Archief - Even log checken, ben gehacked geweest.

Mja blijkbaar zit er vuiligheid op mn pc, mn world of warcraft account is gehacked

dus kan iemand ff checken.

alvast bedankt!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:24:41, on 1-8-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Vista Drive Icon\DrvIcon.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Simon\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1208800636250
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 5896 bytes

log ziet er goed uit ...

damn, hoe kan ik te weten komen waar die keylogger ergens zit dan?

bedankt om te checke btw

Voor de zekerheid:

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

Ok, hier komt het:

ComboFix 08-08-01.04 - Simon 2008-08-02 17:38:26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.1527 [GMT 2:00]
Gestart vanuit: C:\Documents and Settings\Simon\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Simon\Application Data\macromedia\Flash Player\#SharedObjects\GVP00001\interclick.com
C:\Documents and Settings\Simon\Application Data\macromedia\Flash Player\#SharedObjects\GVP00001\interclick.com\ud.sol
C:\Documents and Settings\Simon\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Simon\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-07-02 to 2008-08-02 ))))))))))))))))))))))))))))))
.

2008-07-29 16:58 . 2008-07-29 16:58 <DIR> d-------- C:\Logs
2008-07-29 16:56 . 2008-07-29 16:56 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-07-25 18:38 . 2008-07-25 18:38 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-25 18:38 . 2008-07-25 18:38 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-24 00:26 . 2008-07-30 01:58 <DIR> d-------- C:\Program Files\Subdownloader
2008-07-19 18:05 . 2006-05-31 09:22 62,232 -r------- C:\WINDOWS\system32\GameuxInstallHelper.dll
2008-07-19 14:00 . 2008-07-19 14:00 <DIR> d-------- C:\WINDOWS\system32\VirtualExpander
2008-07-17 22:17 . 2008-07-17 22:17 <DIR> d-------- C:\Documents and Settings\Simon\Application Data\Teleca
2008-07-13 22:49 . 2008-07-13 22:49 <DIR> d-------- C:\Program Files\TomTom HOME 2
2008-07-13 22:49 . 2008-07-13 22:49 <DIR> d-------- C:\Documents and Settings\Simon\Application Data\TomTom
2008-07-12 22:43 . 2008-07-12 22:43 <DIR> d-------- C:\Documents and Settings\Simon\Application Data\Sony Ericsson
2008-07-12 22:43 . 2008-07-12 22:43 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
2008-07-12 22:41 . 2008-07-17 22:20 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2008-07-12 22:41 . 2008-07-17 22:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2008-07-12 22:41 . 2008-07-12 22:41 21,672 --a------ C:\WINDOWS\system32\drivers\ggsemc.sys
2008-07-12 22:41 . 2008-07-12 22:41 13,352 --a------ C:\WINDOWS\system32\drivers\ggflt.sys
2008-07-12 22:40 . 2008-07-17 22:20 <DIR> d-------- C:\Program Files\Sony Ericsson
2008-07-07 23:28 . 2008-07-07 23:28 <DIR> d-------- C:\Program Files\Vista Drive Icon
2008-07-07 23:28 . 2008-07-07 23:29 5,253 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-07-06 16:55 . 2008-07-06 16:55 <DIR> d-------- C:\Documents and Settings\Simon\Application Data\DivX
2008-07-06 16:55 . 2008-05-30 19:22 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe
2008-07-06 16:55 . 2008-05-30 19:22 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe
2008-07-06 16:54 . 2008-07-07 22:36 <DIR> d-------- C:\Program Files\DivX
2008-07-06 16:27 . 2008-07-06 16:27 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2008-07-06 16:27 . 2008-07-06 16:36 29,902 --a------ C:\WINDOWS\DIIUnin.dat
2008-07-06 16:27 . 2008-07-06 16:27 2,829 --a------ C:\WINDOWS\DIIUnin.pif

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-02 11:24 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-02 02:43 --------- d-----w C:\Documents and Settings\Simon\Application Data\Azureus
2008-07-17 20:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-15 22:55 --------- d-----w C:\Program Files\FlashFXP
2008-07-07 21:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-07 21:36 --------- d-----w C:\Program Files\Glitchy's Model Editing Suite
2008-07-07 21:29 71,326 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-06-17 22:34 --------- d-----w C:\Program Files\SubDownloader2
2008-06-11 21:45 --------- d-----w C:\Documents and Settings\Simon\Application Data\Lavasoft
2008-06-11 21:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-11 17:38 --------- d-----w C:\Documents and Settings\Simon\Application Data\dyyno-vlc
2008-06-09 20:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Prevx
2008-06-06 21:56 --------- d-----w C:\Documents and Settings\Simon\Application Data\LimeWire
2008-06-06 21:38 --------- d-----w C:\Program Files\Java
2008-06-06 21:37 --------- d-----w C:\Program Files\Common Files\Java
2008-06-02 23:22 --------- d-----w C:\Documents and Settings\Simon\Application Data\vlc
2008-06-02 23:22 --------- d-----w C:\Documents and Settings\Simon\Application Data\dvdcss
2008-06-02 22:18 --------- d-----w C:\Documents and Settings\Simon\Application Data\CyberLink
2008-06-01 18:14 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
.

------- Sigcheck -------

2007-10-11 01:42 825344 79a07c04c00d4acf47afdb44e7fef1cc C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
2007-12-07 04:00 825344 9294b445326b926babc3f382f8410a31 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
2008-03-01 14:49 827392 1073283dc2d66c5539301baef0bcb442 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
2004-08-04 02:03 659456 6c7e1322898378c30bcd9f779a2621ee C:\WINDOWS\ie7\wininet.dll
2007-08-13 18:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
2007-10-11 01:54 824832 8aeb1e98d785bea8278bdf2d3389d6e2 C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
2007-12-07 04:18 824832 c3877ec9fe7642975e83846dc7bfcd8c C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
2007-10-11 01:54 824832 8aeb1e98d785bea8278bdf2d3389d6e2 C:\WINDOWS\SoftwareDistribution\Download\036c89a2b8c304944d03ab6469b6ca70\SP2GDR\wininet.dll
2007-10-11 01:42 825344 79a07c04c00d4acf47afdb44e7fef1cc C:\WINDOWS\SoftwareDistribution\Download\036c89a2b8c304944d03ab6469b6ca70\SP2QFE\wininet.dll
2007-12-07 04:18 824832 c3877ec9fe7642975e83846dc7bfcd8c C:\WINDOWS\SoftwareDistribution\Download\7d953bb3c7470fb7a638f999a54adca3\SP2GDR\wininet.dll
2007-12-07 04:00 825344 9294b445326b926babc3f382f8410a31 C:\WINDOWS\SoftwareDistribution\Download\7d953bb3c7470fb7a638f999a54adca3\SP2QFE\wininet.dll
2008-02-16 11:05 662528 1d77f302bbfe2d407dd67c5cb098ea95 C:\WINDOWS\SoftwareDistribution\Download\d88df4b7a5141a0b04846b90bbe73ef3\sp2gdr\wininet.dll
2008-02-16 11:33 669184 c683f6cf71edfcb8708bdf2c5dd1ba13 C:\WINDOWS\SoftwareDistribution\Download\d88df4b7a5141a0b04846b90bbe73ef3\sp2qfe\wininet.dll
2008-03-01 15:05 826368 0bc8124d6ea627a1bb864094a43c2698 C:\WINDOWS\SoftwareDistribution\Download\f7efd6f87d93148263b0b8790abd0b1b\SP2GDR\wininet.dll
2008-03-01 14:49 827392 1073283dc2d66c5539301baef0bcb442 C:\WINDOWS\SoftwareDistribution\Download\f7efd6f87d93148263b0b8790abd0b1b\SP2QFE\wininet.dll
2008-03-01 15:05 817152 6b116f0822c03c53300c897499b13611 C:\WINDOWS\system32\wininet.dll
2008-03-01 15:05 817152 6b116f0822c03c53300c897499b13611 C:\WINDOWS\system32\dllcache\wininet.dll

2007-06-13 15:24 979456 1b23f40acaed86b9f6db6833d22cfdb0 C:\WINDOWS\explorer.exe
2007-06-13 15:12 1036800 1d6245afbd3faabc16a885116be1874d C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2004-08-04 02:03 1035776 a1d7304a87fc3093150f5e3cc7b0f338 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2007-06-13 15:24 979456 1b23f40acaed86b9f6db6833d22cfdb0 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.EXE" [2004-01-20 05:09 192512]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08 813912]
"Telemeter 3.0"="C:\Program Files\Telemeter 3.0\telemeter3.exe" [2007-04-16 00:38 1441792]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 14:39 49152]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:03 15360]

C:\Documents and Settings\Simon\Menu Start\Programma's\Opstarten\
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 09:43:08 180224]
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 09:43:14 155648]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-07-24 11:50:16 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Games\\Sega Rally\\SEGA Rally.exe"=
"D:\\Games\\Sega Rally\\SEGA Rally_SSE1.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

R0 m5289;m5289;C:\WINDOWS\system32\drivers\m5289.sys [2004-12-01 10:49]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2005-05-03 17:31]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 16:51]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN51.SYS [2005-03-22 20:36]
S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-07-12 22:41]
.
- - - - ORPHANS REMOVED - - - -

ShellIconOverlayIdentifiers-{E4000AC4-5E5F-4956-807A-C5854405D64F} - %SystemRoot%\system32\VirtualExpander\VEShellExt.dll
Notify-WgaLogon - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Simon\Application Data\Mozilla\Firefox\Profiles\b6qkcod5.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.be/
FF -: plugin - C:\Documents and Settings\Simon\Application Data\Mozilla\Firefox\Profiles\b6qkcod5.default\extensions\[email protected]\plugins\npDyyno.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava11.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava12.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava13.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava14.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjava32.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll
FF -: plugin - C:\Program Files\Java\jre1.6.0_06\bin\npoji610.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-02 17:43:10
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Voltooingstijd: 2008-08-02 17:45:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-02 15:45:00

Pre-Run: 11,622,469,632 bytes beschikbaar
Post-Run: 11,749,367,808 bytes beschikbaar

182


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:46:29, on 2-8-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\Vista Drive Icon\DrvIcon.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Simon\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1208800636250
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--
End of file - 5930 bytes

upje heb andere account en zou nie wille da die ook gehacked wordt.

Ziet er goed uit hoor.