB Video Camera;C:\WINDOWS\system32\Drivers\nvtcam.sys
S3 dtscsi;dtscsi;C:\WINDOWS\system32\Drivers\dtscsi.sys
S3 GcKernel;Microsoft SideWinder Value Add - Filterstuurprogramma;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Mini-stuurprogramma voor virtueel HID-apparaat van Microsoft SideWinder;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 Jukebox3;Jukebox3;C:\WINDOWS\system32\DRIVERS\ctpdusb.sys
S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINDOWS\system32\57.tmp
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR
S3 nvax;Service for NVIDIA(R) nForce(TM) Audio Enumerator;C:\WINDOWS\system32\drivers\nvax.sys
S3 nvnforce;Service for NVIDIA(R) nForce(TM) Audio;C:\WINDOWS\system32\drivers\nvapu.sys
S3 RDID1003;EDIROL UM-2;C:\WINDOWS\system32\Drivers\rdwm1003.sys
S3 SANDRA;SANDRA;\??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Sandra.sys
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR
S3 STEAMDVR;STEAMDVR;\??\C:\Program Files\Steam\bin\x86\SteamDvr.sys
S3 XTrapD12;XTrapD12;\??\C:\WINDOWS\system32\XTrapD12.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a05f5ba-9a6e-11da-8d6c-0011d8c0871c}]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d239932-4e42-11da-b44a-806d6172696f}]


Contents of the 'Scheduled Tasks' folder
2008-01-02 23:56:21 C:\WINDOWS\Tasks\Norton Security Scan.job - C:\Program Files\Norton Security Scan\Nss.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-15 17:33:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2008-01-15 17:37:36
C:\ComboFix-quarantined-files.txt ... 2008-01-15 17:35
C:\ComboFix2.txt ... 2007-10-17 12:25
C:\ComboFix3.txt ... 2007-09-25 17:15

--- E O F ---

Start de computer op in veilige modus. Hoe je dit doet kan je hier lezen.
Sluit alle open vensters.

Dubbelklik op smitfraudfix.exe.
Kies optie #2 - Clean door 2 te typen en druk dan op "Enter".

Wanneer de volgende vraag gesteld: "Registry cleaning - Do you want to clean the registry ?"; antwoord je "Yes/ja" door Y te typen en daarna op "Enter" te klikken. Dit zal je bureaublad terug herstellen en registersleutels die deze infectie heeft aangemaakt weer verwijderen.

De tool zal daarna je computer opnieuw laten opstarten om de restanten te verwijderen.
Indien de computer niet automatisch start, start je de pc zelf opnieuw in normale windowsmodus.
Wanneer de computer opnieuw gestart is zal er een logfile open: C:\rapport.txt.
Post de inhoud van dat logje samen met een nieuwe hijackthislog.

HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:06:42, on 15/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\SysAidServer\firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\SysAidServer\firebird\bin\fbserver.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: XTN Monitor - {0BB25A64-41B8-4051-A627-A8B9F2DA6FD2} - C:\WINDOWS\ddwlxtqowd.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: The enqvwkp - {92162A1C-A9E3-4C0C-BCDC-2996E8406887} - C:\WINDOWS\enqvwkp.dll
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [nwiz] nwiz.exe /install
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O21 - SSODL: bmlvqkn - {3AA95204-0B50-4B54-9F41-4254121710D4} - C:\WINDOWS\bmlvqkn.dll
O21 - SSODL: agrlmvp - {C117AA22-AEBB-4972-A653-FABFF6BAA114} - C:\WINDOWS\agrlmvp.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\SysAidServer\firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\SysAidServer\firebird\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 7174 bytes



Smitfraude:

SmitFraudFix v2.274

Scan done at 18:00:31,04, di 15/01/2008
Run from C:\Documents and Settings\user\Bureaublad\SmitfraudFix
OS: Microsoft Windows XP [versie 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\DOCUME~1\user\FAVORI~1\Online Security Test.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.129.161 195.130.130.161
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=195.130.129.161 195.130.130.161
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End





Ik heb geen popups, achtergrond, .. meer
enkel nog in IE: een taakbalk die: "the enqvwkp" heet. Deze kan ik wel uitvinken..

Ik ben nog eens aan het scannen met Spybot S&D (voor de zekerheid)
Er komen echter nog steeds files in (voordien had ik er nooit!)
-CurePCSolution
-DoubleClick
-FastClick
-MediaPlex
-Statcounter
-TradeDoubler
-Zedo
----- De bovenstaande hebben allemaal iets ivm. Firefox
-Smitfraud-C.MSVPS
----- Deze zal van het programma smitfraud zijn?

Kunnen deze kwaad?

Ik start nu mijn computer op en ALLES is weer hetzelfde zoals gistere namiddag.
Rode achtergrond, pictogrammen,...

Nu ga ik naar school dus kan ik niets antwoorden, maar het moet wel iets erg zijn.
Help me aub!

Dank u

Een combofix heb ik nog kunnen maken voor de rest niets.
WindowsCare heb ik ook laten lopen en nog steeds bij het bovenste blijven er 2 errors (en dat zijn hkey's maar deze willen niet weg. Ik zal straks een prt sc. posten)

ComboFix 07-07-30.2 - "user" 2008-01-16 7:26:19.8 [GMT 1:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.Waar


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\user\FAVORI~1.\Error Cleaner.url
C:\DOCUME~1\user\FAVORI~1.\Privacy Protector.url
C:\DOCUME~1\user\FAVORI~1.\Spyware&Malware Protection.url
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\rs.txt


((((((((((((((((((((((((( Files Created from 2007-12-16 to 2008-01-16 )))))))))))))))))))))))))))))))


2008-01-15 18:15 <DIR> d-------- C:\Program Files\IEPro
2008-01-15 18:15 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\IEPro
2008-01-15 18:12 <DIR> d-------- C:\Program Files\Orbitdownloader
2008-01-15 18:12 <DIR> d-------- C:\Downloads
2008-01-15 18:12 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\Orbit
2008-01-15 17:24 2,154 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-15 16:39 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-15 16:30 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-14 22:03 81,920 --a------ C:\WINDOWS\fxtqdrl.exe
2008-01-14 22:03 253,952 --a------ C:\WINDOWS\ddwlxtqowd.dll
2008-01-14 22:03 229,376 --a------ C:\WINDOWS\bmlvqkn.dll
2008-01-14 22:03 217,088 --a------ C:\WINDOWS\agrlmvp.dll
2008-01-14 22:03 172,032 --a------ C:\WINDOWS\enqvwkp.dll
2008-01-14 22:02 348,160 --a------ C:\WINDOWS\system32\eSellerateEngine.dll
2008-01-14 19:59 <DIR> d-------- C:\Program Files\MixVibes6
2008-01-14 17:11 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-01-14 17:11 548,864 --a------ C:\WINDOWS\system32\msvcp80.dll
2008-01-14 17:11 479,232 --a------ C:\WINDOWS\system32\msvcm80.dll
2008-01-14 17:11 <DIR> d-------- C:\Program Files\MyXOFT
2008-01-14 17:11 <DIR> d-------- C:\DOCUME~1\user\DSS DJ Data
2008-01-14 17:06 78,112 --a------ C:\WINDOWS\system32\drivers\MMRTKRNL.SYS
2008-01-14 17:06 344,576 --a------ C:\WINDOWS\system32\MMRTKRNL.DLL
2008-01-14 16:54 <DIR> d-------- C:\Program Files\ALCATech
2008-01-14 16:47 <DIR> d-------- C:\Program Files\DJ Mix Pro
2008-01-13 20:28 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\NetMedia Providers
2008-01-07 18:47 <DIR> d-------- C:\Program Files\Dialang
2008-01-03 13:54 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2008-01-03 13:54 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2008-01-03 13:54 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2008-01-03 13:54 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2008-01-03 13:54 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2008-01-03 13:54 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2008-01-03 13:54 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2008-01-03 13:54 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2008-01-03 13:52 <DIR> d-------- C:\Program Files\Activision
2008-01-03 00:56 <DIR> d-------- C:\Program Files\Norton Security Scan
2008-01-03 00:56 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-12-30 13:30 <DIR> d-------- C:\Program Files\WS_FTP
2007-12-27 20:10 <DIR> d-------- C:\Program Files\Webteh
2007-12-27 20:10 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\BSplayer Pro
2007-12-27 20:10 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\BSplayer
2007-12-20 18:47 <DIR> d-------- C:\Program Files\PokerStars
2007-12-18 16:26 <DIR> d-------- C:\Program Files\Mozilla Thunderbird


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-01-16 07:22 90080 --a------ C:\WINDOWS\system32\perfc013.dat
2008-01-16 07:22 486728 --a------ C:\WINDOWS\system32\perfh013.dat
2008-01-15 21:07 --------- dr------- C:\Program Files\Sam
2008-01-15 20:05 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-15 20:05 107832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-01-15 18:17 --------- dr------- C:\Program Files\prog. pictogrammen
2008-01-15 16:16 12632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-01-13 20:21 --------- d-------- C:\Program Files\VstPlugins
2008-01-13 20:21 --------- d-------- C:\Program Files\Sony
2008-01-13 20:20 --------- d-------- C:\Program Files\Sony Setup
2008-01-13 14:08 --------- d-------- C:\DOCUME~1\user\APPLIC~1\SolidDocuments
2008-01-12 15:38 --------- d-------- C:\Program Files\AllToAVI
2008-01-12 12:10 --------- d-------- C:\Program Files\Windows Live Safety Center
2008-01-11 22:03 --------- d-------- C:\Program Files\mIRC
2008-01-07 18:47 --------- d--h----- C:\Program Files\InstallShield Installation Information
2008-01-05 09:52 --------- d-------- C:\Program Files\ASUS
2007-12-31 13:52 --------- d-------- C:\Program Files\Opera
2007-12-16 16:31 --------- d-------- C:\Program Files\Ableton
2007-12-16 16:10 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Ableton
2007-12-15 15:56 --------- d-------- C:\Program Files\VirtualDJ
2007-12-14 21:54 --------- d-------- C:\Program Files\HooTech
2007-12-12 13:03 --------- dr------- C:\Program Files\ward
2007-12-09 09:00 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Media Player Classic
2007-12-07 14:11 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Vso
2007-12-06 18:48 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-12-06 18:18 1324 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-06 18:18 1100 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-04 20:37 --------- d-------- C:\DOCUME~1\user\APPLIC~1\MailWasherPro
2007-12-02 13:30 --------- d-------- C:\Program Files\Pontifex Demo
2007-11-26 16:46 --------- d-------- C:\Program Files\TGTSoft
2007-11-24 18:59 --------- d-------- C:\Program Files\MixMeister Fusion + Video
2007-11-24 18:59 --------- d-------- C:\DOCUME~1\user\APPLIC~1\MixMeister Technology
2007-11-21 14:05 --------- d-------- C:\Program Files\Common Files\DirectX
2007-11-19 21:40 --------- d-------- C:\Program Files\Alt OGG to MP3 converter
2007-11-07 10:30 727040 --a------ C:\WINDOWS\system32\lsasrv.dll
2007-10-29 23:45 1291776 --a------ C:\WINDOWS\system32\quartz.dll
2007-10-28 11:23 95 --a------ C:\AUTOEXEC.BAT
2007-10-25 09:28 222720 --a------ C:\WINDOWS\system32\wmasf.dll
2007-01-08 17:01 87608 --a------ C:\DOCUME~1\user\APPLIC~1\ezpinst.exe
2007-01-08 17:01 47360 --a------ C:\DOCUME~1\user\APPLIC~1\pcouffin.sys
2006-11-05 14:16 1982 --a------ C:\Program Files\PeL.zir
2006-11-05 14:15 1982 --a------ C:\Program Files\PeL.zir.bak
2006-05-14 12:02:08 88 --sh--r C:\WINDOWS\system32\0BAE5EC053.sys
2006-05-02 16:37:48 56 --sh--r C:\WINDOWS\system32\53C05EAE0B.sys
2006-10-30 10:05:56 6,060 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0BB25A64-41B8-4051-A627-A8B9F2DA6FD2}]
2008-01-14 18:22 253952 --a------ C:\WINDOWS\ddwlxtqowd.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Telemeter 3.0"="C:\Program Files\Telemeter 3.0\telemeter3.exe" [2007-04-15 23:38]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 11:59]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-07 18:07]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 05:03]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-08-16 15:19]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bmlvqkn"= {3AA95204-0B50-4B54-9F41-4254121710D4} - C:\WINDOWS\bmlvqkn.dll [2008-01-14 18:22 229376]
"agrlmvp"= {C117AA22-AEBB-4972-A653-FABFF6BAA114} - C:\WINDOWS\agrlmvp.dll [2008-01-14 18:22 217088]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Snelle start.lnk
backup=C:\WINDOWS\pss\Adobe Reader Snelle start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^BHODemon 2.0.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\BHODemon 2.0.lnk
backup=C:\WINDOWS\pss\BHODemon 2.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Registration .LNK]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Registration .LNK
backup=C:\WINDOWS\pss\Registration .LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Registration-Studio 8.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Registration-Studio 8.lnk
backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
"C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead Photo Express Calendar Checker]
C:\Program Files\Ulead Systems\Ulead Photo Express 5 SE\calcheck.exe

R0 MMRTKRNL;MMRTKRNL;C:\WINDOWS\system32\drivers\mmrtkrnl.sys
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x);C:\WINDOWS\system32\drivers\sfvfs02.sys
R1 AmdK8;Stuurprogramma voor AMD-processor;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 AsIO;AsIO;C:\WINDOWS\system32\drivers\AsIO.sys
R1 PCLEPCI;PCLEPCI;\??\C:\WINDOWS\system32\drivers\pclepci.sys
R1 PQNTDrv;PQNTDrv;C:\WINDOWS\system32\drivers\PQNTDrv.sys
R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\SysAidServer\firebird\bin\fbguard.exe -s
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\SysAidServer\firebird\bin\fbserver.exe -s
R3 MarvinBus;Pinnacle Marvin Bus;C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
R3 ms_mpu401;Microsoft MPU-401 MIDI UART-stuurprogramma;C:\WINDOWS\system32\drivers\msmpu401.sys
R3 MTsensor;ATK0110 ACPI UTILITY;C:\WINDOWS\system32\DRIVERS\ASACPI.sys
R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys
S3 61883;61883-eenheidsapparaat;C:\WINDOWS\system32\DRIVERS\61883.sys
S3 ASAPIW2K;ASAPIW2K;C:\WINDOWS\system32\drivers\Asapiw2k.sys
S3 ASPI;Advanced SCSI Programming Interface Driver;\??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys
S3 Avc;AVC-apparaat;C:\WINDOWS\system32\DRIVERS\avc.sys
S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
S3 CO_Mon;CO_Mon;\??\C:\WINDOWS\system32\Drivers\CO_Mon.sys
S3 DCamUSBNovatek;USB Video Camera;C:\WINDOWS\system32\Drivers\nvtcam.sys
S3 dtscsi;dtscsi;C:\WINDOWS\system32\Drivers\dtscsi.sys
S3 GcKernel;Microsoft SideWinder Value Add - Filterstuurprogramma;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Mini-stuurprogramma voor virtueel HID-apparaat van Microsoft SideWinder;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 Jukebox3;Jukebox3;C:\WINDOWS\system32\DRIVERS\ctpdusb.sys
S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINDOWS\system32\57.tmp
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR
S3 nvax;Service for NVIDIA(R) nForce(TM) Audio Enumerator;C:\WINDOWS\system32\drivers\nvax.sys
S3 nvnforce;Service for NVIDIA(R) nForce(TM) Audio;C:\WINDOWS\system32\drivers\nvapu.sys
S3 RDID1003;EDIROL UM-2;C:\WINDOWS\system32\Drivers\rdwm1003.sys
S3 SANDRA;SANDRA;\??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Sandra.sys
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR
S3 STEAMDVR;STEAMDVR;\??\C:\Program Files\Steam\bin\x86\SteamDvr.sys
S3 XTrapD12;XTrapD12;\??\C:\WINDOWS\system32\XTrapD12.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a05f5ba-9a6e-11da-8d6c-0011d8c0871c}]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d239932-4e42-11da-b44a-806d6172696f}]


Contents of the 'Scheduled Tasks' folder
2008-01-02 23:56:21 C:\WINDOWS\Tasks\Norton Security Scan.job - C:\Program Files\Norton Security Scan\Nss.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 07:28:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000000ad

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2008-01-16 7:28:57
C:\ComboFix-quarantined-files.txt ... 2008-01-16 07:28
C:\ComboFix2.txt ... 2008-01-15 17:37
C:\ComboFix3.txt ... 2007-10-17 12:25

--- E O F ---

Ik heb weer hetzelfde gedaan als gisteren en alles lijkt weer opgelost.
Ik heb nog files om te checken. (Combofix, smitfraud, HJT, SDfix, DrCure)

Combofix
=======

ComboFix 07-07-30.2 - "user" 2008-01-16 13:28:22.9 [GMT 1:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.Waar


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\rs.txt


((((((((((((((((((((((((( Files Created from 2007-12-16 to 2008-01-16 )))))))))))))))))))))))))))))))


2008-01-16 08:20 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\MiniDm
2008-01-15 18:15 <DIR> d-------- C:\Program Files\IEPro
2008-01-15 18:15 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\IEPro
2008-01-15 18:12 <DIR> d-------- C:\Program Files\Orbitdownloader
2008-01-15 18:12 <DIR> d-------- C:\Downloads
2008-01-15 18:12 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\Orbit
2008-01-15 17:24 2,154 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-15 16:39 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-15 16:30 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-14 22:03 81,920 --a------ C:\WINDOWS\fxtqdrl.exe
2008-01-14 22:03 229,376 --a------ C:\WINDOWS\bmlvqkn.dll
2008-01-14 22:03 217,088 --a------ C:\WINDOWS\agrlmvp.dll
2008-01-14 22:03 172,032 --a------ C:\WINDOWS\enqvwkp.dll
2008-01-14 22:02 348,160 --a------ C:\WINDOWS\system32\eSellerateEngine.dll
2008-01-14 19:59 <DIR> d-------- C:\Program Files\MixVibes6
2008-01-14 17:11 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-01-14 17:11 548,864 --a------ C:\WINDOWS\system32\msvcp80.dll
2008-01-14 17:11 479,232 --a------ C:\WINDOWS\system32\msvcm80.dll
2008-01-14 17:11 <DIR> d-------- C:\Program Files\MyXOFT
2008-01-14 17:11 <DIR> d-------- C:\DOCUME~1\user\DSS DJ Data
2008-01-14 17:06 78,112 --a------ C:\WINDOWS\system32\drivers\MMRTKRNL.SYS
2008-01-14 17:06 344,576 --a------ C:\WINDOWS\system32\MMRTKRNL.DLL
2008-01-14 16:54 <DIR> d-------- C:\Program Files\ALCATech
2008-01-14 16:47 <DIR> d-------- C:\Program Files\DJ Mix Pro
2008-01-13 20:28 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\NetMedia Providers
2008-01-07 18:47 <DIR> d-------- C:\Program Files\Dialang
2008-01-03 13:54 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2008-01-03 13:54 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2008-01-03 13:54 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2008-01-03 13:54 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2008-01-03 13:54 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2008-01-03 13:54 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2008-01-03 13:54 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2008-01-03 13:54 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2008-01-03 13:52 <DIR> d-------- C:\Program Files\Activision
2008-01-03 00:56 <DIR> d-------- C:\Program Files\Norton Security Scan
2008-01-03 00:56 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-12-30 13:30 <DIR> d-------- C:\Program Files\WS_FTP
2007-12-27 20:10 <DIR> d-------- C:\Program Files\Webteh
2007-12-27 20:10 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\BSplayer Pro
2007-12-27 20:10 <DIR> d-------- C:\DOCUME~1\user\APPLIC~1\BSplayer
2007-12-20 18:47 <DIR> d-------- C:\Program Files\PokerStars
2007-12-18 16:26 <DIR> d-------- C:\Program Files\Mozilla Thunderbird


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-01-16 13:29 90080 --a------ C:\WINDOWS\system32\perfc013.dat
2008-01-16 13:29 486728 --a------ C:\WINDOWS\system32\perfh013.dat
2008-01-15 21:07 --------- dr------- C:\Program Files\Sam
2008-01-15 20:05 22328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-15 20:05 107832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-01-15 18:17 --------- dr------- C:\Program Files\prog. pictogrammen
2008-01-15 16:16 12632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-01-13 20:21 --------- d-------- C:\Program Files\VstPlugins
2008-01-13 20:21 --------- d-------- C:\Program Files\Sony
2008-01-13 20:20 --------- d-------- C:\Program Files\Sony Setup
2008-01-13 14:08 --------- d-------- C:\DOCUME~1\user\APPLIC~1\SolidDocuments
2008-01-12 15:38 --------- d-------- C:\Program Files\AllToAVI
2008-01-12 12:10 --------- d-------- C:\Program Files\Windows Live Safety Center
2008-01-11 22:03 --------- d-------- C:\Program Files\mIRC
2008-01-07 18:47 --------- d--h----- C:\Program Files\InstallShield Installation Information
2008-01-05 09:52 --------- d-------- C:\Program Files\ASUS
2007-12-31 13:52 --------- d-------- C:\Program Files\Opera
2007-12-16 16:31 --------- d-------- C:\Program Files\Ableton
2007-12-16 16:10 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Ableton
2007-12-15 15:56 --------- d-------- C:\Program Files\VirtualDJ
2007-12-14 21:54 --------- d-------- C:\Program Files\HooTech
2007-12-12 13:03 --------- dr------- C:\Program Files\ward
2007-12-09 09:00 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Media Player Classic
2007-12-07 14:11 --------- d-------- C:\DOCUME~1\user\APPLIC~1\Vso
2007-12-06 18:48 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-12-06 18:18 1324 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-06 18:18 1100 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-04 20:37 --------- d-------- C:\DOCUME~1\user\APPLIC~1\MailWasherPro
2007-12-02 13:30 --------- d-------- C:\Program Files\Pontifex Demo
2007-11-26 16:46 --------- d-------- C:\Program Files\TGTSoft
2007-11-24 18:59 --------- d-------- C:\Program Files\MixMeister Fusion + Video
2007-11-24 18:59 --------- d-------- C:\DOCUME~1\user\APPLIC~1\MixMeister Technology
2007-11-21 14:05 --------- d-------- C:\Program Files\Common Files\DirectX
2007-11-19 21:40 --------- d-------- C:\Program Files\Alt OGG to MP3 converter
2007-11-07 10:30 727040 --a------ C:\WINDOWS\system32\lsasrv.dll
2007-10-29 23:45 1291776 --a------ C:\WINDOWS\system32\quartz.dll
2007-10-28 11:23 95 --a------ C:\AUTOEXEC.BAT
2007-10-25 09:28 222720 --a------ C:\WINDOWS\system32\wmasf.dll
2007-01-08 17:01 87608 --a------ C:\DOCUME~1\user\APPLIC~1\ezpinst.exe
2007-01-08 17:01 47360 --a------ C:\DOCUME~1\user\APPLIC~1\pcouffin.sys
2006-11-05 14:16 1982 --a------ C:\Program Files\PeL.zir
2006-11-05 14:15 1982 --a------ C:\Program Files\PeL.zir.bak
2006-05-14 12:02:08 88 --sh--r C:\WINDOWS\system32\0BAE5EC053.sys
2006-05-02 16:37:48 56 --sh--r C:\WINDOWS\system32\53C05EAE0B.sys
2006-10-30 10:05:56 6,060 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0BB25A64-41B8-4051-A627-A8B9F2DA6FD2}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Telemeter 3.0"="C:\Program Files\Telemeter 3.0\telemeter3.exe" [2007-04-15 23:38]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 11:59]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-07 18:07]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 05:03]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-08-16 15:19]
"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bmlvqkn"= {3AA95204-0B50-4B54-9F41-4254121710D4} - C:\WINDOWS\bmlvqkn.dll [2008-01-14 18:22 229376]
"agrlmvp"= {C117AA22-AEBB-4972-A653-FABFF6BAA114} - C:\WINDOWS\agrlmvp.dll [2008-01-14 18:22 217088]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Snelle start.lnk
backup=C:\WINDOWS\pss\Adobe Reader Snelle start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^BHODemon 2.0.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\BHODemon 2.0.lnk
backup=C:\WINDOWS\pss\BHODemon 2.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Registration .LNK]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Registration .LNK
backup=C:\WINDOWS\pss\Registration .LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Registration-Studio 8.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Registration-Studio 8.lnk
backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programma's^Opstarten^Yahoo! Widget Engine.lnk]
path=C:\Documents and Settings\user\Menu Start\Programma's\Opstarten\Yahoo! Widget Engine.lnk
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
"C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead Photo Express Calendar Checker]
C:\Program Files\Ulead Systems\Ulead Photo Express 5 SE\calcheck.exe

R0 MMRTKRNL;MMRTKRNL;C:\WINDOWS\system32\drivers\mmrtkrnl.sys
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x);C:\WINDOWS\system32\drivers\sfvfs02.sys
R1 AmdK8;Stuurprogramma voor AMD-processor;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R1 AsIO;AsIO;C:\WINDOWS\system32\drivers\AsIO.sys
R1 PCLEPCI;PCLEPCI;\??\C:\WINDOWS\system32\drivers\pclepci.sys
R1 PQNTDrv;PQNTDrv;C:\WINDOWS\system32\drivers\PQNTDrv.sys
R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\SysAidServer\firebird\bin\fbguard.exe -s
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\SysAidServer\firebird\bin\fbserver.exe -s
R3 MarvinBus;Pinnacle Marvin Bus;C:\WINDOWS\system32\DRIVERS\MarvinBus.sys
R3 ms_mpu401;Microsoft MPU-401 MIDI UART-stuurprogramma;C:\WINDOWS\system32\drivers\msmpu401.sys
R3 MTsensor;ATK0110 ACPI UTILITY;C:\WINDOWS\system32\DRIVERS\ASACPI.sys
R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys
S3 61883;61883-eenheidsapparaat;C:\WINDOWS\system32\DRIVERS\61883.sys
S3 ASAPIW2K;ASAPIW2K;C:\WINDOWS\system32\drivers\Asapiw2k.sys
S3 ASPI;Advanced SCSI Programming Interface Driver;\??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys
S3 Avc;AVC-apparaat;C:\WINDOWS\system32\DRIVERS\avc.sys
S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
S3 CO_Mon;CO_Mon;\??\C:\WINDOWS\system32\Drivers\CO_Mon.sys
S3 DCamUSBNovatek;USB Video Camera;C:\WINDOWS\system32\Drivers\nvtcam.sys
S3 dtscsi;dtscsi;C:\WINDOWS\system32\Drivers\dtscsi.sys
S3 GcKernel;Microsoft SideWinder Value Add - Filterstuurprogramma;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Mini-stuurprogramma voor virtueel HID-apparaat van Microsoft SideWinder;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 Jukebox3;Jukebox3;C:\WINDOWS\system32\DRIVERS\ctpdusb.sys
S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINDOWS\system32\57.tmp
S3 MSDV;Microsoft DV Camera and VCR;C:\WINDOWS\system32\DRIVERS\msdv.sys
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR
S3 nvax;Service for NVIDIA(R) nForce(TM) Audio Enumerator;C:\WINDOWS\system32\drivers\nvax.sys
S3 nvnforce;Service for NVIDIA(R) nForce(TM) Audio;C:\WINDOWS\system32\drivers\nvapu.sys
S3 RDID1003;EDIROL UM-2;C:\WINDOWS\system32\Drivers\rdwm1003.sys
S3 SANDRA;SANDRA;\??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Sandra.sys
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR;C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR
S3 STEAMDVR;STEAMDVR;\??\C:\Program Files\Steam\bin\x86\SteamDvr.sys
S3 XTrapD12;XTrapD12;\??\C:\WINDOWS\system32\XTrapD12.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a05f5ba-9a6e-11da-8d6c-0011d8c0871c}]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d239932-4e42-11da-b44a-806d6172696f}]


Contents of the 'Scheduled Tasks' folder
2008-01-02 23:56:21 C:\WINDOWS\Tasks\Norton Security Scan.job - C:\Program Files\Norton Security Scan\Nss.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 13:33:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2008-01-16 13:35:17
C:\ComboFix-quarantined-files.txt ... 2008-01-16 13:34
C:\ComboFix2.txt ... 2008-01-16 07:28
C:\ComboFix3.txt ... 2008-01-15 17:37

--- E O F ---





Smitfraud
=======



SmitFraudFix v2.274

Scan done at 13:22:15,67, wo 16/01/2008
Run from C:\Documents and Settings\user\Bureaublad\SmitfraudFix
OS: Microsoft Windows XP [versie 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\DOCUME~1\user\FAVORI~1\Error Cleaner.url Deleted
C:\DOCUME~1\user\FAVORI~1\Privacy Protector.url Deleted
C:\DOCUME~1\user\FAVORI~1\Spyware?Malware Protection.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.129.161 195.130.130.161
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1FAEAD3C-0096-475D-A8C4-EF6C4B128CC7}: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=195.130.129.161 195.130.130.161
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=195.130.130.1 195.130.130.129


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End



HJT (als eerste scan uitgevoerd)
========================


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:21:29, on 16/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: XTN Monitor - {0BB25A64-41B8-4051-A627-A8B9F2DA6FD2} - (no file)
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: The enqvwkp - {92162A1C-A9E3-4C0C-BCDC-2996E8406887} - C:\WINDOWS\enqvwkp.dll
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [nwiz] nwiz.exe /install
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O21 - SSODL: bmlvqkn - {3AA95204-0B50-4B54-9F41-4254121710D4} - C:\WINDOWS\bmlvqkn.dll
O21 - SSODL: agrlmvp - {C117AA22-AEBB-4972-A653-FABFF6BAA114} - C:\WINDOWS\agrlmvp.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\SysAidServer\firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\SysAidServer\firebird\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 7294 bytes



SDFix (als laaste uitgevoerd)
=====================



SDFix: Version 1.127

Run by user on wo 16/01/2008 at 16:42

Microsoft Windows XP [versie 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default HomePage Value
Restoring Default Desktop Components Value

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\DOCUME~1\user\LOCALS~1\Temp\ac8zt2.dat - Deleted
C:\WINDOWS\agrlmvp.dll - Deleted
C:\WINDOWS\bmlvqkn.dll - Deleted
C:\WINDOWS\enqvwkp.dll - Deleted
C:\WINDOWS\fxtqdrl.exe - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 16:46:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d2,b9,b3,7d,35,68,0c,80,c9,04,f9,cd,54,3d,70,f3,4d,58,74,15,54,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d2,b9,b3,7d,35,68,0c,80,c9,04,f9,cd,54,3d,70,f3,4d,58,74,15,54,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:977c534a
"s1"=dword:4ac44722
"s2"=dword:ef2ad3c3
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:d2,b9,b3,7d,35,68,0c,80,c9,04,f9,cd,54,3d,70,f3,4d,58,74,15,54,..

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 10


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\BitLord\\BitLord.exe"="C:\\Program Files\\BitLord\\BitLord.exe:*:Enabled:BitLord"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sun 14 May 2006 88 ..SHR --- "C:\WINDOWS\system32\0BAE5EC053.sys"
Tue 2 May 2006 56 ..SHR --- "C:\WINDOWS\system32\53C05EAE0B.sys"
Mon 30 Oct 2006 6,060 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Fri 31 Mar 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 24 Jun 2006 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv13.bak"
Wed 1 Aug 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 19 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\20cc0088cd851a680d48cd7c937fca62\BIT1.tmp"
Wed 19 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2dbf984193615b6f71b2df3870f6b269\BIT2.tmp"
Wed 28 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5f8852a298d3691406ec08f1d311c7d3\BIT2.tmp"
Wed 19 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\86f358f6b417711764f8556bc9e7cafb\BIT3.tmp"
Tue 11 Sep 2007 236,032 A..H. --- "C:\Program Files\Sam\HTML - CSS - PS CS2\HIKKE TAKKE TOE\pdf\~WRL0003.tmp"

Finished!

* Open hijackthis en vink volgende regels aan:

O2 - BHO: XTN Monitor - {0BB25A64-41B8-4051-A627-A8B9F2DA6FD2} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O21 - SSODL: bmlvqkn - {3AA95204-0B50-4B54-9F41-4254121710D4} - C:\WINDOWS\bmlvqkn.dll
O21 - SSODL: agrlmvp - {C117AA22-AEBB-4972-A653-FABFF6BAA114} - C:\WINDOWS\agrlmvp.dll

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Download OTMoveIt.exe en plaats het op je bureaublad:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

* Open OTMoveIt.exe.
In het linkerpaneel, waar het zegt: "Paste List of Files/Folders to be Moved" ,kopieer en plak onderstaand gedeelte:

C:\WINDOWS\agrlmvp.dll
C:\WINDOWS\bmlvqkn.dll

Daarna klik de MoveIt knop onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in volgende map: C:\_OTMoveIt\MovedFiles.
Kopieer en plak de inhoud van die log in je volgende post met een nieuw hijackthis logje.

"OTMoveIt" werkte niet zo goed er kwam:
File/Folder C:\WINDOWS\agrlmvp.dll not found.
File/Folder C:\WINDOWS\bmlvqkn.dll not found.
(wrs was het al verwijdert door andere scan)
En kon dus ook geen logje aanmaken.

**Advanced windowscare ontdekt toch nog steeds in het "spyware scan gedeelte" 2 kritische opjecten die ik maar niet wegkrijg (of enkel na spybot + combofix !) maar die komen dan weer terug (en willen ze weer niet weg voordat ik scan met deze)
welke dit zijn: http://users.telenet.be/coRCup/probleem/advanced windowscare spywarescan.JPG
-> Volgens mij betekent dit dat ik er nog steeds last van heb

In de HJT file staat iets van PDF transformer toolbar, ik wil deze verwijderen, maar het lukt me niet. Mag ik die verwijderen via HJT ? ( 02 - BHO: Solid Converter PDF )

HJT:
===

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:53:31, on 16/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\SysAidServer\firebird\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\SysAidServer\firebird\bin\fbserver.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [nwiz] nwiz.exe /install
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\SysAidServer\firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\SysAidServer\firebird\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 7838 bytes

Ok, alles is weg (denk ik)
Als je ziet dat er toch nog iets fout staat in de bovenstaande files. Gelieve dit dan toch ook te melden (maar dit zal je wel doen )
Erg bedankt ook!

Log ziet er goed uit.