Archief - Explorer Popups - google MEGAtraag...

Hellow,

had over het laatst mijn Firewall afgezet omdat m'n ps3
anders mijn TVERSITY mediaserver niet zag en had het erna
zitten (ligt vlgens mij aan de firewall). Het alles weggekregen
(popus in windows van "windows" & bureaublad achtergrond veranderde
altijd. TASKMANAGER was ook "disabled by systeembeheerder"

Nu: alles gaat nu , juist die popus van explorer. Was van "outerinfo"
maar heb dat normaal weggekregen want anders stond dat in de
titelbalk "advertisemend by outerinfo" maar nu nog steeds popus.
Google search duurt oneindig lang!

verder als ik in Windows map ga dan hangt die map vast...
ik wou daar een file opzoeken die AD-WARE zag als trojan.

Nuja ik denk dat die elke dag "opnieuw" trojans vind en delete?
of is dan diezelfde

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28:15, on 17/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\Steam\Steam.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Belkin\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Stephen\Bureaublad\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.beyondgaming.be/forums
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REGystem.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O2 - BHO: (no name) - {13F20E4F-F379-41EA-8F80-CCAAE787362A} - C:\WINDOWS\system32\urqNeBQG.dll (file missing)
O2 - BHO: (no name) - {16702622-F7FA-4342-B2DD-144E7948A37C} - C:\WINDOWS\system32\qoMggdAq.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {9AC8B136-4827-45A9-97EB-21D4EB1225BB} - C:\WINDOWS\system32\iifddDvv.dll
O2 - BHO: {3eac694c-68fc-dada-cc44-4ab9622e7acc} - {cca7e226-9ba4-44cc-adad-cf86c496cae3} - C:\WINDOWS\system32\ahvfmkeu.dll
O2 - BHO: (no name) - {D844B815-008F-0459-FD3A-71A2E49D1FCC} - C:\WINDOWS\system32\wvmeyom.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BM83dc593a] Rundll32.exe "C:\WINDOWS\system32\agqlbfyk.dll",s
O4 - HKLM\..\Run: [80ef6aa6] rundll32.exe "C:\WINDOWS\system32\wecfieoy.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] E:\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
O20 - Winlogon Notify: qoMggdAq - C:\WINDOWS\SYSTEM32\qoMggdAq.dll
O20 - Winlogon Notify: urqNeBQG - urqNeBQG.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\444.470.exe (file missing)
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

--
End of file - 5764 bytes

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

Jurgenv1 zei:

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

Klik om te vergroten...

COMBOFIX:
ComboFix 08-06-16.2 - Stephen 2008-06-17 12:37:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.1351 [GMT 2:00]
Gestart vanuit: C:\Documents and Settings\Stephen\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Documents and Settings\NetworkService\Application Data\NetMon
C:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt
C:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt
C:\Program Files\AntiSpywareMaster
C:\Program Files\Common Files\ymbols~1
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\accesss.exe
C:\WINDOWS\astctl32.ocx
C:\WINDOWS\avpcc.dll
C:\WINDOWS\BM83dc593a.xml
C:\WINDOWS\clrssn.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\cpan.dll
C:\WINDOWS\ctfmon32.exe
C:\WINDOWS\ctrlpan.dll
C:\WINDOWS\default.htm
C:\WINDOWS\directx32.exe
C:\WINDOWS\dnsrelay.dll
C:\WINDOWS\editpad.exe
C:\WINDOWS\explore.exe
C:\WINDOWS\explorer32.exe
C:\WINDOWS\funniest.exe
C:\WINDOWS\funny.exe
C:\WINDOWS\gfmnaaa.dll
C:\WINDOWS\helpcvs.exe
C:\WINDOWS\iedll.exe
C:\WINDOWS\iexplorer.exe
C:\WINDOWS\inetinf.exe
C:\WINDOWS\internet.exe
C:\WINDOWS\loader.exe
C:\WINDOWS\mainms.vpi
C:\WINDOWS\megavid.cdt
C:\WINDOWS\msconfd.dll
C:\WINDOWS\msspi.dll
C:\WINDOWS\mswsc10.dll
C:\WINDOWS\mswsc20.dll
C:\WINDOWS\mtwirl32.dll
C:\WINDOWS\muotr.so
C:\WINDOWS\notepad32.exe
C:\WINDOWS\olehelp.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\qttasks.exe
C:\WINDOWS\quicken.exe
C:\WINDOWS\rundll16.exe
C:\WINDOWS\rundll32.vbe
C:\WINDOWS\searchword.dll
C:\WINDOWS\sistem.exe
C:\WINDOWS\svchost32.exe
C:\WINDOWS\svcinit.exe
C:\WINDOWS\systeem.exe
C:\WINDOWS\system32\agqlbfyk.dll
C:\WINDOWS\system32\ahvfmkeu.dll
C:\WINDOWS\system32\akhenmww.dll
C:\WINDOWS\system32\apwpseae.dll
C:\WINDOWS\system32\ercdybyx.dll
C:\WINDOWS\system32\fcecvbgj.dll
C:\WINDOWS\system32\geBqPHaB.dll
C:\WINDOWS\system32\hgGwTjJb.dll
C:\WINDOWS\system32\hljwugsf.bin
C:\WINDOWS\system32\iifddDvv.dll
C:\WINDOWS\system32\lyblkbks.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\ntspxdqi.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\qoMggdAq.dll
C:\WINDOWS\system32\rtejlsvs.ini
C:\WINDOWS\system32\skbklbyl.dll
C:\WINDOWS\system32\tvtyrgal.dll
C:\WINDOWS\system32\vvDddfii.ini
C:\WINDOWS\system32\vvDddfii.ini2
C:\WINDOWS\system32\wecfieoy.dll
C:\WINDOWS\system32\yoeifcew.ini
C:\WINDOWS\systemcritical.exe
C:\WINDOWS\time.exe
C:\WINDOWS\users32.exe
C:\WINDOWS\waol.exe
C:\WINDOWS\win32e.exe
C:\WINDOWS\win64.exe
C:\WINDOWS\winajbm.dll
C:\WINDOWS\window.exe
C:\WINDOWS\winmgnt.exe
C:\WINDOWS\x.exe
C:\WINDOWS\xplugin.dll
C:\WINDOWS\xxxvideo.hta
C:\WINDOWS\y.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CMDSERVICE
-------\Legacy_MSSECURITY1.209.4
-------\Legacy_NETWORK_MONITOR
-------\Service_MsSecurity1.209.4


(((((((((((((((((((( Bestanden Gemaakt van 2008-05-17 to 2008-06-17 ))))))))))))))))))))))))))))))
.

2008-06-14 16:15 . 2008-06-14 16:15 4,638 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-06-14 16:15 . 2008-06-14 16:15 4,638 --a------ C:\WINDOWS\system32\ZoneAlarmIconUK.ico
2008-06-14 16:15 . 2008-06-14 16:15 4,638 --a------ C:\WINDOWS\system32\ZoneAlarmIconFR.ico
2008-06-14 16:15 . 2008-06-14 16:15 4,638 --a------ C:\WINDOWS\system32\TuneclubIconDE.ico
2008-06-14 16:15 . 2008-06-14 16:15 4,638 --a------ C:\WINDOWS\system32\Jamster.ico
2008-06-14 16:15 . 2008-06-14 16:15 4,638 --a------ C:\WINDOWS\system32\JambaIconFR.ico
2008-06-14 16:15 . 2008-06-14 16:15 4,638 --a------ C:\WINDOWS\system32\CelldoradoIconUK.ico
2008-06-14 16:15 . 2008-06-14 16:15 4,638 --a------ C:\WINDOWS\system32\BlinkoIconES.ico
2008-06-14 15:14 . 2008-06-14 15:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-14 15:13 . 2008-06-14 15:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-14 14:43 . 2008-06-16 20:41 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-14 14:42 . 2008-06-14 15:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 14:42 . 2008-06-14 14:42 164 --a------ C:\install.dat
2008-06-14 14:41 . 2008-06-14 15:14 <DIR> d-------- C:\Program Files\Lavasoft
2008-06-14 14:33 . 2008-06-14 14:33 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-06-14 14:31 . 2008-06-14 14:41 <DIR> d-------- C:\Program Files\ESET
2008-06-14 14:30 . 2008-06-14 14:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
2008-06-14 14:26 . 2008-06-14 14:26 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
2008-06-14 14:25 . 2008-06-14 14:25 <DIR> d-------- C:\WINDOWS\system32\4638
2008-06-14 14:25 . 2008-06-14 15:50 <DIR> d-------- C:\Program Files\Hitman Pro
2008-06-13 22:51 . 2008-06-13 23:09 <DIR> d-------- C:\Program Files\Symantec
2008-06-13 22:51 . 2008-06-13 23:10 <DIR> d-------- C:\Program Files\Norton AntiVirus
2008-06-13 22:51 . 2008-06-13 23:10 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-13 22:51 . 2008-06-13 22:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-13 22:46 . 2008-06-13 23:09 <DIR> d-------- C:\Documents and Settings\Administrator\Sjablonen
2008-06-13 22:46 . 2008-06-13 23:09 <DIR> d-------- C:\Documents and Settings\Administrator\Favorieten
2008-06-13 22:46 . 2008-06-13 23:09 <DIR> d---s---- C:\Documents and Settings\Administrator
2008-06-13 21:30 . 2008-06-13 21:30 <DIR> dr------- C:\Documents and Settings\NetworkService\Favorieten
2008-06-13 21:29 . 2008-06-14 15:45 <DIR> d--hs---- C:\WINDOWS\WFlSSVM
2008-06-13 21:29 . 2008-06-14 15:52 <DIR> d-------- C:\WINDOWS\system32\RI
2008-06-13 21:29 . 2008-06-14 15:45 <DIR> d-------- C:\WINDOWS\system32\oprt
2008-06-13 21:29 . 2008-06-13 21:29 <DIR> d-------- C:\WINDOWS\system32\netrax01
2008-06-13 21:29 . 2008-06-13 21:29 <DIR> d-------- C:\WINDOWS\system32\cPT
2008-06-13 21:29 . 2008-06-13 21:29 <DIR> d-------- C:\Temp\itmp4
2008-06-13 21:29 . 2008-06-17 12:37 <DIR> d-------- C:\Temp
2008-06-13 21:29 . 2008-06-13 21:29 25,600 --a------ C:\WINDOWS\system32\urqNeBQG.dll__DELETE_ON_REBOOT
2008-06-13 21:24 . 2008-06-13 21:24 <DIR> d-------- C:\WINDOWS\Sun
2008-06-12 01:18 . 2008-06-12 01:18 <DIR> d-------- C:\Documents and Settings\Stephen\Application Data\Apple Computer
2008-06-12 01:16 . 2008-06-12 01:16 <DIR> d-------- C:\Program Files\QuickTime
2008-06-12 01:16 . 2008-06-12 01:16 <DIR> d-------- C:\Program Files\Apple Software Update
2008-06-12 01:16 . 2008-06-12 01:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-08 20:04 . 2008-06-08 20:04 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-06-08 20:01 . 2008-06-08 20:01 <DIR> d-------- C:\ATI
2008-06-08 20:01 . 2008-05-12 10:49 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-06-08 17:49 . 2008-06-08 17:49 <DIR> d-------- C:\Program Files\LimeWire
2008-06-08 17:48 . 2008-06-17 12:12 <DIR> d-------- C:\Documents and Settings\Stephen\.limewire
2008-06-08 04:13 . 2008-06-08 04:13 32,768 --a------ C:\WINDOWS\system32\netrax01\netrax011065.exe
2008-06-02 19:17 . 2004-08-04 01:03 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-06-02 19:17 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-06-02 19:17 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-06-02 19:17 . 2001-09-06 21:27 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-05-30 17:50 . 2008-05-30 17:50 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-05-30 17:50 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-05-30 17:50 . 2008-05-30 17:50 395 --a------ C:\WINDOWS\ODBC.INI
2008-05-30 17:49 . 2008-05-30 17:50 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-05-30 17:46 . 2008-05-30 17:46 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-05-30 17:42 . 2008-05-30 17:42 <DIR> d-------- C:\Documents and Settings\Stephen\Application Data\DAEMON Tools
2008-05-30 17:42 . 2008-05-30 17:42 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-05-29 16:00 . 2008-05-29 16:03 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-05-27 07:17 . 2008-05-27 07:17 <DIR> d-------- C:\Program Files\OpenOffice.org 2.3
2008-05-27 07:17 . 2008-06-13 06:38 <DIR> d-------- C:\Documents and Settings\Stephen\Application Data\OpenOffice.org2
2008-05-27 07:16 . 2008-05-28 12:11 <DIR> d-------- C:\Program Files\Java
2008-05-27 07:16 . 2008-05-27 07:16 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-27 07:16 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-26 18:29 . 2006-06-03 21:29 48,128 --a------ C:\WINDOWS\system32\hpz3l4pi.dll
2008-05-26 18:28 . 2008-05-26 18:28 <DIR> d-------- C:\Program Files\HP
2008-05-26 18:26 . 2006-06-22 05:03 56 --a------ C:\ut9x.bat
2008-05-26 18:26 . 2006-06-19 23:08 54 --a------ C:\ut.bat
2008-05-26 17:22 . 2008-05-26 17:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania
2008-05-26 17:20 . 2008-05-26 17:21 <DIR> d-------- C:\Program Files\TmNationsForever
2008-05-26 17:18 . 2008-05-26 17:18 <DIR> d-------- C:\Documents and Settings\Stephen\Bluetooth Software
2008-05-26 17:18 . 2004-08-04 01:03 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-05-26 17:18 . 2004-08-04 01:03 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-05-26 17:17 . 2004-08-04 00:57 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-05-26 17:17 . 2004-08-04 00:57 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-05-26 17:14 . 2008-05-26 17:14 <DIR> d-------- C:\Program Files\Belkin
2008-05-26 14:41 . 2008-05-26 14:41 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-05-26 14:31 . 2008-06-13 00:00 593 --a------ C:\WINDOWS\system32\tversity.cookies
2008-05-26 14:27 . 2008-05-26 14:27 <DIR> d-------- C:\Program Files\ffdshow
2008-05-26 14:27 . 2003-03-18 21:14 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-05-26 14:27 . 2003-02-21 05:42 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-05-26 14:27 . 2007-04-24 17:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2008-05-26 14:27 . 2007-06-03 14:31 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-05-26 14:27 . 2007-06-03 14:31 6,144 --a------ C:\WINDOWS\system32\ff_acm.acm
2008-05-26 14:27 . 2006-12-10 23:32 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-05-26 14:26 . 2008-05-26 14:27 <DIR> d-------- C:\Program Files\TVersity Codec Pack
2008-05-26 14:26 . 2008-05-26 14:26 <DIR> d-------- C:\Program Files\TVersity
2008-05-26 14:19 . 2008-06-02 19:26 <DIR> d-------- C:\Program Files\WS_FTP
2008-05-26 14:18 . 2008-05-26 14:18 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-05-26 14:17 . 2008-05-26 14:17 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-05-26 14:16 . 2008-05-26 14:16 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-26 14:16 . 2008-05-26 14:16 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-05-26 14:14 . 2008-05-26 14:14 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-05-26 14:14 . 2008-05-26 14:14 <DIR> d---s---- C:\Documents and Settings\Stephen\UserData
2008-05-26 14:14 . 2008-05-26 14:14 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-05-26 14:14 . 2008-05-26 14:14 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-05-26 14:11 . 2008-05-26 14:11 <DIR> d-------- C:\Program Files\Realtek
2008-05-26 14:10 . 2007-01-13 00:54 520,192 --a------ C:\WINDOWS\RtlExUpd.dll
2008-05-26 14:10 . 2008-05-26 14:10 315,392 --a------ C:\WINDOWS\HideWin.exe

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 18:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-08 18:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-26 13:52 --------- d-----w C:\Program Files\Logitech
2008-05-26 13:52 --------- d-----w C:\Program Files\Common Files\Logitech
2008-05-26 13:52 --------- d-----w C:\Program Files\Common Files\LogiShrd
2008-05-26 13:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logishrd
2008-05-26 13:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-05-26 13:15 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-05-26 13:15 --------- d-----w C:\Documents and Settings\Stephen\Application Data\teamspeak2
2008-05-26 11:58 --------- d-----w C:\Program Files\Intel
2008-05-26 11:53 --------- d-----w C:\Program Files\MSN Messenger
2008-05-26 11:51 --------- d-----w C:\Program Files\Attansic
2008-05-26 11:29 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-12 16:30 3,007,488 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-05-12 15:56 397,312 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-05-12 15:54 305,152 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-05-12 15:53 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-05-12 15:45 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-05-12 15:45 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-05-12 15:45 180,224 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-05-12 15:45 139,264 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-05-12 15:44 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-05-12 15:43 540,672 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-05-12 15:43 10,153,984 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-05-12 15:41 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-05-12 15:32 3,203,168 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-05-12 15:22 1,999,616 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-05-12 15:09 47,104 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-05-12 15:05 327,680 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-05-12 15:03 19,968 ----a-w C:\WINDOWS\system32\atiadlxx.dll
2008-05-12 15:03 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-05-12 15:02 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-05-12 15:02 241,664 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-05-12 14:57 548,864 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-05-02 20:46 6,554,496 ------w C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-05-02 20:46 6,108,160 ------w C:\WINDOWS\system32\nv4_disp.dll
2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13F20E4F-F379-41EA-8F80-CCAAE787362A}]
C:\WINDOWS\system32\urqNeBQG.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D844B815-008F-0459-FD3A-71A2E49D1FCC}]
C:\WINDOWS\system32\wvmeyom.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"Steam"="E:\Steam\\Steam.exe" [2008-05-26 14:30 1271032]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 22:49 16126464 C:\WINDOWS\RTHDCPL.exe]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57 282624]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
BTTray.lnk - C:\Program Files\Belkin\Bluetooth Software\BTTray.exe [2006-06-07 17:05:38 553021]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{13F20E4F-F379-41EA-8F80-CCAAE787362A}"= C:\WINDOWS\system32\urqNeBQG.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqNeBQG]
urqNeBQG.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"cmdService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"E:\\Steam\\SteamApps\\_xyris_\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\TmNationsForever\\TmForever.exe"=
"H:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 14:12]
S2 PlugPlayRPC;Plug and Play (RPC);C:\WINDOWS\portsv.exe service []

.
Inhoud van de 'Gedeelde Taken' map
"2008-06-12 16:46:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-17 10:39:50 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 12:40:01
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\ati2evxx.exe
E:\Steam\Steam.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Belkin\Bluetooth Software\BTStackServer.exe
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
.
**************************************************************************
.
Voltooingstijd: 2008-06-17 12:41:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-17 10:41:43

Pre-Run: 22,505,922,560 bytes beschikbaar
Post-Run: 22,673,698,816 bytes beschikbaar

329


HIJACK:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:42:58, on 17/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\Steam\Steam.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\Belkin\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
H:\[ Programs ]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.beyondgaming.be/forums
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {13F20E4F-F379-41EA-8F80-CCAAE787362A} - C:\WINDOWS\system32\urqNeBQG.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {D844B815-008F-0459-FD3A-71A2E49D1FCC} - C:\WINDOWS\system32\wvmeyom.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] E:\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
O20 - Winlogon Notify: urqNeBQG - urqNeBQG.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

--
End of file - 5332 bytes



Ik heb wel niet 1 Ingetikt en de PC starte vanzelf weer op.
(alles ging blijkbaar vanzelf)

* Download Malwarebytes' Anti-Malware via hier of hier.

Dubbelklik mbam-setup.exe om het programma te installeren.

• Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Launch Malwarebytes' Anti-Malware, Klik daarna op "finish".
• Indien een update gevonden werd, zal het die downloaden en de laatste versie installeren.
• Wanneer het programma volledig up to date is, selecteer "Perform Quick Scan", daarna klik Scan.
• Het scannen kan een tijdje duren, dus wees geduldig.
• Wanneer de scan voltooid is, klik OK, daarna "Show Results" om de resultaten te zien.
• Zorg ervoor dat daar alles aangevinkt is, daarna klik: Remove Selected.
• Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie extra nota onderaan)
• De log wordt automatisch bewaard door MBAM die je kan zien door de "Logs" tab te klikken in MBAM.
• Kopieer en plak de resultaten van de log in je volgend antwoord, samen met een nieuw HijackThislog.

Extra Nota:
Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de Computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.