Archief - Iemand goesting om te checke?

Dankuzeer bij voorbaat ^^

Tis voor ne pc dak aant opkuise ben van iemand, kheb eerst hitmanpro zen ding laten doen (was dringend nodig :|)

Khoop dat al wa clean is, toch voor de zekerheid mor is late checke.

Logfile of HijackThis v1.99.1
Scan saved at 21:34:11, on 23/09/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\WINDOWS\System32\Tablet.exe
C:\Documents and Settings\nancy\Local Settings\Temp\Tijdelijke map 1 voor hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: load=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1109196003752
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

Ga naar http://windowsupdate.microsoft.com/ en installeer service pack 1 (wacht met service pack 2 tot je pc weer clean is)

Post dan een nieuw hijackthis logje hier.

eja die service packs staan der nog ni op

even een tussenvraag, waar leerde die logs analysere ^^

LethPhaos zei:

eja die service packs staan der nog ni op

even een tussenvraag, waar leerde die logs analysere ^^

Klik om te vergroten...

Eens snel logjes leren analyseren kan je niet zeggen , het duurt maanden en het vraagt tijd van je, en in ruil moet je mensen gaan helpen dus voor eigen gebruik is het niet.

Installeer nu maar SP1

lap nu werkt da netwerk nimeer :/
hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 12:35:15, on 24/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Documents and Settings\nancy\Local Settings\Temp\Tijdelijke map 2 voor hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: load=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1109196003752
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

1. Download dit bestand: - combofix.exe
2. Dubbelklik op combofix.exe en volg de instructies die je krijgt.
3. Wanneer het tooltje klaar is zal het een rapport maken voor je, post die log hier met een nieuw hijackthis logje.

Note:
Niet klikken terwijl combofix bezig is, dat zou het tooltje doen vastlopen!

nancy - 06-09-24 13:49:38,34 Service Pack 1
ComboFix 06.09.23.2 - Running from: "E:\"

((((((((((((((((((((((((((((((( Files Created from 2006-08-24 to 2006-09-24 ))))))))))))))))))))))))))))))))))


2006-09-24 12:01 9,216 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-09-24 12:01 87,552 --a------ C:\WINDOWS\system32\wlnotify.dll
2006-09-24 12:01 86,016 --a------ C:\WINDOWS\system32\xactsrv.dll
2006-09-24 12:01 77,824 --a------ C:\WINDOWS\system32\wmpstub.exe
2006-09-24 12:01 77,824 --a------ C:\WINDOWS\system32\wmpshell.dll
2006-09-24 12:01 57,344 --a------ C:\WINDOWS\system32\wzcdlg.dll
2006-09-24 12:01 48,128 --a------ C:\WINDOWS\system32\winsta.dll
2006-09-24 12:01 446,464 --a------ C:\WINDOWS\system32\wmvdmoe.dll
2006-09-24 12:01 38,912 --a------ C:\WINDOWS\system32\wsnmp32.dll
2006-09-24 12:01 311,327 --a------ C:\WINDOWS\system32\wmv8dmod.dll
2006-09-24 12:01 296,448 --a------ C:\WINDOWS\system32\wmstream.dll
2006-09-24 12:01 270,336 --a------ C:\WINDOWS\winhlp32.exe
2006-09-24 12:01 264,704 --a------ C:\WINDOWS\system32\wzcsvc.dll
2006-09-24 12:01 253,952 --a------ C:\WINDOWS\system32\wmpcd.dll
2006-09-24 12:01 248,320 --a------ C:\WINDOWS\system32\wow32.dll
2006-09-24 12:01 23,552 --a------ C:\WINDOWS\system32\wzcsapi.dll
2006-09-24 12:01 2,015,232 --a------ C:\WINDOWS\system32\wmploc.dll
2006-09-24 12:01 174,592 --a------ C:\WINDOWS\system32\winmm.dll
2006-09-24 12:01 174,200 --a------ C:\WINDOWS\system32\xenroll.dll
2006-09-24 12:01 17,408 --a------ C:\WINDOWS\system32\wtsapi32.dll
2006-09-24 12:01 168,960 --a------ C:\WINDOWS\system32\wldap32.dll
2006-09-24 12:01 13,312 --a------ C:\WINDOWS\system32\wship6.dll
2006-09-24 12:01 118,784 --a------ C:\WINDOWS\system32\wmsdmoe.dll
2006-09-24 12:01 1,404,928 --a------ C:\WINDOWS\system32\wmpui.dll
2006-09-24 12:01 1,298,432 --a------ C:\WINDOWS\system32\wmpcore.dll
2006-09-24 12:00 61,952 --a------ C:\WINDOWS\system32\webclnt.dll
2006-09-24 12:00 61,440 --a------ C:\WINDOWS\system32\wextract.exe
2006-09-24 12:00 50,176 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2006-09-24 12:00 48,640 --a------ C:\WINDOWS\system32\vdmredir.dll
2006-09-24 12:00 479,261 --a------ C:\WINDOWS\system32\vbscript.dll
2006-09-24 12:00 47,616 --a------ C:\WINDOWS\system32\utilman.exe
2006-09-24 12:00 409,088 --a------ C:\WINDOWS\system32\vssapi.dll
2006-09-24 12:00 339,456 --a------ C:\WINDOWS\system32\usp10.dll
2006-09-24 12:00 32,768 --a------ C:\WINDOWS\system32\umandlg.dll
2006-09-24 12:00 316,928 --a------ C:\WINDOWS\system32\wiaservc.dll
2006-09-24 12:00 261,120 --a------ C:\WINDOWS\system32\webcheck.dll
2006-09-24 12:00 231,424 --a------ C:\WINDOWS\system32\upnpui.dll
2006-09-24 12:00 22,016 --a------ C:\WINDOWS\system32\udhisapi.dll
2006-09-24 12:00 203,776 --a------ C:\WINDOWS\system32\uxtheme.dll
2006-09-24 12:00 166,400 --a------ C:\WINDOWS\system32\w32time.dll
2006-09-24 12:00 165,376 --a------ C:\WINDOWS\system32\upnphost.dll
2006-09-24 12:00 16,384 --a------ C:\WINDOWS\system32\watchdog.sys
2006-09-24 12:00 16,384 --a------ C:\WINDOWS\system32\ups.exe
2006-09-24 12:00 125,440 --a------ C:\WINDOWS\system32\webvw.dll
2006-09-24 12:00 120,320 --a------ C:\WINDOWS\system32\wiadss.dll
2006-09-24 12:00 120,320 --a------ C:\WINDOWS\system32\upnp.dll
2006-09-24 12:00 108,032 --a------ C:\WINDOWS\system32\umpnpmgr.dll
2006-09-24 12:00 107,520 --a------ C:\WINDOWS\system32\url.dll
2006-09-24 11:59 88,576 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-09-24 11:59 81,920 --a------ C:\WINDOWS\system32\trkwks.dll
2006-09-24 11:59 74,752 --a------ C:\WINDOWS\system32\telnet.exe
2006-09-24 11:59 72,704 --a------ C:\WINDOWS\system32\storprop.dll
2006-09-24 11:59 676,352 --a------ C:\WINDOWS\system32\sxs.dll
2006-09-24 11:59 671,744 --a------ C:\WINDOWS\system32\ss3dfo.scr
2006-09-24 11:59 643,072 --a------ C:\WINDOWS\system32\sstext3d.scr
2006-09-24 11:59 63,488 --a------ C:\WINDOWS\system32\srclient.dll
2006-09-24 11:59 61,952 --a------ C:\WINDOWS\system32\sti.dll
2006-09-24 11:59 569,344 --a------ C:\WINDOWS\system32\sspipes.scr
2006-09-24 11:59 43,008 --a------ C:\WINDOWS\system32\ssdpsrv.dll
2006-09-24 11:59 40,960 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-09-24 11:59 388,608 --a------ C:\WINDOWS\system32\themeui.dll
2006-09-24 11:59 364,544 --a------ C:\WINDOWS\system32\ssflwbox.scr
2006-09-24 11:59 27,136 --a------ C:\WINDOWS\system32\ssdpapi.dll
2006-09-24 11:59 251,904 --a------ C:\WINDOWS\system32\strmdll.dll
2006-09-24 11:59 233,984 --a------ C:\WINDOWS\system32\tapisrv.dll
2006-09-24 11:59 202,240 --a------ C:\WINDOWS\system32\termsrv.dll
2006-09-24 11:59 19,456 --a------ C:\WINDOWS\system32\ssmarque.scr
2006-09-24 11:59 18,944 --a------ C:\WINDOWS\system32\ssbezier.scr
2006-09-24 11:59 17,408 --a------ C:\WINDOWS\system32\ssmyst.scr
2006-09-24 11:59 165,376 --a------ C:\WINDOWS\system32\tapi32.dll
2006-09-24 11:59 158,720 --a------ C:\WINDOWS\system32\srsvc.dll
2006-09-24 11:59 133,632 --a------ C:\WINDOWS\system32\taskmgr.exe
2006-09-24 11:59 131,072 --a------ C:\WINDOWS\system32\sti_ci.dll
2006-09-24 11:59 13,312 --a------ C:\WINDOWS\system32\ssstars.scr
2006-09-24 11:59 118,272 --a------ C:\WINDOWS\system32\stobject.dll
2006-09-24 11:59 11,264 --a------ C:\WINDOWS\system32\tracert.exe
2006-09-24 11:58 91,648 --a------ C:\WINDOWS\system32\rastls.dll
2006-09-24 11:58 87,304 --a------ C:\WINDOWS\system32\rdpdd.dll
2006-09-24 11:58 84,992 --a------ C:\WINDOWS\system32\smlogsvc.exe
2006-09-24 11:58 8,192 --a------ C:\WINDOWS\system32\scrnsave.scr
2006-09-24 11:58 75,912 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-09-24 11:58 75,264 --a------ C:\WINDOWS\system32\rtcshare.exe
2006-09-24 11:58 72,192 --a------ C:\WINDOWS\system32\sdbinst.exe
2006-09-24 11:58 67,072 --a------ C:\WINDOWS\system32\sigverif.exe
2006-09-24 11:58 66,560 --a------ C:\WINDOWS\system32\spoolss.dll
2006-09-24 11:58 62,976 --a------ C:\WINDOWS\system32\shgina.dll
2006-09-24 11:58 60,416 --a------ C:\WINDOWS\system32\shimeng.dll
2006-09-24 11:58 6,144 --a------ C:\WINDOWS\system32\sensapi.dll
2006-09-24 11:58 57,856 --a------ C:\WINDOWS\system32\raschap.dll
2006-09-24 11:58 57,344 --a------ C:\WINDOWS\system32\remotepg.dll
2006-09-24 11:58 54,784 --a------ C:\WINDOWS\system32\reg.exe
2006-09-24 11:58 534,528 --a------ C:\WINDOWS\system32\spider.exe
2006-09-24 11:58 52,224 --a------ C:\WINDOWS\system32\secur32.dll
2006-09-24 11:58 44,032 --a------ C:\WINDOWS\system32\regapi.dll
2006-09-24 11:58 44,032 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-09-24 11:58 423,424 --a------ C:\WINDOWS\system32\riched20.dll
2006-09-24 11:58 422,912 --a------ C:\WINDOWS\system32\shimgvw.dll
2006-09-24 11:58 385,024 --a------ C:\WINDOWS\system32\sqlsrv32.dll
2006-09-24 11:58 36,352 --a------ C:\WINDOWS\system32\sens.dll
2006-09-24 11:58 34,304 --a------ C:\WINDOWS\system32\rcimlby.exe
2006-09-24 11:58 339,968 --a------ C:\WINDOWS\system32\smlogcfg.dll
2006-09-24 11:58 33,280 --a------ C:\WINDOWS\system32\shmgrate.exe
2006-09-24 11:58 308,224 --a------ C:\WINDOWS\system32\scesrv.dll
2006-09-24 11:58 3,352 --a------ C:\WINDOWS\system32\redir.exe
2006-09-24 11:58 24,064 --a------ C:\WINDOWS\system32\skeys.exe
2006-09-24 11:58 23,040 --a------ C:\WINDOWS\system32\slayerxp.dll
2006-09-24 11:58 22,528 --a------ C:\WINDOWS\system32\shfolder.dll
2006-09-24 11:58 20,992 --a------ C:\WINDOWS\system32\setup.exe
2006-09-24 11:58 193,536 --a------ C:\WINDOWS\system32\rasppp.dll
2006-09-24 11:58 179,200 --a------ C:\WINDOWS\system32\scecli.dll
2006-09-24 11:58 171,008 --a------ C:\WINDOWS\system32\sccsccp.dll
2006-09-24 11:58 169,984 --a------ C:\WINDOWS\system32\sccbase.dll
2006-09-24 11:58 160,256 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-09-24 11:58 16,896 --a------ C:\WINDOWS\system32\snmpapi.dll
2006-09-24 11:58 140,800 --a------ C:\WINDOWS\regedit.exe
2006-09-24 11:58 14,848 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-09-24 11:58 135,680 --a------ C:\WINDOWS\system32\rdchost.dll
2006-09-24 11:58 134,656 --a------ C:\WINDOWS\system32\sfc_os.dll
2006-09-24 11:58 133,632 --a------ C:\WINDOWS\system32\rsaenh.dll
2006-09-24 11:58 13,824 --a------ C:\WINDOWS\system32\rassapi.dll
2006-09-24 11:58 12,800 --a------ C:\WINDOWS\system32\runonce.exe
2006-09-24 11:58 12,288 --a------ C:\WINDOWS\system32\sigtab.dll
2006-09-24 11:58 12,288 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-09-24 11:58 116,736 --a------ C:\WINDOWS\system32\shsvcs.dll
2006-09-24 11:58 1,354,240 --a------ C:\WINDOWS\system32\query.dll
2006-09-24 11:58 1,145,856 --a------ C:\WINDOWS\system32\sfcfiles.dll
2006-09-24 11:57 99,328 --a------ C:\WINDOWS\system32\oleprn.dll
2006-09-24 11:57 94,208 --a------ C:\WINDOWS\system32\odbccp32.dll
2006-09-24 11:57 84,480 --a------ C:\WINDOWS\system32\psbase.dll
2006-09-24 11:57 686,080 --a------ C:\WINDOWS\system32\opengl32.dll
2006-09-24 11:57 61,440 --a------ C:\WINDOWS\system32\odbccu32.dll
2006-09-24 11:57 61,440 --a------ C:\WINDOWS\system32\odbccr32.dll
2006-09-24 11:57 60,928 --a------ C:\WINDOWS\system32\pautoenr.dll
2006-09-24 11:57 53,760 --a------ C:\WINDOWS\system32\packager.exe
2006-09-24 11:57 53,248 --a------ C:\WINDOWS\system32\odbcconf.exe
2006-09-24 11:57 329,216 --a------ C:\WINDOWS\system32\oakley.dll
2006-09-24 11:57 32,768 --a------ C:\WINDOWS\system32\odbcad32.exe
2006-09-24 11:57 31,744 --a------ C:\WINDOWS\system32\pid.dll
2006-09-24 11:57 3,494,303 --------- C:\WINDOWS\system32\nv4_disp.dll
2006-09-24 11:57 256,512 --a------ C:\WINDOWS\system32\pdh.dll
2006-09-24 11:57 24,576 --a------ C:\WINDOWS\system32\odbcbcp.dll
2006-09-24 11:57 212,992 --a------ C:\WINDOWS\system32\osk.exe
2006-09-24 11:57 200,704 --a------ C:\WINDOWS\system32\odbc32.dll
2006-09-24 11:57 17,408 --a------ C:\WINDOWS\system32\psapi.dll
2006-09-24 11:57 16,896 --a------ C:\WINDOWS\system32\ping.exe
2006-09-24 11:57 16,384 --a------ C:\WINDOWS\system32\odbc32gt.dll
2006-09-24 11:57 147,456 --a------ C:\WINDOWS\system32\odbctrac.dll
2006-09-24 11:57 122,880 --a------ C:\WINDOWS\system32\odbcconf.dll
2006-09-24 11:57 12,288 --a------ C:\WINDOWS\system32\odbcp32r.dll
2006-09-24 11:57 109,568 --a------ C:\WINDOWS\system32\offfilt.dll
2006-09-24 11:56 95,744 --a------ C:\WINDOWS\system32\nlhtml.dll
2006-09-24 11:56 49,664 --a------ C:\WINDOWS\system32\npptools.dll
2006-09-24 11:56 394,752 --a------ C:\WINDOWS\system32\ntmssvc.dll
2006-09-24 11:56 38,400 --a------ C:\WINDOWS\system32\ntmsapi.dll
2006-09-24 11:56 38,400 --a------ C:\WINDOWS\system32\ntlanman.dll
2006-09-24 11:56 33,888 --a------ C:\WINDOWS\system32\ntio.sys
2006-09-24 11:56 240,128 --a------ C:\WINDOWS\system32\newdev.dll
2006-09-24 11:56 24,576 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-09-24 11:56 166,400 --a------ C:\WINDOWS\system32\ntmsdba.dll
2006-09-24 11:56 139,264 --a------ C:\WINDOWS\system32\ntshrui.dll
2006-09-24 11:56 112,640 --a------ C:\WINDOWS\system32\ntmarta.dll
2006-09-24 11:56 1,677,312 --------- C:\WINDOWS\system32\wmvcore2.dll
2006-09-24 11:55 921,475 --------- C:\WINDOWS\system32\ati3d2ag.dll
2006-09-24 11:55 844,675 --------- C:\WINDOWS\system32\ati3d1ag.dll
2006-09-24 11:55 504,832 --------- C:\WINDOWS\system32\msftedit.dll
2006-09-24 11:55 5,120 --------- C:\WINDOWS\system32\hccoin.dll
2006-09-24 11:55 403,456 --------- C:\WINDOWS\system32\winbrand.dll
2006-09-24 11:55 377,984 --------- C:\WINDOWS\system32\ati2dvaa.dll
2006-09-24 11:55 3,584 --------- C:\WINDOWS\system32\dsprpres.dll
2006-09-24 11:55 218,112 --------- C:\WINDOWS\system32\sbe.dll
2006-09-24 11:55 202,496 --------- C:\WINDOWS\system32\ati2dvag.dll
2006-09-24 11:55 196,608 --------- C:\WINDOWS\system32\xpsp1res.dll
2006-09-24 11:55 18,944 --------- C:\WINDOWS\system32\faxpatch.exe
2006-09-24 11:55 172,032 --------- C:\WINDOWS\system32\mssap.dll
2006-09-24 11:55 155,648 --------- C:\WINDOWS\system32\encdec.dll
2006-09-24 11:55 110,080 --------- C:\WINDOWS\system32\sbeio.dll
2006-09-24 11:54 9,728 --a------ C:\WINDOWS\system32\mstinit.exe
2006-09-24 11:54 863,744 --a------ C:\WINDOWS\system32\netplwiz.dll
2006-09-24 11:54 81,408 --a------ C:\WINDOWS\system32\msoert2.dll
2006-09-24 11:54 699,392 --a------ C:\WINDOWS\system32\msxml2.dll
2006-09-24 11:54 598,016 --a------ C:\WINDOWS\system32\mstscax.dll
2006-09-24 11:54 591,360 --a------ C:\WINDOWS\system32\netcfgx.dll
2006-09-24 11:54 552,991 --a------ C:\WINDOWS\system32\msrepl40.dll
2006-09-24 11:54 421,919 --a------ C:\WINDOWS\system32\msrd2x40.dll
2006-09-24 11:54 42,496 --a------ C:\WINDOWS\system32\ncobjapi.dll
2006-09-24 11:54 401,462 --a------ C:\WINDOWS\system32\msvcp60.dll
2006-09-24 11:54 399,360 --a------ C:\WINDOWS\system32\netlogon.dll
2006-09-24 11:54 393,728 --a------ C:\WINDOWS\system32\mstsc.exe
2006-09-24 11:54 39,424 --a------ C:\WINDOWS\system32\net.exe
2006-09-24 11:54 348,191 --a------ C:\WINDOWS\system32\mspbde40.dll
2006-09-24 11:54 344,095 --a------ C:\WINDOWS\system32\msxbde40.dll
2006-09-24 11:54 342,528 --a------ C:\WINDOWS\system32\mspaint.exe
2006-09-24 11:54 329,728 --a------ C:\WINDOWS\system32\netsetup.exe
2006-09-24 11:54 323,072 --a------ C:\WINDOWS\system32\msvcrt.dll
2006-09-24 11:54 319,760 --a------ C:\WINDOWS\system32\msnsspc.dll
2006-09-24 11:54 253,983 --a------ C:\WINDOWS\system32\mstext40.dll
2006-09-24 11:54 253,952 --a------ C:\WINDOWS\system32\mstask.dll
2006-09-24 11:54 245,760 --a------ C:\WINDOWS\system32\msscp.dll
2006-09-24 11:54 241,725 --a------ C:\WINDOWS\system32\msuni11.dll
2006-09-24 11:54 228,864 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-09-24 11:54 183,296 --a------ C:\WINDOWS\system32\msutb.dll
2006-09-24 11:54 175,104 --a------ C:\WINDOWS\system32\mspmsp.dll
2006-09-24 11:54 16,896 --a------ C:\WINDOWS\system32\nddenb32.dll
2006-09-24 11:54 154,112 --a------ C:\WINDOWS\system32\netman.dll
2006-09-24 11:54 131,072 --a------ C:\WINDOWS\system32\msorcl32.dll
2006-09-24 11:54 115,200 --a------ C:\WINDOWS\system32\net1.exe
2006-09-24 11:54 114,176 --a------ C:\WINDOWS\system32\msvfw32.dll
2006-09-24 11:54 108,544 --a------ C:\WINDOWS\system32\netdde.exe
2006-09-24 11:54 10,240 --a------ C:\WINDOWS\system32\msrle32.dll
2006-09-24 11:54 1,635,840 --a------ C:\WINDOWS\system32\netshell.dll
2006-09-24 11:54 1,122,304 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-24 11:53 64,512 --a------ C:\WINDOWS\system32\msiexec.exe
2006-09-24 11:53 56,832 --a------ C:\WINDOWS\system32\mshtmler.dll
2006-09-24 11:53 4,608 --a------ C:\WINDOWS\system32\msimg32.dll
2006-09-24 11:53 368,710 --a------ C:\WINDOWS\system32\msisam11.dll
2006-09-24 11:53 348,195 --a------ C:\WINDOWS\system32\msjetoledb40.dll
2006-09-24 11:53 305,664 --a------ C:\WINDOWS\system32\msihnd.dll
2006-09-24 11:53 241,695 --a------ C:\WINDOWS\system32\msjtes40.dll
2006-09-24 11:53 232,960 --a------ C:\WINDOWS\system32\msieftp.dll
2006-09-24 11:53 23,040 --a------ C:\WINDOWS\system32\mslbui.dll
2006-09-24 11:53 213,023 --a------ C:\WINDOWS\system32\msltus40.dll
2006-09-24 11:53 2,086,400 --a------ C:\WINDOWS\system32\msi.dll
2006-09-24 11:53 143,872 --a------ C:\WINDOWS\system32\msimtf.dll
2006-09-24 11:53 1,503,262 --a------ C:\WINDOWS\system32\msjet40.dll
2006-09-24 11:52 68,096 --a------ C:\WINDOWS\system32\mscms.dll
2006-09-24 11:52 67,584 --a------ C:\WINDOWS\system32\msctfp.dll
2006-09-24 11:52 65,536 --a------ C:\WINDOWS\system32\msconf.dll
2006-09-24 11:52 512,031 --a------ C:\WINDOWS\system32\msexch40.dll
2006-09-24 11:52 4,126 --a------ C:\WINDOWS\system32\msdxmlc.dll
2006-09-24 11:52 32,256 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-09-24 11:52 319,519 --a------ C:\WINDOWS\system32\msexcl40.dll
2006-09-24 11:52 266,752 --a------ C:\WINDOWS\system32\msctf.dll
2006-09-24 11:52 210,944 --a------ C:\WINDOWS\system32\moricons.dll
2006-09-24 11:52 197,632 --a------ C:\WINDOWS\system32\mobsync.dll
2006-09-24 11:52 163,840 --a------ C:\WINDOWS\system32\mindex.dll
2006-09-24 11:52 126,976 --a------ C:\WINDOWS\system32\msdart.dll
2006-09-24 11:52 12,288 --a------ C:\WINDOWS\system32\mscpx32r.dll
2006-09-24 11:52 117,760 --a------ C:\WINDOWS\system32\mplay32.exe
2006-09-24 11:52 1,132,544 --a------ C:\WINDOWS\system32\mmcndmgr.dll

2006-09-24 11:51 57,856 --a------ C:\WINDOWS\system32\licwmi.dll
2006-09-24 11:51 504,832 --a------ C:\WINDOWS\system32\logonui.exe
2006-09-24 11:51 381,440 --a------ C:\WINDOWS\system32\lmrt.dll
2006-09-24 11:51 219,648 --a------ C:\WINDOWS\system32\logon.scr
2006-09-24 11:51 19,456 --a------ C:\WINDOWS\system32\licmgr10.dll
2006-09-24 11:51 10,240 --a------ C:\WINDOWS\system32\localui.dll
2006-09-24 11:47 91,648 --a------ C:\WINDOWS\system32\iuctl.dll
2006-09-24 11:47 89,088 --a------ C:\WINDOWS\system32\mqsec.dll
2006-09-24 11:47 75,264 --a------ C:\WINDOWS\system32\tlntsess.exe
2006-09-24 11:47 7,168 --a------ C:\WINDOWS\system32\tlntsvrp.dll
2006-09-24 11:47 7,040 --a------ C:\WINDOWS\system32\kd1394.dll
2006-09-24 11:47 69,120 --a------ C:\WINDOWS\system32\tlntsvr.exe
2006-09-24 11:47 68,608 --a------ C:\WINDOWS\system32\fdeploy.dll
2006-09-24 11:47 62,976 --a------ C:\WINDOWS\system32\ipv6.exe
2006-09-24 11:47 613,888 --a------ C:\WINDOWS\system32\mqqm.dll
2006-09-24 11:47 59,392 --a------ C:\WINDOWS\system32\tlntadmn.exe
2006-09-24 11:47 587,776 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-09-24 11:47 57,344 --a------ C:\WINDOWS\system32\nwwks.dll
2006-09-24 11:47 558,080 --a------ C:\WINDOWS\system32\wsecedit.dll
2006-09-24 11:47 53,248 --a------ C:\WINDOWS\system32\ipconfig.exe
2006-09-24 11:47 502,784 --a------ C:\WINDOWS\system32\mqutil.dll
2006-09-24 11:47 50,176 --a------ C:\WINDOWS\system32\ixsso.dll
2006-09-24 11:47 478,720 --a------ C:\WINDOWS\system32\mqsnap.dll
2006-09-24 11:47 42,537 --a------ C:\WINDOWS\system32\keyboard.sys
2006-09-24 11:47 36,922 --a------ C:\WINDOWS\system32\imeshare.dll
2006-09-24 11:47 336,896 --a------ C:\WINDOWS\system32\ippromon.dll
2006-09-24 11:47 30,208 --a------ C:\WINDOWS\system32\imgutil.dll
2006-09-24 11:47 29,696 --------- C:\WINDOWS\system32\asr_pfu.exe
2006-09-24 11:47 281,600 --a------ C:\WINDOWS\system32\appmgr.dll
2006-09-24 11:47 272,896 --a------ C:\WINDOWS\system32\kerberos.dll
2006-09-24 11:47 27,648 --a------ C:\WINDOWS\system32\pidgen.dll
2006-09-24 11:47 232,448 --a------ C:\WINDOWS\system32\tracerpt.exe
2006-09-24 11:47 184,832 --a------ C:\WINDOWS\system32\gptext.dll
2006-09-24 11:47 164,864 --a------ C:\WINDOWS\system32\mqrt.dll
2006-09-24 11:47 164,352 --a------ C:\WINDOWS\system32\mqtrig.dll
2006-09-24 11:47 164,352 --a------ C:\WINDOWS\system32\appmgmts.dll
2006-09-24 11:47 156,672 --a------ C:\WINDOWS\system32\ipsecsvc.dll
2006-09-24 11:47 14,848 --a------ C:\WINDOWS\system32\mqise.dll
2006-09-24 11:47 130,048 --a------ C:\WINDOWS\system32\mqad.dll
2006-09-24 11:47 123,904 --a------ C:\WINDOWS\system32\imapi.exe
2006-09-24 11:47 117,760 --a------ C:\WINDOWS\system32\schtasks.exe
2006-09-24 11:47 116,736 --a------ C:\WINDOWS\system32\input.dll
2006-09-24 11:47 115,712 --a------ C:\WINDOWS\system32\dpcdll.dll
2006-09-24 11:47 115,200 --a------ C:\WINDOWS\system32\gpresult.exe
2006-09-24 11:47 110,592 --a------ C:\WINDOWS\system32\ipv6mon.dll
2006-09-24 11:47 103,936 --a------ C:\WINDOWS\system32\rsnotify.exe
2006-09-24 11:47 103,936 --a------ C:\WINDOWS\system32\imm32.dll
2006-09-24 11:47 10,752 --------- C:\WINDOWS\system32\spiisupd.exe
2006-09-24 11:46 9,216 --a------ C:\WINDOWS\system32\icaapi.dll
2006-09-24 11:46 8,832 --a------ C:\WINDOWS\system32\framebuf.dll
2006-09-24 11:46 73,728 --a------ C:\WINDOWS\system32\ils.dll
2006-09-24 11:46 60,416 --a------ C:\WINDOWS\system32\iesetup.dll
2006-09-24 11:46 294,912 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-09-24 11:46 28,672 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-09-24 11:46 244,224 --a------ C:\WINDOWS\system32\hnetcfg.dll
2006-09-24 11:46 236,032 --a------ C:\WINDOWS\system32\icm32.dll
2006-09-24 11:46 207,872 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-09-24 11:46 20,480 --a------ C:\WINDOWS\system32\hidserv.dll
2006-09-24 11:46 126,976 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-09-24 11:46 114,176 --a------ C:\WINDOWS\system32\idq.dll
2006-09-24 11:45 9,216 --a------ C:\WINDOWS\system32\dumprep.exe
2006-09-24 11:45 83,456 --a------ C:\WINDOWS\system32\fldrclnr.dll
2006-09-24 11:45 802,304 --a------ C:\WINDOWS\system32\dxmrtp.dll
2006-09-24 11:45 76,288 --a------ C:\WINDOWS\system32\dfrgfat.exe
2006-09-24 11:45 70,656 --a------ C:\WINDOWS\system32\defrag.exe
2006-09-24 11:45 67,072 --a------ C:\WINDOWS\system32\faultrep.dll
2006-09-24 11:45 61,440 --a------ C:\WINDOWS\system32\dbnetlib.dll
2006-09-24 11:45 55,296 --a------ C:\WINDOWS\system32\digest.dll
2006-09-24 11:45 53,248 --a------ C:\WINDOWS\system32\cryptsvc.dll
2006-09-24 11:45 498,717 --a------ C:\WINDOWS\system32\dxmasf.dll
2006-09-24 11:45 49,152 --a------ C:\WINDOWS\system32\eventlog.dll
2006-09-24 11:45 489,984 --a------ C:\WINDOWS\system32\dbghelp.dll
2006-09-24 11:45 486,400 --a------ C:\WINDOWS\system32\cryptui.dll
2006-09-24 11:45 46,080 --a------ C:\WINDOWS\system32\docprop2.dll
2006-09-24 11:45 380,445 --a------ C:\WINDOWS\system32\expsrv.dll
2006-09-24 11:45 35,328 --a------ C:\WINDOWS\system32\dfrgsnap.dll
2006-09-24 11:45 315,392 --a------ C:\WINDOWS\system32\cscui.dll
2006-09-24 11:45 28,672 --a------ C:\WINDOWS\system32\dbnmpntw.dll
2006-09-24 11:45 268,288 --a------ C:\WINDOWS\system32\devmgr.dll
2006-09-24 11:45 263,680 --a------ C:\WINDOWS\system32\duser.dll
2006-09-24 11:45 25,600 --a------ C:\WINDOWS\system32\dfsshlex.dll
2006-09-24 11:45 24,576 --a------ C:\WINDOWS\system32\dbmsvinn.dll
2006-09-24 11:45 24,576 --a------ C:\WINDOWS\system32\dbmsrpcn.dll
2006-09-24 11:45 228,864 --a------ C:\WINDOWS\system32\dsquery.dll
2006-09-24 11:45 20,480 --a------ C:\WINDOWS\system32\dbmsadsn.dll
2006-09-24 11:45 19,968 --a------ C:\WINDOWS\system32\fontview.exe
2006-09-24 11:45 19,456 --a------ C:\WINDOWS\system32\ersvc.dll
2006-09-24 11:45 180,224 --a------ C:\WINDOWS\system32\eudcedit.exe
2006-09-24 11:45 180,224 --a------ C:\WINDOWS\system32\dwwin.exe
2006-09-24 11:45 174,080 --a------ C:\WINDOWS\system32\dinput8.dll
2006-09-24 11:45 168,448 --a------ C:\WINDOWS\system32\els.dll
2006-09-24 11:45 16,384 --a------ C:\WINDOWS\system32\ds32gt.dll
2006-09-24 11:45 156,672 --a------ C:\WINDOWS\system32\dinput.dll
2006-09-24 11:45 138,752 --a------ C:\WINDOWS\system32\dsprop.dll
2006-09-24 11:45 13,312 --a------ C:\WINDOWS\system32\ctfmon.exe
2006-09-24 11:45 124,928 --a------ C:\WINDOWS\system32\dssenh.dll
2006-09-24 11:45 113,152 --a------ C:\WINDOWS\system32\dfrgui.dll
2006-09-24 11:45 102,400 --a------ C:\WINDOWS\system32\dgnet.dll
2006-09-24 11:45 1,007,616 --a------ C:\WINDOWS\explorer.exe
2006-09-24 11:44 99,840 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-09-24 11:44 8,192 --a------ C:\WINDOWS\system32\autolfn.exe
2006-09-24 11:44 76,800 --a------ C:\WINDOWS\system32\avifil32.dll
2006-09-24 11:44 74,810 --a------ C:\WINDOWS\system32\atl.dll
2006-09-24 11:44 71,680 --a------ C:\WINDOWS\system32\browsewm.dll
2006-09-24 11:44 71,168 --a------ C:\WINDOWS\system32\cryptdlg.dll
2006-09-24 11:44 67,072 --a------ C:\WINDOWS\system32\browselc.dll
2006-09-24 11:44 64,512 --a------ C:\WINDOWS\system32\ciodm.dll
2006-09-24 11:44 6,656 --a------ C:\WINDOWS\system32\batt.dll
2006-09-24 11:44 59,904 --a------ C:\WINDOWS\system32\cabinet.dll
2006-09-24 11:44 54,272 --a------ C:\WINDOWS\system32\clusapi.dll
2006-09-24 11:44 49,152 --a------ C:\WINDOWS\system32\browser.dll
2006-09-24 11:44 41,472 --a------ C:\WINDOWS\system32\cmdl32.exe
2006-09-24 11:44 38,912 --a------ C:\WINDOWS\system32\audiosrv.dll
2006-09-24 11:44 330,752 --a------ C:\WINDOWS\system32\cmdial32.dll
2006-09-24 11:44 33,280 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-09-24 11:44 24,576 --a------ C:\WINDOWS\system32\conime.exe
2006-09-24 11:44 239,104 --a------ C:\WINDOWS\system32\compatui.dll
2006-09-24 11:44 189,952 --a------ C:\WINDOWS\system32\certcli.dll
2006-09-24 11:44 179,712 --a------ C:\WINDOWS\system32\cewmdm.dll
2006-09-24 11:44 159,744 --a------ C:\WINDOWS\system32\credui.dll
2006-09-24 11:43 92,160 --a------ C:\WINDOWS\system32\advpack.dll
2006-09-24 11:43 91,648 --a------ C:\WINDOWS\system32\ahui.exe
2006-09-24 11:43 62,464 --a------ C:\WINDOWS\system32\adsmsext.dll
2006-09-24 11:43 59,392 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-09-24 11:43 5,120 --a------ C:\WINDOWS\system32\asferror.dll
2006-09-24 11:43 41,984 --a------ C:\WINDOWS\system32\alg.exe
2006-09-24 11:43 239,616 --a------ C:\WINDOWS\system32\adsnt.dll
2006-09-24 11:43 23,552 --a------ C:\WINDOWS\system32\at.exe
2006-09-24 11:43 162,816 --a------ C:\WINDOWS\system32\adsldp.dll
2006-09-24 11:43 14,366 --a------ C:\WINDOWS\system32\asfsipc.dll
2006-09-24 11:43 139,776 --a------ C:\WINDOWS\system32\adsldpc.dll
2006-09-24 11:43 111,616 --a------ C:\WINDOWS\system32\apphelp.dll
2006-09-24 10:32 53,760 --a------ C:\WINDOWS\system32\sw_wheel.dll
2006-09-24 10:32 41,472 --a------ C:\WINDOWS\system32\sw_effct.dll
2006-09-24 10:02 712,704 --a------ C:\WINDOWS\system32\Audio3D.dll
2006-09-24 10:02 712,704 --a------ C:\WINDOWS\system32\a3d.dll
2006-09-24 10:02 32,768 --a------ C:\WINDOWS\system32\cmnprop.dll
2006-09-24 10:02 139,264 --a------ C:\WINDOWS\cmuninst.exe
2006-09-24 10:02 1,581,056 --a------ C:\WINDOWS\mixer.exe
2006-09-23 21:24 8,976 --a------ C:\WINDOWS\deldirs.EXE
2006-09-23 15:37 102,912 --a------ C:\WINDOWS\system32\islzma.dll
2006-09-23 15:35 270,336 --a------ C:\WINDOWS\system32\imon.dll
2006-08-28 09:48 3,584 --a------ C:\WINDOWS\system32\wmfhotfix.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-24 10:01 -------- d-------- C:\Documents and Settings\nancy\Application Data\Mozilla
2006-09-23 20:10 -------- d-------- C:\Documents and Settings\nancy\Application Data\gtopala
2006-09-23 20:01 -------- d-------- C:\Documents and Settings\nancy\Application Data\TuneUp Software
2006-09-23 15:40 51072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2006-09-23 15:40 -------- d-------- C:\Program Files\Spyware Doctor
2006-09-23 15:40 -------- d-------- C:\Documents and Settings\nancy\Application Data\PC Tools
2006-09-23 15:37 -------- d-------- C:\Program Files\Webroot
2006-09-23 15:36 -------- d-------- C:\Program Files\SpywareBlaster
2006-09-23 15:36 -------- d-------- C:\Program Files\Lavasoft
2006-09-23 15:35 502368 --a------ C:\WINDOWS\system32\drivers\amon.sys
2006-09-23 15:35 -------- d-------- C:\Program Files\ESET
2006-09-23 15:28 -------- d-------- C:\Program Files\Hitman Pro


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe /startup"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"SSC_UserPrompt"="C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe"
"Smart Start UP"="C:\\Program Files\\NewSoft\\Smart Start UP\\PnPDetect.exe /Automation "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"Spyware Doctor"=""

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"Spyware Doctor"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=hex:ff,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"ltwob"="C:\\WINDOWS\\System32\\formatsys.exe"
"avnort"="C:\\WINDOWS\\msmbw.exe"
"serpe"="C:\\WINDOWS\\System32\\serbw.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"ltwob"="C:\\WINDOWS\\System32\\formatsys.exe"
"serpe"="C:\\WINDOWS\\System32\\serbw.exe"
"avnort"="C:\\WINDOWS\\msmbw.exe"

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Click Maintenance.job

Completion time: Sun 24/09/2006 13:50:08.80
ComboFix.txt

Logfile of HijackThis v1.99.1
Scan saved at 13:50:33, on 24/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Documents and Settings\nancy\Local Settings\Temp\Tijdelijke map 3 voor hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: load=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1109196003752
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

Download SmitfraudFix (by S!Ri), en pak het uit op je bureaublad.

Open de SmitfraudFix map en dubbelklik op smitfraudfix.cmd
Kies optie #1 - Search door1 te typen, en druk op "Enter";
Er zal een tekstbestandje openen.
Plaats de inhoud van dat tekstbestandje in je volgende antwoord.

SmitFraudFix v2.99

Scan done at 14:37:07,44, zo 24/09/2006
Run from E:\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versie 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\nancy\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\nancy\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\WINDOWS\\System32\\wmfhotfix.dll"


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Je kan deze instructies best uitprinten of opslaan in een tekstbestandje, want
je zal in veilige modus moeten gaan werken en dan is deze pagina niet beschikbaar (geen internet).

Start de computer in veilige modus.
(Kijk hier eventueel voor uitleg.)

Open de map smitfraudfix en dubbelklik op smitfraudfix.cmd
Kies optie #2 - Clean door2 te typen, en druk op "Enter" om de
geïnfecteerde bestanden te verwijderen.

Je zal een vraag krijgen: ""Registry cleaning - Do you want to clean the registry ?"
Antwoord "yes" door y te typen en druk op "Enter".

Als je pc daarna niet heropstart, start hem dan handmatig terug op in normale modus.

Het tooltje zal nu onderzoeken of wininet.dll geïnfecteerd is. Je kan dus de vraag krijgen of je
het geïnfecteerde bestandje wil vervangen. Antwoord dan "yes" door y te typen en druk op "Enter".

Het kan zijn dat het tooltje je pc opnieuw laat opstarten om zijn werk te kunnen afmaken.
Als dat niet zo is, start je pc dan handmatig opnieuw op in normale modus.
Er zal een tekstbestandje openen met de resultaten van de fix. Post de inhoud van dit bestandje in je volgende antwoord met een nieuw hijackthis logje + een ieuw logje van combofix.
(Je kan het rapport ook vinden in c:\rapport.txt

wil ni boote in safemode

kblijf probere ^^

(tis btw ni mijne pc ma nen andere)

EDIT: na den enter van de registry clean moet die dan nog iets zegge? blijft precies hange nadaddek op enter heb gedrukt
EDIT2: gewoon wachten dus

SmitFraudFix v2.99

Scan done at 15:09:12,83, zo 24/09/2006
Run from E:\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [versie 5.1.2600] - Windows_NT
Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Logfile of HijackThis v1.99.1
Scan saved at 15:36:14, on 24/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\nancy\Local Settings\Temp\Tijdelijke map 4 voor hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: load=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Smart Start UP] C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1109196003752
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

1.Download gmer.zip, en pak het het uit op je bureaublad.

2.Dubbelklik op gmer.exe om het te starten.

3.Wanneer je de vraag krijgt om je systeem te scannen, klik je op "ja".

4.Nadien klik je op het tabblad "Rootkit".

5.NA de scan: Klik op de knop "Copy" (rechts beneden)

6.Open een kladblokbestand.

7.Rechtsklik in dit bestand, en kies voor plakken. Sla dit bestandje op als gmerlog.txt

8.Plaats in je volgende antwoord de inhoud van gmerlog.txt.

GMER 1.0.11.11349 - http://www.gmer.net
Rootkit 2006-09-24 16:17:43
Windows 5.1.2600 Service Pack 1


---- System - GMER 1.0.11 ----

SSDT SSI.SYS ZwCreateKey
SSDT SSI.SYS ZwCreateProcess
SSDT SSI.SYS ZwCreateProcessEx
SSDT SSI.SYS ZwDeleteKey
SSDT SSI.SYS ZwDeleteValueKey
SSDT SSI.SYS ZwRenameKey
SSDT SSI.SYS ZwSetInformationKey
SSDT SSI.SYS ZwSetValueKey

---- Devices - GMER 1.0.11 ----

Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_READ [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_POWER [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Ip IRP_MJ_PNP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_READ [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Tcp IRP_MJ_PNP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_READ [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_WRITE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_POWER [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\Udp IRP_MJ_PNP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_READ [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_POWER [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\RawIp IRP_MJ_PNP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE_NAMED_PIPE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_READ [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_WRITE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_EA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_FLUSH_BUFFERS [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_VOLUME_INFORMATION [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DIRECTORY_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_FILE_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SHUTDOWN [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_LOCK_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLEANUP [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE_MAILSLOT [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_SECURITY [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_POWER [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SYSTEM_CONTROL [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CHANGE [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_QUERY_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SET_QUOTA [FC42020C] SSI.SYS
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_PNP [FC42020C] SSI.SYS

---- EOF - GMER 1.0.11 ----

Mag ik een nieuw hijackthis logje zien?

pffr, na dieje sp1 werktenet netwerk nimeer, bennek begonne de logs via ne stick over te brenge naar ne pc die nog wel internet had, en nu alsek dieje stick insteek reboot dieje pc

kzal is kijke wa den error is ma ge zij alles aant kapot doen jom

CAUSE
This problem may occur if the computer is infected with a variant of the Sdbot virus.

The Sdbot virus creates a hidden process. This process closes programs that system administrators use for diagnostic and configuration purposes. The process may also prevent these programs from running.

The file name of the Sdbot virus varies. Many variants of this virus put a driver that is named Msdirectx.sys or Haxdrv.sys on the computer. This driver is used to hide the virus process. The file names that the virus frequently uses include Msdrv.exe and Sdkcore.exe. These virus variants can restore the virus if you delete the files.

http://support.microsoft.com/?scid=kb;en-us;897079

Het kán dit zijn (volgens den info uit het systeem logbook, kzal meteen is naar de DSOD stop code kijken om te verifieren.