Archief - Logcheck aub

Logfile of HijackThis v1.99.1
Scan saved at 20:24:48, on 18/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\DOCUME~1\Nibby\LOCALS~1\Temp\Rar$EX00.891\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide
O4 - HKCU\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe


ik heb juist mijne pc gecleaned van nen hoop spyware maar toch ffkes zeker zijn of alles eruit is. want hij gaat trager dan normaal

bedankt

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/combofix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

ComboFix

Nibby - 06-10-18 20:30:34,06 Service Pack 2
ComboFix 06.10.16 - Running from: "C:\Documents and Settings\Nibby\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\Nibby\Application Data\Install.dat


((((((((((((((((((((((((((((((( Files Created from 2006-09-18 to 2006-10-18 ))))))))))))))))))))))))))))))))))


2006-10-18 18:11 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2006-10-18 16:32 15,360 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2006-10-18 16:32 14,848 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2006-10-18 16:32 13,824 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys
2006-10-18 16:32 117,248 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2006-10-18 16:29 82,432 -ra------ C:\WINDOWS\system32\MSXML4r.dll
2006-10-18 16:29 626,960 -ra------ C:\WINDOWS\system32\hpvaut32.dll
2006-10-18 16:29 487,424 -ra------ C:\WINDOWS\system32\hpvcp70.dll
2006-10-18 16:29 44,544 -ra------ C:\WINDOWS\system32\MSXML4a.dll
2006-10-18 16:29 344,064 -ra------ C:\WINDOWS\system32\hpvcr70.dll
2006-10-18 16:29 1,230,336 -ra------ C:\WINDOWS\system32\MSXML4.dll
2006-10-18 15:45 10,752 --a------ C:\WINDOWS\system32\MZU_DRV.sys
2006-10-18 15:44 7,680 --a------ C:\WINDOWS\fb0c4nps.exe
2006-10-18 15:44 5,707 --a------ C:\WINDOWS\system32\z15.exe
2006-10-18 15:44 211 --a------ C:\WINDOWS\system32\z13.exe
2006-10-18 15:12 82,380 --a------ C:\WINDOWS\system32\drivers\AFS2K.SYS
2006-10-18 15:10 327,168 --a------ C:\WINDOWS\IsUn0413.exe
2006-10-18 15:10 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2006-10-18 00:31 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2006-10-17 16:19 10,752 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-10-16 19:43 967 --a------ C:\WINDOWS\ScUnin.pif
2006-10-16 19:43 68,096 --a------ C:\WINDOWS\ScUnin.exe
2006-10-16 19:34 611,064 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2006-10-16 18:51 36,864 --------- C:\WINDOWS\system32\wbsys.dll
2006-10-16 18:51 20,480 --a------ C:\WINDOWS\system32\wbload.dll
2006-10-16 14:33 947,984 --a------ C:\WINDOWS\system32\msjava.dll
2006-10-16 14:33 63,248 --a------ C:\WINDOWS\system32\javaprxy.dll
2006-10-16 14:33 49,424 --a------ C:\WINDOWS\system32\clspack.exe
2006-10-16 14:33 46,352 --a------ C:\WINDOWS\setdebug.exe
2006-10-16 14:33 404,752 --a------ C:\WINDOWS\system32\javart.dll
2006-10-16 14:33 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2006-10-16 14:33 286,992 --a------ C:\WINDOWS\system32\vmhelper.dll
2006-10-16 14:33 21,264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2006-10-16 14:33 187,152 --a------ C:\WINDOWS\system32\javacypt.dll
2006-10-16 14:33 172,304 --a------ C:\WINDOWS\system32\jview.exe
2006-10-16 14:33 171,792 --a------ C:\WINDOWS\system32\wjview.exe
2006-10-16 14:33 171,280 --a------ C:\WINDOWS\system32\jit.dll
2006-10-16 14:33 154,384 --a------ C:\WINDOWS\system32\msawt.dll
2006-10-16 14:33 15,120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2006-10-16 14:33 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2006-10-16 14:33 113 --a------ C:\WINDOWS\system32\zonedon.reg
2006-10-16 14:33 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2006-10-15 23:51 26,496 --a------ C:\WINDOWS\system32\drivers\USBSTOR.SYS
2006-10-15 23:43 98,304 --a------ C:\WINDOWS\system32\msir3jp.dll
2006-10-15 23:43 838,144 --a------ C:\WINDOWS\system32\chtbrkr.dll
2006-10-15 23:43 811,064 --a------ C:\WINDOWS\system32\imjp81k.dll
2006-10-15 23:43 76,288 --a------ C:\WINDOWS\system32\uniime.dll
2006-10-15 23:43 70,656 --a------ C:\WINDOWS\system32\korwbrkr.dll
2006-10-15 23:43 6,144 --a------ C:\WINDOWS\system32\kbd101a.dll
2006-10-15 23:43 218,112 --a------ C:\WINDOWS\system32\c_g18030.dll
2006-10-15 23:43 1,677,824 --a------ C:\WINDOWS\system32\chsbrkr.dll
2006-10-15 23:42 9,216 --a------ C:\WINDOWS\system32\kbdnecAT.dll
2006-10-15 23:42 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll
2006-10-15 23:42 8,192 --a------ C:\WINDOWS\system32\kbdkor.dll
2006-10-15 23:42 7,680 --a------ C:\WINDOWS\system32\kbdnecNT.dll
2006-10-15 23:42 7,168 --a------ C:\WINDOWS\system32\kbdnec95.dll
2006-10-15 23:42 7,168 --a------ C:\WINDOWS\system32\kbdibm02.dll
2006-10-15 23:42 7,168 --a------ C:\WINDOWS\system32\f3ahvoas.dll
2006-10-15 23:42 6,656 --a------ C:\WINDOWS\system32\kbdlk41a.dll
2006-10-15 23:42 6,656 --a------ C:\WINDOWS\system32\c_is2022.dll
2006-10-15 23:42 6,144 --a------ C:\WINDOWS\system32\kbdlk41j.dll
2006-10-15 23:42 6,144 --a------ C:\WINDOWS\system32\kbdax2.dll
2006-10-15 23:42 6,144 --a------ C:\WINDOWS\system32\kbd106n.dll
2006-10-15 23:42 6,144 --a------ C:\WINDOWS\system32\kbd106.dll
2006-10-15 23:42 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll
2006-10-15 23:42 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll
2006-10-15 23:42 6,144 --a------ C:\WINDOWS\system32\kbd101.dll
2006-10-15 23:42 5,632 --a------ C:\WINDOWS\system32\kbd103.dll
2006-10-15 23:41 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2006-10-15 23:41 59,648 --a------ C:\WINDOWS\system32\drivers\rfcomm.sys
2006-10-15 23:41 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2006-10-15 23:41 27,136 --a------ C:\WINDOWS\system32\irmon.dll
2006-10-15 23:41 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2006-10-15 23:41 17,024 --a------ C:\WINDOWS\system32\drivers\BthEnum.sys
2006-10-15 23:41 152,576 --a------ C:\WINDOWS\system32\irftp.exe
2006-10-15 23:41 100,992 --a------ C:\WINDOWS\system32\drivers\bthpan.sys
2006-10-15 23:40 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2006-10-15 23:40 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2006-10-15 23:40 363,520 --a------ C:\WINDOWS\system32\PsisDecd.dll
2006-10-15 23:40 3,712 --a------ C:\WINDOWS\system32\drivers\ctljystk.sys
2006-10-15 23:40 274,304 --a------ C:\WINDOWS\system32\drivers\bthport.sys
2006-10-15 23:40 18,944 --a------ C:\WINDOWS\system32\drivers\BTHUSB.SYS
2006-10-15 23:40 15,360 --a------ C:\WINDOWS\system32\drivers\MPE.sys
2006-10-15 23:40 11,776 --a------ C:\WINDOWS\system32\drivers\BdaSup.sys
2006-10-15 23:40 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2006-10-15 23:39 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-10-15 23:39 8,704 --a------ C:\WINDOWS\system32\batt.dll
2006-10-15 23:39 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-10-15 23:39 74,752 --a------ C:\WINDOWS\system32\storprop.dll
2006-10-15 23:39 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-10-15 23:39 69,120 --a------ C:\WINDOWS\NOTEPAD.EXE
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-10-15 23:39 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-10-15 23:39 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-10-15 23:39 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-10-15 23:39 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-10-15 23:39 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-10-15 23:39 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-10-15 23:39 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-10-15 23:39 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-10-15 23:39 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-10-15 23:39 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-10-15 23:39 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-10-15 23:39 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2006-10-15 23:39 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-10-15 23:39 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2006-10-15 23:39 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2006-10-15 22:55 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-10-15 22:54 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2006-10-15 22:54 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2006-10-15 22:54 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2006-10-15 22:54 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2006-10-15 22:54 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe
2006-10-15 22:36 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-10-15 22:36 168,832 --a------ C:\WINDOWS\system32\drivers\atinavt2.sys
2006-10-15 22:22 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2006-10-15 22:22 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2006-10-15 22:22 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2006-10-15 22:22 6,912 --a------ C:\WINDOWS\system32\drivers\ctlfacem.sys
2006-10-15 22:22 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2006-10-15 22:22 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2006-10-15 22:22 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2006-10-15 22:22 51,200 --a------ C:\WINDOWS\system32\sfman32.dll
2006-10-15 22:22 495,616 --a------ C:\WINDOWS\system32\sblfx.dll
2006-10-15 22:22 4,096 --a------ C:\WINDOWS\system32\ctwdm32.dll
2006-10-15 22:22 36,480 --a------ C:\WINDOWS\system32\drivers\sfmanm.sys
2006-10-15 22:22 283,904 --a------ C:\WINDOWS\system32\drivers\emu10k1m.sys
2006-10-15 22:22 256,512 --a------ C:\WINDOWS\system32\devcon32.dll
2006-10-15 22:22 24,064 --a------ C:\WINDOWS\system32\devldr32.exe
2006-10-15 22:22 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2006-10-15 22:22 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2006-10-15 22:22 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2006-10-15 22:22 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2006-10-15 22:15 52,736 -ra------ C:\WINDOWS\system32\drivers\NVENETFD.sys
2006-10-15 22:15 35,840 -ra------ C:\WINDOWS\system32\nvconrm.dll
2006-10-15 22:15 35,840 -ra------ C:\WINDOWS\system32\NVCOI.DLL
2006-10-15 22:15 289,792 -ra------ C:\WINDOWS\system32\idecoiins.dll
2006-10-15 22:15 289,792 -ra------ C:\WINDOWS\system32\idecoi.dll
2006-10-15 22:15 261,120 -ra------ C:\WINDOWS\system32\drivers\nvsnpu.sys
2006-10-15 22:15 208,896 -ra------ C:\WINDOWS\system32\nvusmb.exe
2006-10-15 22:15 208,896 --a------ C:\WINDOWS\system32\nvunrm.exe
2006-10-15 22:15 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2006-10-15 22:15 208,896 --------- C:\WINDOWS\system32\nvuide.exe
2006-10-15 22:15 208,384 -ra------ C:\WINDOWS\system32\fdco1ins.dll
2006-10-15 22:15 208,384 -ra------ C:\WINDOWS\system32\fdco1.dll
2006-10-15 22:15 18,944 -ra------ C:\WINDOWS\system32\drivers\nvnetbus.sys
2006-10-15 22:15 159,232 -ra------ C:\WINDOWS\system32\fdco_l1036.dll
2006-10-15 22:15 159,232 -ra------ C:\WINDOWS\system32\fdco_l1034.dll
2006-10-15 22:15 159,232 -ra------ C:\WINDOWS\system32\fdco_l1031.dll
2006-10-15 22:15 158,720 -ra------ C:\WINDOWS\system32\fdco_l1046.dll
2006-10-15 22:15 158,720 -ra------ C:\WINDOWS\system32\fdco_l1040.dll
2006-10-15 22:15 156,672 -ra------ C:\WINDOWS\system32\fdco_l1042.dll
2006-10-15 22:15 156,672 -ra------ C:\WINDOWS\system32\fdco_l1041.dll
2006-10-15 22:15 155,648 -ra------ C:\WINDOWS\system32\fdco_l1028.dll
2006-10-15 22:15 155,136 -ra------ C:\WINDOWS\system32\fdco_l2052.dll
2006-10-15 22:15 109,568 -ra------ C:\WINDOWS\system32\drivers\nvtcp.sys
2006-10-15 22:15 100,736 -ra------ C:\WINDOWS\system32\drivers\nvata.sys
2006-10-15 22:15 10,240 -ra------ C:\WINDOWS\system32\bdco1ins.dll
2006-10-15 22:15 10,240 -ra------ C:\WINDOWS\system32\bdco1.dll
2006-10-15 22:15 1,068,800 -ra------ C:\WINDOWS\system32\drivers\nvnrm.sys
2006-10-15 22:14 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2006-10-15 22:14 486,400 -ra------ C:\WINDOWS\system32\AsusSetup.exe
2006-10-15 22:13 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2006-10-15 22:13 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2006-10-15 22:13 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2006-10-15 22:13 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2006-10-15 22:13 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2006-10-15 22:13 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2006-10-15 22:13 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2006-10-15 22:13 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-10-15 22:13 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2006-10-15 22:13 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2006-10-15 22:13 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2006-10-15 22:13 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2006-10-15 22:13 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2006-10-15 22:12 992,896 --a------ C:\WINDOWS\system32\drivers\Bravo_n.sys
2006-10-15 22:12 992,896 --a------ C:\WINDOWS\system32\drivers\Bravo_a.sys
2006-10-15 22:12 46,592 --a------ C:\WINDOWS\system32\asfrench.dll
2006-10-15 22:12 46,080 --a------ C:\WINDOWS\system32\asrussian.dll
2006-10-15 22:12 46,080 --a------ C:\WINDOWS\system32\asgerman.dll
2006-10-15 22:12 46,080 --a------ C:\WINDOWS\system32\aseng.dll
2006-10-15 22:12 45,568 --a------ C:\WINDOWS\system32\askorean.dll
2006-10-15 22:12 45,568 --a------ C:\WINDOWS\system32\asjapan.dll
2006-10-15 22:12 45,568 --a------ C:\WINDOWS\system32\aschs.dll
2006-10-15 22:12 257,920 --a------ C:\WINDOWS\system32\ATKDISP.dll
2006-10-15 22:12 11,008 --a------ C:\WINDOWS\system32\drivers\atkkbnt.sys
2006-10-15 22:12 10,496 --a------ C:\WINDOWS\system32\ATKOSDMini.DLL
2006-10-15 22:12 1,667,072 --a------ C:\WINDOWS\system32\ATKDispCPL.dll
2006-10-15 22:11 45,568 --a------ C:\WINDOWS\system32\ASCHT.dll
2006-10-15 22:11 43,008 --a------ C:\WINDOWS\system32\ATKOGL32.dll
2006-10-15 22:11 2,040,832 --a------ C:\WINDOWS\system32\ATKOSDX32.dll
2006-10-15 22:09 34,304 --a------ C:\WINDOWS\system32\ativtmxx.dll
2006-10-15 22:09 166,400 --a------ C:\WINDOWS\system32\drivers\atinevxx.sys
2006-10-15 22:09 15,360 --a------ C:\WINDOWS\system32\drivers\atinmdxx.sys
2006-10-15 22:08 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-10-15 22:06 11,264 -ra------ C:\WINDOWS\system32\drivers\EIO.sys
2006-10-15 22:00 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-10-15 22:00 0 -rahs---- C:\MSDOS.SYS
2006-10-15 22:00 0 -rahs---- C:\IO.SYS
2006-10-15 22:00 0 --a------ C:\CONFIG.SYS
2006-10-15 22:00 0 --a------ C:\AUTOEXEC.BAT
2006-10-15 21:59 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-10-15 21:59 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2006-10-15 21:59 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2006-10-15 21:59 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2006-10-15 21:59 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-10-15 21:59 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-10-15 21:59 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2006-10-15 21:59 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-10-15 21:59 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2006-10-15 21:59 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-10-15 21:59 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-10-15 21:59 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-10-15 21:59 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-10-15 21:59 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-10-15 21:59 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-10-15 21:59 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-10-15 21:59 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-10-15 21:59 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-10-15 21:59 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-10-15 21:59 239,104 --a------ C:\WINDOWS\system32\srrstr.dll
2006-10-15 21:59 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-10-15 21:59 194,328 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-10-15 21:59 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-10-15 21:59 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-10-15 21:59 172,312 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-10-15 21:59 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-10-15 21:59 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-10-15 21:59 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-10-15 21:59 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-10-15 21:59 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2006-10-15 21:59 124,184 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-10-15 21:59 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-10-15 21:59 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-10-15 21:59 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-10-15 21:58 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2006-10-15 21:58 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-10-15 21:58 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-10-15 21:58 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-10-15 21:58 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-10-15 21:58 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-10-15 21:58 48,128 --a------ C:\WINDOWS\system32\inetres.dll
2006-10-15 21:58 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-10-15 21:58 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2006-10-15 21:58 274,944 --a------ C:\WINDOWS\system32\mstask.dll
2006-10-15 21:58 274,432 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-10-15 21:58 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-10-15 21:58 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2006-10-15 21:58 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-10-15 21:58 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-10-15 21:58 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-10-15 21:58 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-10-15 21:58 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-10-15 21:57 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2006-10-15 21:57 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-10-15 21:57 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-10-15 21:57 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-10-15 21:57 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-10-15 21:57 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-10-15 21:57 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-10-15 21:57 80,384 --a------ C:\WINDOWS\system32\charmap.exe
2006-10-15 21:57 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-10-15 21:57 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-10-15 21:57 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-10-15 21:57 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-10-15 21:57 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2006-10-15 21:57 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2006-10-15 21:57 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2006-10-15 21:57 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-10-15 21:57 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-10-15 21:57 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-10-15 21:57 56,832 --a------ C:\WINDOWS\system32\sol.exe
2006-10-15 21:57 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-10-15 21:57 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2006-10-15 21:57 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-10-15 21:57 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-10-15 21:57 538,624 --a------ C:\WINDOWS\system32\spider.exe
2006-10-15 21:57 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-10-15 21:57 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-10-15 21:57 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-10-15 21:57 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-10-15 21:57 407,552 --a------ C:\WINDOWS\system32\mstsc.exe
2006-10-15 21:57 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2006-10-15 21:57 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-10-15 21:57 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-10-15 21:57 38,912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-10-15 21:57 347,136 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-10-15 21:57 343,040 --a------ C:\WINDOWS\system32\mspaint.exe
2006-10-15 21:57 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-10-15 21:57 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2006-10-15 21:57 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-10-15 21:57 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-10-15 21:57 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2006-10-15 21:57 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-10-15 21:57 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2006-10-15 21:57 20,992 --a------ C:\WINDOWS\system32\msg.exe
2006-10-15 21:57 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-10-15 21:57 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-10-15 21:57 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2006-10-15 21:57 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-10-15 21:57 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2006-10-15 21:57 183,808 --a------ C:\WINDOWS\system32\accwiz.exe
2006-10-15 21:57 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-10-15 21:57 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-10-15 21:57 16,896 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-10-15 21:57 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-10-15 21:57 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-10-15 21:57 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-10-15 21:57 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-10-15 21:57 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-10-15 21:57 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-10-15 21:57 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-10-15 21:57 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-10-15 21:57 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-10-15 21:57 14,848 --a------ C:\WINDOWS\system32\tscon.exe
2006-10-15 21:57 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2006-10-15 21:57 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2006-10-15 21:57 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-10-15 21:57 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-10-15 21:57 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2006-10-15 21:57 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2006-10-15 21:57 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2006-10-15 21:57 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-10-15 21:57 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-10-15 21:57 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-10-15 21:57 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-10-15 21:57 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-10-15 21:57 102,912 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-10-15 21:57 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2006-10-15 21:57 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

2006-10-18 19:49 -------- d-------- C:\Documents and Settings\Nibby\Application Data\Xfire
2006-10-18 18:40 -------- d-------- C:\Program Files\EA GAMES
2006-10-18 18:19 -------- d-------- C:\Documents and Settings\Nibby\Application Data\DMCache
2006-10-18 16:32 -------- d-------- C:\Program Files\Webroot
2006-10-18 16:32 -------- d-------- C:\Documents and Settings\Nibby\Application Data\Webroot
2006-10-18 15:42 -------- d-------- C:\Program Files\TGTSoft
2006-10-18 15:19 -------- d-------- C:\Documents and Settings\Nibby\Application Data\Adobe
2006-10-18 15:12 -------- d-------- C:\Program Files\Hewlett-Packard
2006-10-18 15:10 -------- d-------- C:\Program Files\HP
2006-10-18 00:28 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-18 00:28 -------- d-------- C:\Program Files\Electronic Arts
2006-10-18 00:23 -------- d-------- C:\Program Files\DAEMON Tools
2006-10-17 23:25 -------- d-------- C:\Program Files\Java
2006-10-17 23:25 -------- d-------- C:\Documents and Settings\Nibby\Application Data\Sun
2006-10-17 23:23 -------- d-------- C:\Program Files\Common Files\Java
2006-10-17 23:23 -------- d-------- C:\Program Files\Common Files
2006-10-17 23:07 -------- d-------- C:\Documents and Settings\Nibby\Application Data\IDM
2006-10-17 22:41 -------- d-------- C:\Program Files\Internet Download Manager
2006-10-17 16:46 -------- d-------- C:\Program Files\Adobe
2006-10-17 16:45 -------- d-------- C:\Program Files\Common Files\Adobe
2006-10-17 16:44 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2006-10-17 16:27 -------- d-------- C:\Documents and Settings\Nibby\Application Data\Macromedia
2006-10-17 16:25 -------- d-------- C:\Program Files\Common Files\Macromedia
2006-10-17 16:24 -------- d-------- C:\Program Files\Macromedia
2006-10-17 16:18 -------- d-------- C:\Program Files\GlobalSCAPE
2006-10-17 16:18 -------- d-------- C:\Documents and Settings\Nibby\Application Data\GlobalSCAPE
2006-10-17 13:27 -------- d---s---- C:\Program Files\Xfire
2006-10-16 19:46 -------- d-------- C:\Program Files\Starcraft
2006-10-16 18:51 -------- d-------- C:\Program Files\Stardock
2006-10-16 17:46 -------- d---s---- C:\Documents and Settings\Nibby\Application Data\Microsoft
2006-10-16 16:03 -------- d-------- C:\Program Files\THQ
2006-10-16 14:38 -------- d-------- C:\Program Files\KBC-Online
2006-10-16 00:01 -------- d-------- C:\Program Files\Messenger
2006-10-16 00:00 -------- d-------- C:\Program Files\Windows Media Player
2006-10-16 00:00 -------- d-------- C:\Program Files\Internet Explorer
2006-10-15 23:59 -------- d-------- C:\Program Files\Outlook Express
2006-10-15 23:59 -------- d-------- C:\Program Files\Common Files\System
2006-10-15 23:47 -------- d-------- C:\Documents and Settings\Nibby\Application Data\Ahead
2006-10-15 23:46 -------- d-------- C:\Program Files\Nero
2006-10-15 23:46 -------- d-------- C:\Program Files\Common Files\Ahead
2006-10-15 23:44 -------- d-------- C:\Program Files\WinRAR
2006-10-15 23:39 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-10-15 23:39 -------- d-------- C:\Program Files\Common Files\ODBC
2006-10-15 23:38 62 --ahs---- C:\Documents and Settings\Nibby\Application Data\desktop.ini
2006-10-15 22:56 -------- d-------- C:\Program Files\Winamp
2006-10-15 22:46 -------- d-------- C:\Program Files\ATI Technologies
2006-10-15 22:33 -------- d-------- C:\Documents and Settings\Nibby\Application Data\Avant Profiles
2006-10-15 22:32 -------- d-------- C:\Program Files\Avant Browser
2006-10-15 22:25 -------- d-------- C:\Program Files\MSN Messenger
2006-10-15 22:25 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-15 22:13 -------- d-------- C:\Documents and Settings\Nibby\Application Data\ATI
2006-10-15 22:12 -------- d-------- C:\Program Files\My Company Name
2006-10-15 22:11 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-10-15 22:04 -------- d--h----- C:\Program Files\Uninstall Information
2006-10-15 22:04 -------- d-------- C:\Documents and Settings\Nibby\Application Data\Identities
2006-10-15 22:01 -------- d-------- C:\Program Files\xerox
2006-10-15 22:01 -------- d-------- C:\Program Files\microsoft frontpage
2006-10-15 21:59 -------- d--h----- C:\Program Files\WindowsUpdate
2006-10-15 21:59 -------- d-------- C:\Program Files\NetMeeting
2006-10-15 21:59 -------- d-------- C:\Program Files\Movie Maker
2006-10-15 21:59 -------- d-------- C:\Program Files\Common Files\Services
2006-10-15 21:59 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-10-15 21:58 -------- d-------- C:\Program Files\Windows NT
2006-10-15 21:58 -------- d-------- C:\Program Files\Online Services
2006-10-15 21:58 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-10-15 21:58 -------- d-------- C:\Program Files\ComPlus Applications
2006-10-15 21:57 -------- d-------- C:\Program Files\MSN
2006-09-13 07:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-08-29 10:28 140984 --a------ C:\WINDOWS\system32\idmmbc.dll
2006-08-25 17:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-23 03:53 260096 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-08-23 03:53 1723904 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys
2006-08-23 03:47 114688 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-08-23 03:46 86016 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-08-23 03:46 77824 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-08-23 03:46 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-08-23 03:46 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-08-23 03:45 413696 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-08-23 03:44 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-08-23 03:38 2401984 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-08-23 03:33 303104 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-08-23 03:33 2510752 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-08-23 03:27 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-08-23 03:24 5140480 --a------ C:\WINDOWS\system32\atioglxx.dll
2006-08-23 03:21 221184 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-08-23 03:19 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-08-23 03:14 290816 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-08-16 13:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-21 10:24 72704 --a------ C:\WINDOWS\system32\hlink.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
"STYLEXP"="\"C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe\" -Hide"
"_mzu_stonedrv7"="c:\\windows\\system32\\_mzu_stonedrv7.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"BluetoothAuthenticationAgent"="\"rundll32.exe\" bthprops.cpl,,BluetoothAuthenticationAgent"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe\""
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd.exe\""
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"DeviceDiscovery"="\"C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpotdd01.exe\""
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb09.exe"
"SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray"
"_mzu_stonedrv7"="c:\\windows\\system32\\_mzu_stonedrv7.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"_mzu_stonedrv7"="c:\\windows\\system32\\_mzu_stonedrv7.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
"_mzu_stonedrv7"="c:\\windows\\system32\\_mzu_stonedrv7.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"
"_mzu_stonedrv7"="c:\\windows\\system32\\_mzu_stonedrv7.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoActiveDesktop"=dword:00000000
"ClassicShell"=dword:00000000
"ForceActiveDesktopOn"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService
Completion time: 06-10-18 20:31:45.70
C:\ComboFix.txt ... 06-10-18 20:31


Hijackthis
------------
Logfile of HijackThis v1.99.1
Scan saved at 20:32:42, on 18/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\DOCUME~1\Nibby\LOCALS~1\Temp\Rar$EX00.890\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide
O4 - HKCU\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Rootkit driver pe386 is present. A rootkit scan is required

Klik om te vergroten...

Zoals ik al dacht, je bent geïnfecteerd met een rootkit.


1. Download The Avenger by Swandog46 naar je Bureaublad.

• Klik op Avenger.zip om het uit te pakken naar je bureaublad

2. Nu, start The Avenger door op het icoontje met het zwaard te dubbelklikken.

• Onder "Script file to execute" kies "Input Script Manually".
• Klik op het vergrootglas icoontje die een niew venster zal openen met de naam "View/edit script"
• Kopieer en plak volgend volledig vetgedrukt erin:
  

  Drivers to unload:
  pe386

  Klik om te vergroten...

  
  Opgelet: Bovenstaande code werd enkel gemaakt voor deze computer/situatie/user. Indien je deze code op een andere computer gebruikt kan het schade toebrengen!
• Klik Done
• Daarna klik op het Groen verkeerslicht om het script uit te voeren
• Antwoord "Yes/Ja" wanneer daarnaar gevraagd wordt.

3. The Avenger zal daarna het volgende doen:

• Uw computer herstarten. ( In gevallen waar het script een code bevat met "Drivers to Unload", dan zal The Avenger tweemaal uw systeem herstarten)
• Na herstart, zal het vlug een zwart command window openen. Dit is normaal.
• Na herstart, zal het een log maken die zal openen met de resultaten van The Avenger. Deze log zal te vinden zijn op C:\avenger.txt
• The Avenger maakt ook backups aan met alle bestanden, etc., die eerder werden verwijderd door The Avenger, deze backups bevinden zich op volgende plaats: C:\avenger\backup.zip.

4. Kopieer en plak de inhoud van avenger.txt in je volgende post samen met een nieuw hijackthislog.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\uuutcqbm

*******************

Script file located at: \??\C:\w^wuqfgf.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver pe386 unloaded successfully.

Completed script processing.

*******************

Finished! Terminate.




Hijackthis
-----------------
Logfile of HijackThis v1.99.1
Scan saved at 20:51:16, on 18/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Nibby\Desktop\hijackthis\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide
O4 - HKCU\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

* Download en installeer AVG Anti-Spyware.

• 
  Na de installatie, open AVG Anti-Spyware:
  * onder "Status", klik op Change state naast "Resident shield". (wijzig van active naar inactive!)
  * onder "Update", klik op de Start update knop.
  * onder "Scanner", tab "Settings":
  • - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine. (ZEER BELANGRIJK!)
    * onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
  Sluit AVG Anti-Spyware. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm
Download link van Ad-aware: http://www.lavasoftusa.com/products/ad-aware_se_personal.php

* Start je computer op in VEILIGE MODUS

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

* Start AVG Anti-Spyware.

• * Klik op Scan en kies Complete System Scan.
  Na de scan; volg onderstaande instructies :
  BELANGRIJK : Klik niet op de "Save Scan Report" knop vooraleer je de "Apply all Actions" knop hebt aangeklikt !
  * Draag er zorg voor dat Set all elements to: op Quarantine staat (1),
  zoniet klik op de link en kies Quarantine in de popup menu. (2)
  (Dit geldt niet voor cookies, deze worden onveranderlijk gedelete !)
  * Onderaan het venster klik op de Apply all Actions knop. (3)
  
  
  
  * Wanneer je de melding krijgt 'All actions have been applied', klik je onderaan op de knop Save Report.

* Herstart je computer in normale modus.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Post dan een nieuw hijackthis logje hier met het rapport van AVG antispyware.

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 23:07:30 18/10/2006

+ Scan result:



C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned.
C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP21\A0003944.exe -> Downloader.Small.ctf : Cleaned.
C:\WINDOWS\system32\MZU_DRV.sys -> Proxy.Small.bo : Cleaned.
C:\Documents and Settings\Nibby\Cookies\nibby@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Nibby\Cookies\nibby@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Nibby\Cookies\[email protected][1].txt -> TrackingCookie.Gamershell : Cleaned.
C:\Documents and Settings\Nibby\Cookies\nibby@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Nibby\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned.


::Report end





Hijackthis
-------------
Logfile of HijackThis v1.99.1
Scan saved at 23:11:21, on 18/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\windows\system32\_mzu_stonedrv7.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Nibby\Desktop\hijackthis\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [STYLEXP] "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" -Hide
O4 - HKCU\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

* Je Java software is verouderd. oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem. Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

• Download de nieuwste versie hier: Java Runtime Environment (JRE) 5.0 Update 9.
• Scroll naar beneden tot waar er staat: "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Klik dan rechts op de "Download" knop.
• Vink het volgende aan waar er staat: "Accept License Agreement".
• De pagina zal herladen.
• Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen En bewaar het naar je bureaublad.
• Sluit alle programma's die eventueel open zijn - Zeker je web browser!
• Ga dan naar Start > Configuratiescherm en dubbelklik op software en verwijder alle oudere versies van Java.
• Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
• Klik dan op Verwijderen of Wijzig/Verwijder knop.
• Herhaal dit tot alle oudere versies verdwenen zijn.
• Na het verwijderen van alle oudere versies, herstart dan je pc.
• Dubbelkik dan op jre-1_5_0_09-windows-i586-p.exe op je bureaublad om de nieuwste versie van Java te installeren.

* Open hijackthis en vink volgende regels aan:

O4 - HKLM\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKLM\..\RunServices: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe
O4 - HKCU\..\Run: [_mzu_stonedrv7] c:\windows\system32\_mzu_stonedrv7.exe

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Download en unzip Killbox naar je bureaublad.
Klik op killbox.exe.
Selecteer de optie "Delete on reboot".
In het veld "Full Path of File to Delete" kopieer en plak je het volgende:

C:\windows\system32\_mzu_stonedrv7.exe

Klik op de knop: single file (!Belangrijk!)

Daarna, Klik op de rode cirkel met het wit kruisje erin.
Killbox zal zeggen dat deze file zal verwijderd worden on reboot.. vraagt om nu te rebooten. Klik YES.

Je pc moet nu rebooten.

* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
• Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
• Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
• Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
• Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
• Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
• Klik daarna de groene pijl rechts om de scan te starten.
• Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
• Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
  
• Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
  
  
  
  Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
• Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
• Sluit daarna Dr.Web Cureit.
• Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
• Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post met een nieuw hijackthis logje.

_mzu_stonedrv7.exe;C:\!KillBox;Trojan.MulDrop.4324;Deleted.;
A0003903.exe;C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP21;Trojan.PWS.Snap;Deleted.;
A0003943.exe\data001;C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP21\A0003943.exe;Trojan.PWS.Snap;;
A0003943.exe\data002;C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP21\A0003943.exe;Trojan.PWS.Snap;;
A0003943.exe;C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP21;Archive contains infected objects;Moved.;
A0004250.sys;C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP23;Trojan.PWS.GoldSpy;Deleted.;
A0004251.exe;C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP23;Adware.SaveNow;Incurable.Moved.;
A0004469.exe;C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP25;Trojan.MulDrop.4324;Deleted.;
A0004488.exe;C:\System Volume Information\_restore{84839C02-5F2F-4BFA-B534-D1D45B193024}\RP25;Trojan.MulDrop.4324;Deleted.;
fb0c4nps.exe;C:\WINDOWS;Trojan.DownLoader.13549;Deleted.;



Hijackthis
---------------
Logfile of HijackThis v1.99.1
Scan saved at 0:07:58, on 19/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Nibby\Desktop\hijackthis\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

Ok, installeer ook eens een goeie en gratis antivirus die je pc niet zo vertraagt zoals AVG free, Avast of antivir (Makkelijk te vinden via google.)
Update ook de definities van je AV!

Installeer ook een firewall zoals Sygate personal firewall, Kerio personal firewall of zonealarm...

Daarn herstart je je pc en voer je eens een schijfdefragmentatie uit.

Post dan een nieuw hijackthis logje hier en vertel hoe alles verder werkt.