Archief - HiJackThis log thoraxx

THoRaXX · 6 nov 2006

In een moment van onoplettendheid heb ik iets van vuiligheid geinstalleerd, scannen met de conventionele programma's lost niet alles op

Hulp wordt geapprecieerd :applause:.

Logfile of HijackThis v1.99.1
Scan saved at 18:37:48, on 6/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\System32\ElkCtrl.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\CloneCD\CloneCDTray.exe
C:\Program Files\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\PopMessenger\PopMessenger.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {02CA00BE-BC04-CBD8-7F55-B6CE6D9EEDB2} - C:\WINDOWS\System32\oyvcveq.dll (file missing)
O2 - BHO: (no name) - {02CA00BE-BC04-CBD8-7F55-B6CE6D9EEDB2} - C:\WINDOWS\System32\oyvcveq.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {D11C691F-88FC-FF79-8BAA-D928E35660EF} - C:\WINDOWS\System32\kwtpw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\System32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\System32\drvros.dll,startup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [PopMessenger] C:\Program Files\PopMessenger\PopMessenger.exe
O4 - HKCU\..\Run: [Eest] "C:\PROGRA~1\COMMON~1\PPATCH~1\alg.exe" -vt ndrv
O4 - HKCU\..\Run: [Wda] C:\WINDOWS\system32\s?mbols\?ttrib.exe
O4 - HKCU\..\Run: [_mzu_stonedrv8] c:\windows\system32\_mzu_stonedrv8.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: DCOM Server 2240 - {2C1CD3D7-86AC-4068-93BC-A02304BB2240} - (no file)
O21 - SSODL: fVSGjd - {ECA342DE-4609-E874-E086-961CBFE7A441} - C:\WINDOWS\System32\uot.dll (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Jurgenv1 · 6 nov 2006

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/combofix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

THoRaXX · 6 nov 2006

** Combofix Log deel 1 **

Kenny - 06-11-06 19:32:16,26 Service Pack 1
ComboFix 06.10.19 - Running from: "C:\Program Files\Mozilla Firefox"

((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\Kenny\Application Data\Dxccwrd.dll
C:\Documents and Settings\Kenny\Application Data\Dxcknwrd.dll
C:\WINDOWS\system32\bkd.exe

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\{ECA342DD-067E-2067-0815-060728060020}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Kenny\Application Data\RACLE~1
C:\QooBox\Purity\Program Files\Common Files\PPATCH~1
C:\QooBox\Purity\Program Files\Common Files\PPATCH~1\??pPatch
C:\QooBox\Purity\Program Files\Common Files\PPATCH~1\??pPatch\dohinst-103.0000

((((((((((((((((((((((((((((((( Files Created from 2006-10-06 to 2006-11-06 ))))))))))))))))))))))))))))))))))

2006-11-04 20:40 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2006-11-04 20:37 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll
2006-11-04 20:37 974,848 --a------ C:\WINDOWS\system32\dxdiag.exe
2006-11-04 20:37 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys
2006-11-04 20:37 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe
2006-11-04 20:37 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll
2006-11-04 20:37 79,360 --a------ C:\WINDOWS\system32\dpwsockx.dll
2006-11-04 20:37 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll
2006-11-04 20:37 76,800 --a------ C:\WINDOWS\system32\dmscript.dll
2006-11-04 20:37 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll
2006-11-04 20:37 723,968 --a------ C:\WINDOWS\system32\dpnet.dll
2006-11-04 20:37 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys
2006-11-04 20:37 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll
2006-11-04 20:37 64,512 --a------ C:\WINDOWS\system32\amstream.dll
2006-11-04 20:37 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll
2006-11-04 20:37 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll
2006-11-04 20:37 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys
2006-11-04 20:37 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys
2006-11-04 20:37 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys
2006-11-04 20:37 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll
2006-11-04 20:37 48,512 --a------ C:\WINDOWS\system32\drivers\stream.sys
2006-11-04 20:37 470,528 --a------ C:\WINDOWS\system32\qdvd.dll
2006-11-04 20:37 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll
2006-11-04 20:37 46,592 --a------ C:\WINDOWS\system32\dxdllreg.exe
2006-11-04 20:37 4,608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys
2006-11-04 20:37 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys
2006-11-04 20:37 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll
2006-11-04 20:37 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll
2006-11-04 20:37 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll
2006-11-04 20:37 33,280 --a------ C:\WINDOWS\system32\dmloader.dll
2006-11-04 20:37 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll
2006-11-04 20:37 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll
2006-11-04 20:37 316,928 --a------ C:\WINDOWS\system32\qdv.dll
2006-11-04 20:37 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll
2006-11-04 20:37 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll
2006-11-04 20:37 292,864 --a------ C:\WINDOWS\system32\ddraw.dll
2006-11-04 20:37 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe
2006-11-04 20:37 27,136 --a------ C:\WINDOWS\system32\dmband.dll
2006-11-04 20:37 257,024 --a------ C:\WINDOWS\system32\qcap.dll
2006-11-04 20:37 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll
2006-11-04 20:37 230,400 --a------ C:\WINDOWS\system32\dplayx.dll
2006-11-04 20:37 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll
2006-11-04 20:37 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll
2006-11-04 20:37 181,248 --a------ C:\WINDOWS\system32\dmime.dll
2006-11-04 20:37 18,944 --a------ C:\WINDOWS\system32\encapi.dll
2006-11-04 20:37 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys
2006-11-04 20:37 18,432 --a------ C:\WINDOWS\system32\dswave.dll
2006-11-04 20:37 16,896 --a------ C:\WINDOWS\system32\msyuv.dll
2006-11-04 20:37 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe
2006-11-04 20:37 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys
2006-11-04 20:37 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys
2006-11-04 20:37 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys
2006-11-04 20:37 132,608 --a------ C:\WINDOWS\system32\devenum.dll
2006-11-04 20:37 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys
2006-11-04 20:37 122,880 --a------ C:\WINDOWS\system32\dmusic.dll
2006-11-04 20:37 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll
2006-11-04 20:37 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys
2006-11-04 20:37 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll
2006-11-04 20:37 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys
2006-11-04 20:37 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys
2006-11-04 20:37 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll
2006-11-04 20:37 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll
2006-11-04 20:37 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll
2006-11-04 20:37 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll
2006-11-04 20:37 1,201,152 --a------ C:\WINDOWS\system32\d3d8.dll
2006-11-04 20:37 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll
2006-10-31 11:29 3,888 --a------ C:\WINDOWS\system32\drivers\NTHANDLE.SYS
2006-10-30 17:58 502,368 --a------ C:\WINDOWS\system32\drivers\amon.sys
2006-10-30 17:58 274,432 --a------ C:\WINDOWS\system32\imon.dll
2006-10-30 01:55 36,864 --a------ C:\WINDOWS\system32\mf3216.dll
2006-10-30 01:53 51,072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2006-10-30 01:45 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys
2006-10-30 01:40 78,336 --a------ C:\WINDOWS\system32\drivers\ssi.sys
2006-10-30 01:40 102,912 --a------ C:\WINDOWS\system32\islzma.dll
2006-10-30 01:38 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2006-10-30 00:10 2 --a------ C:\WINDOWS\system32\wintsvcc.exe
2006-10-30 00:05 1,259 --a------ C:\WINDOWS\system32\rzp7d5bd.sys
2006-10-30 00:00 53,760 --a------ C:\WINDOWS\system32\drvros.dll
2006-10-29 23:54 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2006-10-27 22:27 69,632 --a------ C:\WINDOWS\system32\eRecUtil.dll
2006-10-27 22:27 49,152 --a------ C:\WINDOWS\system32\SysMonitor.exe
2006-10-27 22:08 147,456 --a------ C:\WINDOWS\UNINST32.EXE
2006-10-24 22:10 50,176 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2006-10-24 22:05 65,536 --a------ C:\WINDOWS\system32\MFC71DEU.DLL
2006-10-24 22:05 61,440 --a------ C:\WINDOWS\system32\MFC71ITA.DLL
2006-10-24 22:05 61,440 --a------ C:\WINDOWS\system32\MFC71ESP.DLL
2006-10-24 22:05 57,344 --a------ C:\WINDOWS\system32\MFC71ENU.DLL
2006-10-24 22:05 57,344 --a------ C:\WINDOWS\system32\ElkCtlPS.dll
2006-10-24 22:05 49,152 --a------ C:\WINDOWS\system32\MFC71KOR.DLL
2006-10-24 22:05 49,152 --a------ C:\WINDOWS\system32\MFC71JPN.DLL
2006-10-24 22:05 45,056 --a------ C:\WINDOWS\system32\MFC71CHT.DLL
2006-10-24 22:05 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2006-10-24 22:05 40,960 --a------ C:\WINDOWS\system32\VxLibRes.dll
2006-10-24 22:05 40,960 --a------ C:\WINDOWS\system32\MFC71CHS.DLL
2006-10-24 22:05 39,424 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
2006-10-24 22:05 380,928 --a------ C:\WINDOWS\system32\LVUI2RC.dll
2006-10-24 22:05 323,584 --a------ C:\WINDOWS\system32\CamCplRes.dll
2006-10-24 22:05 262,144 --a------ C:\WINDOWS\system32\ElkCtrl.exe
2006-10-24 22:05 245,824 -ra------ C:\WINDOWS\system32\InstExec.exe
2006-10-24 22:05 245,824 --a------ C:\WINDOWS\Instexec.exe
2006-10-24 22:05 221,184 --a------ C:\WINDOWS\system32\LVUI2.dll
2006-10-24 22:05 204,800 --a------ C:\WINDOWS\system32\lvcodec2.dll
2006-10-24 22:05 2,760 --a------ C:\WINDOWS\system32\Repository.reg
2006-10-24 22:05 167,936 --a------ C:\WINDOWS\system32\VxLib.dll
2006-10-24 22:05 151,552 --a------ C:\WINDOWS\system32\VLib.dll
2006-10-24 22:05 110,592 --a------ C:\WINDOWS\system32\lvcoinst.dll
2006-10-24 22:05 1,645,320 --a------ C:\WINDOWS\system32\gdiplus.dll
2006-10-24 22:05 1,097,728 --a------ C:\WINDOWS\system32\drivers\lv321av.sys
2006-10-24 22:05 1,047,552 --a------ C:\WINDOWS\system32\mfc71u.dll
2006-10-24 18:07 77,942 --a------ C:\WINDOWS\system32\BisonRem.dll
2006-10-24 18:07 576,000 --a------ C:\WINDOWS\system32\drivers\BisonCam.sys
2006-10-23 12:49 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2006-10-23 12:49 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2006-10-23 12:49 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2006-10-23 12:49 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2006-10-23 12:49 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe
2006-10-20 01:22 856,064 --a------ C:\WINDOWS\system32\xvidcore.dll
2006-10-20 01:22 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2006-10-20 00:57 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2006-10-20 00:57 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2006-10-20 00:51 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2006-10-19 20:13 299,520 --a------ C:\WINDOWS\uninst.exe
2006-10-19 19:03 9,344 --a------ C:\WINDOWS\system32\drivers\compbatt.sys
2006-10-19 19:03 57,088 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2006-10-19 19:03 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2006-10-19 19:03 14,080 --a------ C:\WINDOWS\system32\drivers\battc.sys
2006-10-19 19:03 13,184 --a------ C:\WINDOWS\system32\drivers\CmBatt.sys
2006-10-19 19:02 8,064 --a------ C:\WINDOWS\system32\drivers\wmiacpi.sys
2006-10-19 19:01 86,556 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-10-19 19:01 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-10-19 19:01 72,704 --a------ C:\WINDOWS\system32\storprop.dll
2006-10-19 19:01 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-10-19 19:01 67,072 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-10-19 19:01 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-10-19 19:01 6,656 --a------ C:\WINDOWS\system32\batt.dll
2006-10-19 19:01 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-10-19 19:01 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-10-19 19:01 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-10-19 19:01 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-10-19 19:01 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-10-19 19:01 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-10-19 19:01 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-10-19 19:01 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-10-19 19:01 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-10-19 19:01 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-10-19 19:01 15,872 --a------ C:\WINDOWS\TASKMAN.EXE
2006-10-19 19:01 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-10-19 19:01 103,936 --a------ C:\WINDOWS\system32\EqnClass.Dll
2006-10-19 19:01 10,496 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2006-10-19 18:54 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll
2006-10-19 18:54 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-10-19 18:54 381,952 --a------ C:\WINDOWS\system32\dsound.dll
2006-10-19 18:54 13,312 --a------ C:\WINDOWS\system32\msdmo.dll
2006-10-19 18:54 1,769,472 --a------ C:\WINDOWS\system32\dxdiagn.dll
2006-10-19 18:54 1,703,936 --a------ C:\WINDOWS\system32\d3d9.dll
2006-10-19 18:21 21,760 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS
2006-10-19 18:17 94,297 --a------ C:\WINDOWS\system32\SynTPAPI.dll
2006-10-19 18:17 82,012 --a------ C:\WINDOWS\system32\SynCOM.dll
2006-10-19 18:17 81,920 --a------ C:\WINDOWS\system32\SynTPCo2.dll
2006-10-19 18:17 69,721 --a------ C:\WINDOWS\system32\SynTPFcs.dll
2006-10-19 18:17 191,936 --a------ C:\WINDOWS\system32\drivers\SynTP.sys
2006-10-19 18:17 114,688 --a------ C:\WINDOWS\system32\SynCtrl.dll
2006-10-19 18:08 50,048 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2006-10-19 18:08 2,816 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2006-10-19 18:08 159,360 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2006-10-19 17:55 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2006-10-19 17:52 78,976 --a------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2006-10-19 17:52 5,888 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2006-10-19 17:52 142,208 --a------ C:\WINDOWS\system32\drivers\aec.sys
2006-10-19 17:48 77,440 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2006-10-19 17:47 56,832 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2006-10-19 17:46 57,856 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2006-10-19 17:46 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe
2006-10-19 17:46 135,168 -r------- C:\WINDOWS\system32\RtlCPAPI.dll
2006-10-19 17:45 9,710,592 -r------- C:\WINDOWS\RTLCPL.exe
2006-10-19 17:45 86,016 -r------- C:\WINDOWS\SoundMan.exe
2006-10-19 17:45 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2006-10-19 17:45 4,137,984 -r------- C:\WINDOWS\system32\drivers\RtkHDAud.Sys
2006-10-19 17:45 356,352 -r------- C:\WINDOWS\RtlUpd.exe
2006-10-19 17:45 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-10-19 17:45 2,809,856 -r------- C:\WINDOWS\alcwzrd.exe
2006-10-19 17:45 2,158,592 -r------- C:\WINDOWS\MicCal.exe
2006-10-19 17:45 182,880 --a------ C:\WINDOWS\system32\iuengine.dll
2006-10-19 17:45 15,961,088 -r------- C:\WINDOWS\RTHDCPL.exe
2006-10-19 17:44 487,424 -r------- C:\WINDOWS\RtlExUpd.dll
2006-10-19 17:37 94,208 --a------ C:\WINDOWS\system32\odbcint.dll
2006-10-19 17:37 73,728 --a------ C:\WINDOWS\system32\dbnetlib.dll
2006-10-19 17:37 73,728 --a------ C:\WINDOWS\system32\cliconfg.dll
2006-10-19 17:37 61,440 --a------ C:\WINDOWS\system32\odbccu32.dll
2006-10-19 17:37 61,440 --a------ C:\WINDOWS\system32\odbccr32.dll
2006-10-19 17:37 44,032 --a------ C:\WINDOWS\system32\msxml3r.dll
2006-10-19 17:37 401,408 --a------ C:\WINDOWS\system32\sqlsrv32.dll
2006-10-19 17:37 4,656 --a------ C:\WINDOWS\system32\ds16gt.dll
2006-10-19 17:37 36,864 --a------ C:\WINDOWS\system32\mscpxl32.dll
2006-10-19 17:37 32,768 --a------ C:\WINDOWS\system32\odbcad32.exe
2006-10-19 17:37 28,672 --a------ C:\WINDOWS\system32\dbnmpntw.dll
2006-10-19 17:37 28,672 --a------ C:\WINDOWS\system32\dbmsgnet.dll
2006-10-19 17:37 26,224 --a------ C:\WINDOWS\system32\odbc16gt.dll
2006-10-19 17:37 24,576 --a------ C:\WINDOWS\system32\odbcbcp.dll
2006-10-19 17:37 24,576 --a------ C:\WINDOWS\system32\dbmsvinn.dll
2006-10-19 17:37 24,576 --a------ C:\WINDOWS\system32\dbmsrpcn.dll
2006-10-19 17:37 24,576 --a------ C:\WINDOWS\system32\dbmsadsn.dll
2006-10-19 17:37 221,184 --a------ C:\WINDOWS\system32\odbc32.dll
2006-10-19 17:37 21,275 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2006-10-19 17:37 20,480 --a------ C:\WINDOWS\system32\msorc32r.dll
2006-10-19 17:37 20,480 --a------ C:\WINDOWS\system32\cliconfg.exe
2006-10-19 17:37 180,800 --a------ C:\WINDOWS\system32\sqlunirl.dll
2006-10-19 17:37 16,384 --a------ C:\WINDOWS\system32\odbc32gt.dll
2006-10-19 17:37 16,384 --a------ C:\WINDOWS\system32\ds32gt.dll
2006-10-19 17:37 147,456 --a------ C:\WINDOWS\system32\odbctrac.dll
2006-10-19 17:37 143,360 --a------ C:\WINDOWS\system32\msdart.dll
2006-10-19 17:37 139,264 --a------ C:\WINDOWS\system32\msorcl32.dll
2006-10-19 17:37 102,400 --a------ C:\WINDOWS\system32\odbccp32.dll
2006-10-19 17:37 1,129,472 --a------ C:\WINDOWS\system32\msxml3.dll
2006-10-19 17:31 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe
2006-10-19 17:30 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2006-10-19 17:28 86,912 --a------ C:\WINDOWS\system32\drivers\atapi.sys
2006-10-19 17:28 69,120 --a------ C:\WINDOWS\system32\usbui.dll
2006-10-19 17:28 62,976 --a------ C:\WINDOWS\system32\drivers\pci.sys
2006-10-19 17:28 51,968 --a------ C:\WINDOWS\system32\drivers\usbhub.sys
2006-10-19 17:28 36,352 --a------ C:\WINDOWS\system32\drivers\isapnp.sys
2006-10-19 17:28 3,328 --a------ C:\WINDOWS\system32\drivers\pciide.sys
2006-10-19 17:28 23,680 --a------ C:\WINDOWS\system32\drivers\pciidex.sys
2006-10-19 17:28 19,328 --a------ C:\WINDOWS\system32\drivers\usbuhci.sys
2006-10-19 17:28 19,328 --a------ C:\WINDOWS\system32\drivers\usbehci.sys
2006-10-19 17:28 135,552 --a------ C:\WINDOWS\system32\drivers\usbport.sys
2006-10-19 17:16 0 -rahs---- C:\MSDOS.SYS
2006-10-19 17:16 0 -rahs---- C:\IO.SYS
2006-10-19 17:16 0 --a------ C:\CONFIG.SYS
2006-10-19 17:16 0 --a------ C:\AUTOEXEC.BAT
2006-10-19 17:15 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-10-19 17:13 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-10-19 17:13 69,632 --a------ C:\WINDOWS\system32\icwdial.dll
2006-10-19 17:13 69,248 --a------ C:\WINDOWS\system32\drivers\sr.sys
2006-10-19 17:13 67,584 --a------ C:\WINDOWS\system32\acctres.dll
2006-10-19 17:13 63,488 --a------ C:\WINDOWS\system32\srclient.dll
2006-10-19 17:13 61,440 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-10-19 17:13 49,664 --a------ C:\WINDOWS\system32\inetres.dll
2006-10-19 17:13 40,960 --a------ C:\WINDOWS\system32\safrslv.dll
2006-10-19 17:13 39,424 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-10-19 17:13 33,792 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-10-19 17:13 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-10-19 17:13 28,672 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-10-19 17:13 270,336 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-10-19 17:13 26,624 --a------ C:\WINDOWS\system32\safrdm.dll
2006-10-19 17:13 228,352 --a------ C:\WINDOWS\system32\srrstr.dll
2006-10-19 17:13 223,232 --a------ C:\WINDOWS\system32\qmgr.dll
2006-10-19 17:13 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-10-19 17:13 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-10-19 17:13 158,720 --a------ C:\WINDOWS\system32\srsvc.dll
2006-10-19 17:13 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-10-19 17:13 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-10-19 17:12 9,728 --a------ C:\WINDOWS\system32\mstinit.exe
2006-10-19 17:12 81,408 --a------ C:\WINDOWS\system32\msoert2.dll
2006-10-19 17:12 73,728 --a------ C:\WINDOWS\system32\ils.dll
2006-10-19 17:12 65,536 --a------ C:\WINDOWS\system32\msconf.dll
2006-10-19 17:12 587,776 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-10-19 17:12 32,256 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-10-19 17:12 253,952 --a------ C:\WINDOWS\system32\mstask.dll
2006-10-19 17:12 24,576 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-10-19 17:12 228,864 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-10-19 17:12 160,256 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-10-19 17:11 9,728 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-10-19 17:11 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-10-19 17:11 869,376 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-10-19 17:11 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-10-19 17:11 83,968 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-10-19 17:11 82,432 --a------ C:\WINDOWS\system32\comrepl.dll
2006-10-19 17:11 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2006-10-19 17:11 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-10-19 17:11 662,528 --a------ C:\WINDOWS\system32\getuname.dll
2006-10-19 17:11 61,952 --a------ C:\WINDOWS\system32\rdshost.exe
2006-10-19 17:11 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-10-19 17:11 57,344 --a------ C:\WINDOWS\system32\sol.exe
2006-10-19 17:11 56,832 --a------ C:\WINDOWS\system32\colbact.dll
2006-10-19 17:11 55,808 --a------ C:\WINDOWS\system32\freecell.exe
2006-10-19 17:11 54,784 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-10-19 17:11 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-10-19 17:11 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-10-19 17:11 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-10-19 17:11 495,616 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-10-19 17:11 495,616 --a------ C:\WINDOWS\system32\comuid.dll
2006-10-19 17:11 468,480 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-10-19 17:11 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-10-19 17:11 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-10-19 17:11 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-10-19 17:11 35,840 --a------ C:\WINDOWS\system32\winchat.exe
2006-10-19 17:11 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-10-19 17:11 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-10-19 17:11 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-10-19 17:11 233,472 --a------ C:\WINDOWS\system32\avtapi.dll
2006-10-19 17:11 23,040 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-10-19 17:11 22,016 --a------ C:\WINDOWS\system32\msg.exe
2006-10-19 17:11 215,040 --a------ C:\WINDOWS\system32\catsrv.dll
2006-10-19 17:11 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-10-19 17:11 20,232 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2006-10-19 17:11 182,784 --a------ C:\WINDOWS\system32\accwiz.exe
2006-10-19 17:11 18,944 --a------ C:\WINDOWS\system32\qprocess.exe
2006-10-19 17:11 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-10-19 17:11 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-10-19 17:11 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-10-19 17:11 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-10-19 17:11 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-10-19 17:11 151,040 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-10-19 17:11 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-10-19 17:11 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-10-19 17:11 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2006-10-19 17:11 15,360 --a------ C:\WINDOWS\system32\shadow.exe
2006-10-19 17:11 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-10-19 17:11 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-10-19 17:11 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-10-19 17:11 128,000 --a------ C:\WINDOWS\system32\mshearts.exe
2006-10-19 17:11 125,440 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-10-19 17:11 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-10-19 17:11 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-10-19 17:11 11,144 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2006-10-19 17:11 100,864 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-10-19 17:11 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2006-10-19 17:10 99,840 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-10-19 17:10 9,216 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-10-19 17:10 9,216 --a------ C:\WINDOWS\system32\icaapi.dll
2006-10-19 17:10 88,576 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-10-19 17:10 75,912 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-10-19 17:10 598,016 --a------ C:\WINDOWS\system32\mstscax.dll
2006-10-19 17:10 582,656 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-10-19 17:10 57,856 --a------ C:\WINDOWS\system32\licwmi.dll
2006-10-19 17:10 57,344 --a------ C:\WINDOWS\system32\remotepg.dll
2006-10-19 17:10 534,528 --a------ C:\WINDOWS\system32\spider.exe
2006-10-19 17:10 53,248 --a------ C:\WINDOWS\system32\servdeps.dll
2006-10-19 17:10 44,032 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-10-19 17:10 40,960 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-10-19 17:10 393,728 --a------ C:\WINDOWS\system32\mstsc.exe
2006-10-19 17:10 38,024 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2006-10-19 17:10 359,936 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-10-19 17:10 342,528 --a------ C:\WINDOWS\system32\mspaint.exe
2006-10-19 17:10 33,280 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-10-19 17:10 202,240 --a------ C:\WINDOWS\system32\termsrv.dll
2006-10-19 17:10 189,952 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-10-19 17:10 182,400 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2006-10-19 17:10 178,176 --a------ C:\WINDOWS\system32\cmprops.dll
2006-10-19 17:10 16,896 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-10-19 17:10 141,824 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-10-19 17:10 14,848 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-10-19 17:10 135,680 --a------ C:\WINDOWS\system32\rdchost.dll
2006-10-19 17:10 130,048 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-10-19 17:10 12,288 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-10-19 17:10 117,760 --a------ C:\WINDOWS\system32\mplay32.exe
2006-10-19 17:10 115,976 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2006-10-19 17:10 1,172,992 --a------ C:\WINDOWS\system32\comsvcs.dll

THoRaXX · 6 nov 2006

** deel 2 **

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

2006-11-06 19:32 -------- d-------- C:\Program Files\Common Files
2006-11-06 19:31 -------- d-------- C:\Program Files\Mozilla Firefox
2006-11-06 18:37 -------- d-------- C:\Program Files\hijackthis
2006-11-06 16:57 -------- d-------- C:\Program Files\DC++
2006-11-06 16:48 -------- d-------- C:\Documents and Settings\Kenny\Application Data\OpenOffice.org2
2006-11-05 14:16 -------- d-------- C:\Program Files\Call of Duty 2
2006-11-04 21:04 -------- d-------- C:\Program Files\Need for Speed Most Wanted
2006-11-02 16:11 -------- d-------- C:\Program Files\ESET
2006-11-02 15:14 -------- d-------- C:\Program Files\Hitman Pro
2006-11-02 13:24 -------- d-------- C:\Program Files\SpywareBlaster
2006-11-02 13:24 -------- d-------- C:\Program Files\Spyware Doctor
2006-10-31 11:23 -------- d-------- C:\Program Files\WhoLockMe104
2006-10-31 11:14 -------- d-------- C:\Program Files\TrackMania Nations ESWC
2006-10-30 11:22 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Azureus
2006-10-30 11:01 -------- d-------- C:\Program Files\Azureus
2006-10-30 02:10 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-10-30 02:06 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Lavasoft
2006-10-30 01:45 -------- d-------- C:\Documents and Settings\Kenny\Application Data\PC Tools
2006-10-30 01:40 -------- d-------- C:\Program Files\Webroot
2006-10-30 01:40 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Webroot
2006-10-30 01:38 -------- d-------- C:\Program Files\Lavasoft
2006-10-30 01:04 -------- d---s---- C:\Documents and Settings\Kenny\Application Data\Microsoft
2006-10-30 01:04 -------- d-------- C:\Program Files\Online Services
2006-10-30 00:10 -------- d-------- C:\Program Files\PowerDVD
2006-10-29 23:55 -------- d-------- C:\Documents and Settings\Kenny\Application Data\CyberLink
2006-10-29 23:54 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-29 23:54 -------- d-------- C:\Program Files\Cyberlink
2006-10-29 16:12 -------- d-------- C:\Program Files\PopMessenger
2006-10-29 16:12 -------- d-------- C:\Documents and Settings\Kenny\Application Data\LeadMind
2006-10-29 13:13 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Real
2006-10-28 23:24 -------- d-------- C:\Program Files\Real Alternative
2006-10-28 23:24 -------- d-------- C:\Program Files\Media Player Classic
2006-10-28 22:05 -------- d-------- C:\Program Files\Winamp
2006-10-28 03:21 -------- d-------- C:\Program Files\Java
2006-10-28 02:58 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Media Player Classic
2006-10-28 00:39 -------- d-------- C:\Program Files\RealVNC
2006-10-27 22:45 -------- d-------- C:\Program Files\Windows Media Player
2006-10-27 22:25 -------- d-------- C:\Program Files\Internet Explorer
2006-10-27 22:08 -------- d-------- C:\Program Files\Acer Inc
2006-10-26 14:55 -------- d-------- C:\Program Files\CloneCD
2006-10-25 23:04 -------- d-------- C:\Program Files\QuickTime
2006-10-25 10:50 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Sun
2006-10-25 10:42 -------- d-------- C:\Program Files\Common Files\Java
2006-10-25 01:07 -------- d-------- C:\Program Files\Battle Realms
2006-10-25 00:34 11376 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-10-24 23:41 -------- d-------- C:\Program Files\opendcd-0.5.8
2006-10-24 22:05 -------- d-------- C:\Program Files\Common Files\Logitech
2006-10-24 22:05 -------- d-------- C:\Program Files\Common Files\Acer
2006-10-24 22:05 -------- d-------- C:\Program Files\Acer
2006-10-23 16:58 -------- d-------- C:\Program Files\OpenOffice.org 2.0
2006-10-23 16:57 -------- d-------- C:\Program Files\OpenOffice.org 2.0 Installation Files
2006-10-23 12:52 -------- d-------- C:\Documents and Settings\Kenny\Application Data\ICAClient
2006-10-23 10:17 -------- d-------- C:\Program Files\Citrix
2006-10-23 09:28 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Adobe
2006-10-23 09:24 -------- d-------- C:\Program Files\Common Files\Adobe
2006-10-23 09:22 867 --a------ C:\Documents and Settings\Kenny\Application Data\AdobeDLM.log
2006-10-23 09:22 0 --a------ C:\Documents and Settings\Kenny\Application Data\dm.ini
2006-10-23 09:22 -------- d-------- C:\Program Files\Adobe
2006-10-22 21:46 -------- d-------- C:\Program Files\MSN Messenger
2006-10-22 21:46 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-20 01:22 -------- d-------- C:\Program Files\K-Lite Codec Pack
2006-10-20 00:48 -------- d-------- C:\Program Files\UT2004
2006-10-19 22:06 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Macromedia
2006-10-19 21:06 -------- d-------- C:\Program Files\WinRAR
2006-10-19 19:07 -------- d-------- C:\Program Files\Microsoft Games
2006-10-19 19:04 -------- d-------- C:\Program Files\VirtualCloneDrive
2006-10-19 19:01 62 --ahs---- C:\Documents and Settings\Kenny\Application Data\desktop.ini
2006-10-19 19:01 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-10-19 19:01 -------- d-------- C:\Program Files\Common Files\ODBC
2006-10-19 18:43 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-19 18:17 -------- d-------- C:\Program Files\Synaptics
2006-10-19 18:10 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Talkback
2006-10-19 18:10 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Mozilla
2006-10-19 17:52 -------- d--h----- C:\Program Files\WindowsUpdate
2006-10-19 17:45 -------- d-------- C:\Program Files\Realtek
2006-10-19 17:37 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Intel
2006-10-19 17:36 -------- d-------- C:\Program Files\Intel
2006-10-19 17:26 -------- d--h----- C:\Program Files\Uninstall Information
2006-10-19 17:26 -------- d-------- C:\Documents and Settings\Kenny\Application Data\Identities
2006-10-19 17:16 -------- d-------- C:\Program Files\xerox
2006-10-19 17:16 -------- d-------- C:\Program Files\microsoft frontpage
2006-10-19 17:13 -------- d-------- C:\Program Files\Outlook Express
2006-10-19 17:13 -------- d-------- C:\Program Files\NetMeeting
2006-10-19 17:13 -------- d-------- C:\Program Files\Movie Maker
2006-10-19 17:13 -------- d-------- C:\Program Files\Common Files\System
2006-10-19 17:13 -------- d-------- C:\Program Files\Common Files\Services
2006-10-19 17:13 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-10-19 17:11 -------- d-------- C:\Program Files\Windows NT
2006-10-19 17:11 -------- d-------- C:\Program Files\MSN
2006-10-19 17:11 -------- d-------- C:\Program Files\Messenger

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"PopMessenger"="C:\\Program Files\\PopMessenger\\PopMessenger.exe"
"Eest"="\"C:\\PROGRA~1\\COMMON~1\\PPATCH~1\\alg.exe\" -vt ndrv"
"Wda"="C:\\WINDOWS\\system32\\s?mbols\\?ttrib.exe"
"_mzu_stonedrv8"="c:\\windows\\system32\\_mzu_stonedrv8.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
"IntelZeroConfig"="\"C:\\Program Files\\Intel\\Wireless\\bin\\ZCfgSvc.exe\""
"IntelWireless"="\"C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe\" /tf Intel PROSet/Wireless"
"EOUApp"="\"C:\\Program Files\\Intel\\Wireless\\Bin\\EOUWiz.exe\""
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"AzMixerSel"="C:\\Program Files\\Realtek\\InstallShield\\AzMixerSel.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"VirtualCloneDrive"="\"C:\\Program Files\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"LVCOMSX"="C:\\WINDOWS\\System32\\LVCOMSX.EXE"
"LogitechCameraAssistant"="C:\\Program Files\\Acer\\OrbiCam\\CameraAssistant.exe"
"LogitechVideo[inspector]"="C:\\Program Files\\Acer\\OrbiCam\\InstallHelper.exe /inspect"
"LogitechCameraService(E)"="C:\\WINDOWS\\System32\\ElkCtrl.exe /automation"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"CloneCDTray"="\"C:\\Program Files\\CloneCD\\CloneCDTray.exe\" /s"
"RemoteControl"="\"C:\\Program Files\\PowerDVD\\PDVDServ.exe\""
"LanguageShortcut"="\"C:\\Program Files\\PowerDVD\\Language\\Language.exe\""
"CTDrive"="rundll32.exe C:\\WINDOWS\\System32\\drvros.dll,startup"
"nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="C:\\Program Files\\ComPlus Applications\\kycesom.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\Program Files\\Online Services\\hozyqekij.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,0c,01,00,00,00,00,00,00,31,04,00,00,84,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,20,01,00,00,00,00,00,00,80,04,00,00,66,03,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,20,01,00,00,00,00,00,00,80,04,00,00,66,03,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"_mzu_stonedrv8"="c:\\windows\\system32\\_mzu_stonedrv8.exe"
"Spyware Doctor"=""

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"_mzu_stonedrv8"="c:\\windows\\system32\\_mzu_stonedrv8.exe"
"Spyware Doctor"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"
"{2C1CD3D7-86AC-4068-93BC-A02304BB2240}"="DCOM Server 2240"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"DCOM Server 2240"="{2C1CD3D7-86AC-4068-93BC-A02304BB2240}"
"fVSGjd"="{ECA342DE-4609-E874-E086-961CBFE7A441}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-06 19:33:54.06
C:\ComboFix.txt ... 06-11-06 19:33

THoRaXX · 6 nov 2006

Logfile of HijackThis v1.99.1
Scan saved at 19:36:52, on 6/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\System32\ElkCtrl.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\CloneCD\CloneCDTray.exe
C:\Program Files\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\PopMessenger\PopMessenger.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {02CA00BE-BC04-CBD8-7F55-B6CE6D9EEDB2} - C:\WINDOWS\System32\oyvcveq.dll (file missing)
O2 - BHO: (no name) - {02CA00BE-BC04-CBD8-7F55-B6CE6D9EEDB2} - C:\WINDOWS\System32\oyvcveq.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {D11C691F-88FC-FF79-8BAA-D928E35660EF} - C:\WINDOWS\System32\kwtpw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\System32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\System32\drvros.dll,startup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [PopMessenger] C:\Program Files\PopMessenger\PopMessenger.exe
O4 - HKCU\..\Run: [Eest] "C:\PROGRA~1\COMMON~1\PPATCH~1\alg.exe" -vt ndrv
O4 - HKCU\..\Run: [Wda] C:\WINDOWS\system32\s?mbols\?ttrib.exe
O4 - HKCU\..\Run: [_mzu_stonedrv8] c:\windows\system32\_mzu_stonedrv8.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: DCOM Server 2240 - {2C1CD3D7-86AC-4068-93BC-A02304BB2240} - (no file)
O21 - SSODL: fVSGjd - {ECA342DE-4609-E874-E086-961CBFE7A441} - C:\WINDOWS\System32\uot.dll (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Jurgenv1 · 6 nov 2006

1. Download The Avenger by Swandog46 naar je Bureaublad.

Klik op Avenger.zip om het uit te pakken naar je bureaublad

2. Nu, start The Avenger door op het icoontje met het zwaard te dubbelklikken.

Onder "Script file to execute" kies "Input Script Manually".
Klik op het vergrootglas icoontje die een niew venster zal openen met de naam "View/edit script"
Kopieer en plak volgend volledig vetgedrukt erin:

Driver to unload:
pe386

Klik om te vergroten...

Opgelet: Bovenstaande code werd enkel gemaakt voor deze computer/situatie/user. Indien je deze code op een andere computer gebruikt kan het schade toebrengen!
Klik Done
Daarna klik op het Groen verkeerslicht om het script uit te voeren
Antwoord "Yes/Ja" wanneer daarnaar gevraagd wordt.

3. The Avenger zal daarna het volgende doen:

Uw computer herstarten. ( In gevallen waar het script een code bevat met "Drivers to Unload", dan zal The Avenger tweemaal uw systeem herstarten)
Na herstart, zal het vlug een zwart command window openen. Dit is normaal.
Na herstart, zal het een log maken die zal openen met de resultaten van The Avenger. Deze log zal te vinden zijn op C:\avenger.txt
The Avenger maakt ook backups aan met alle bestanden, etc., die eerder werden verwijderd door The Avenger, deze backups bevinden zich op volgende plaats: C:\avenger\backup.zip.

4. Laat het volgende tooltje eens runnen: http://aknow.prevx.com/zeroL/FixGrom.exe
5. Kopieer en plak de inhoud van avenger.txt in je volgende post samen met een nieuw hijackthislog.

THoRaXX · 6 nov 2006

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ftmpwbmj

*******************

Fatal error: integrity of Services key failed verification check! Security may be fatally compromised. Exiting immediately.

Could not open script file! Status: 0xc0000034 Abort!

klinkt niet bepaald hoopgevend

nieuwe HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 20:32:43, on 6/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\System32\ElkCtrl.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\CloneCD\CloneCDTray.exe
C:\Program Files\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\PopMessenger\PopMessenger.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {02CA00BE-BC04-CBD8-7F55-B6CE6D9EEDB2} - C:\WINDOWS\System32\oyvcveq.dll (file missing)
O2 - BHO: (no name) - {02CA00BE-BC04-CBD8-7F55-B6CE6D9EEDB2} - C:\WINDOWS\System32\oyvcveq.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {D11C691F-88FC-FF79-8BAA-D928E35660EF} - C:\WINDOWS\System32\kwtpw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\System32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\System32\drvros.dll,startup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [PopMessenger] C:\Program Files\PopMessenger\PopMessenger.exe
O4 - HKCU\..\Run: [Eest] "C:\PROGRA~1\COMMON~1\PPATCH~1\alg.exe" -vt ndrv
O4 - HKCU\..\Run: [Wda] C:\WINDOWS\system32\s?mbols\?ttrib.exe
O4 - HKCU\..\Run: [_mzu_stonedrv8] c:\windows\system32\_mzu_stonedrv8.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: DCOM Server 2240 - {2C1CD3D7-86AC-4068-93BC-A02304BB2240} - (no file)
O21 - SSODL: fVSGjd - {ECA342DE-4609-E874-E086-961CBFE7A441} - C:\WINDOWS\System32\uot.dll (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Jurgenv1 · 6 nov 2006

Probeer eens volgend script:

Code:

Drivers to unload:
pe386

THoRaXX · 6 nov 2006

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ioogadpq

*******************

Script file located at: \??\C:\Documents and Settings\ivjsvxir.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver pe386 unloaded successfully.

Completed script processing.

*******************

Finished! Terminate.

nieuwe HJT:

Logfile of HijackThis v1.99.1
Scan saved at 20:46:50, on 6/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\System32\ElkCtrl.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\CloneCD\CloneCDTray.exe
C:\Program Files\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\PopMessenger\PopMessenger.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {02CA00BE-BC04-CBD8-7F55-B6CE6D9EEDB2} - C:\WINDOWS\System32\oyvcveq.dll (file missing)
O2 - BHO: (no name) - {02CA00BE-BC04-CBD8-7F55-B6CE6D9EEDB2} - C:\WINDOWS\System32\oyvcveq.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {D11C691F-88FC-FF79-8BAA-D928E35660EF} - C:\WINDOWS\System32\kwtpw.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\System32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\System32\drvros.dll,startup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [PopMessenger] C:\Program Files\PopMessenger\PopMessenger.exe
O4 - HKCU\..\Run: [Eest] "C:\PROGRA~1\COMMON~1\PPATCH~1\alg.exe" -vt ndrv
O4 - HKCU\..\Run: [Wda] C:\WINDOWS\system32\s?mbols\?ttrib.exe
O4 - HKCU\..\Run: [_mzu_stonedrv8] c:\windows\system32\_mzu_stonedrv8.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: DCOM Server 2240 - {2C1CD3D7-86AC-4068-93BC-A02304BB2240} - (no file)
O21 - SSODL: fVSGjd - {ECA342DE-4609-E874-E086-961CBFE7A441} - C:\WINDOWS\System32\uot.dll (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

THoRaXX · 6 nov 2006

log van gromfix:

Removal tool loaded into memory
Removing ADS stream: C:\WINDOWS\System32:lzx32.sys

DATA
Gromozon rootkit component not detected - searching for other components
Scanning: C:\WINDOWS
Scanning: C:\Program Files\Common Files

Trojan.Gromozon Removed!

Jurgenv1 · 6 nov 2006

* Download en installeer AVG Anti-Spyware.

Na de installatie, open AVG Anti-Spyware:
* onder "Status", klik op Change state naast "Resident shield". (wijzig van active naar inactive!)
* onder "Update", klik op de Start update knop.
* onder "Scanner", tab "Settings":
- - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine. (ZEER BELANGRIJK!)
  * onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
Sluit AVG Anti-Spyware. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm
Download link van Ad-aware: http://www.lavasoftusa.com/products/ad-aware_se_personal.php

* Start je computer op in VEILIGE MODUS

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

* Start AVG Anti-Spyware.

* Klik op Scan en kies Complete System Scan.
Na de scan; volg onderstaande instructies :
BELANGRIJK : Klik niet op de "Save Scan Report" knop vooraleer je de "Apply all Actions" knop hebt aangeklikt !
* Draag er zorg voor dat Set all elements to: op Quarantine staat (1),
zoniet klik op de link en kies Quarantine in de popup menu. (2)
(Dit geldt niet voor cookies, deze worden onveranderlijk gedelete !)
* Onderaan het venster klik op de Apply all Actions knop. (3)

* Wanneer je de melding krijgt 'All actions have been applied', klik je onderaan op de knop Save Report.

* Herstart je computer in normale modus.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Post dan een nieuw hijackthis logje hier met het rapport van AVG antispyware.

Archief - HiJackThis log thoraxx

THoRaXX

Legacy Member

Jurgenv1

Legacy Member

THoRaXX

Legacy Member

THoRaXX

Legacy Member

THoRaXX

Legacy Member

Jurgenv1

Legacy Member

THoRaXX

Legacy Member

Jurgenv1

Legacy Member

THoRaXX

Legacy Member

THoRaXX

Legacy Member

Jurgenv1

Legacy Member