Archief - Logs na MSN Virus

Logfile of HijackThis v1.99.1
Scan saved at 9:36:56, on 2/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\TEVRED~1\LOCALS~1\Temp\Rar$EX00.437\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Tevreden klant\Application Data\Mozilla\Profiles\default\gwx4eqj8.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - :C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: &Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb100\Dealio.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O2 - BHO: (no name) - {C100C272-05B2-7847-9EAB-5450D1FE28CC} - C:\WINDOWS\system32\pkvfu.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb100\Dealio.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"
O4 - HKLM\..\Run: [XFP: Multi-IM] "C:\Program Files\Xfire Plus\Multi-IM\MultiIM.exe"
O4 - HKLM\..\Run: [Pando] C:\Program Files\Pando Networks\Pando\Pando.exe /Automation
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EA Link\Core.exe -silent
O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe
O4 - HKCU\..\Run: [Bztt] C:\Documents and Settings\Tevreden klant\Application Data\??crosoft\alg.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Buru] "C:\PROGRA~1\COMMON~1\SMBOLS~1\ati2evxx.exe" -vt yazb
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Program Files\Dealio\kb100\res\DealioSearch.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb100\Dealio.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\benl.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0F733F27-5BBB-4D03-8D6B-19E2143880BF} (SkillGround Game Manager) - https://www1.skillground.com/sg/client/SkillGround.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O18 - Protocol: bw+0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL (file missing)
O18 - Protocol: offline-8876480 - {57BF8484-15EB-4A28-A9CE-C6ADB6E5E9C5} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe (file missing)

Klik om te vergroten...

Tevreden klant - 06-12-02 9:20:00.28 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Program Files\Mozilla Firefox"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\{34C518AB-07C5-2067-0419-050411170020}
C:\Program Files\Common Files\{94C518AB-07C5-2067-0419-050411170020}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Tevreden klant\Application Data\CROSOF~1
C:\QooBox\Purity\Documents and Settings\Tevreden klant\Application Data\CROSOF~1\alg.exe
C:\QooBox\Purity\Program Files\Common Files\SMBOLS~1
C:\QooBox\Purity\Program Files\Common Files\SMBOLS~1\s?mbols
C:\QooBox\Purity\Program Files\Common Files\SMBOLS~1\__delete_on_reboot__a_t_i_2_e_v_x_x_._e_x_e_


((((((((((((((((((((((((((((((( Files Created from 2006-11-02 to 2006-12-02 ))))))))))))))))))))))))))))))))))


2006-12-02 01:17 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-02 01:17 <DIR> d-------- C:\Program Files\Grisoft
2006-12-02 00:58 <DIR> d-------- C:\Program Files\MSN Messenger
2006-12-02 00:14 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2006-12-02 00:06 <DIR> d--hs---- C:\Config.Msi
2006-12-01 23:37 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2006-12-01 23:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-12-01 23:26 56,320 --a------ C:\WINDOWS\system32\pkvfu.dll
2006-12-01 23:11 8,570 --a------ C:\WINDOWS\system32\telebos.exe
2006-12-01 23:11 138,565 --a------ C:\WINDOWS\system32\mcc.exe
2006-12-01 19:11 <DIR> d-------- C:\Program Files\SkillGround
2006-12-01 19:08 <DIR> d-------- C:\WINDOWS\system32\SkillGround
2006-11-25 16:11 <DIR> d-------- C:\Program Files\BF2Statistics Client
2006-11-22 17:14 <DIR> d-------- C:\Program Files\Xfire Plus
2006-11-22 17:14 <DIR> d-------- C:\Documents and Settings\Tevreden klant\Application Data\Xfire Plus
2006-11-20 19:41 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2006-11-20 19:41 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2006-11-20 19:41 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2006-11-20 19:41 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2006-11-20 19:41 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2006-11-20 19:41 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2006-11-18 18:05 <DIR> d-------- C:\Program Files\Wings.Over.Europe.Cold.War.Gone.Hot.WORKING-FAS
2006-11-18 17:09 <DIR> d-------- C:\Program Files\Nolimits Rollercoaser
2006-11-17 18:46 <DIR> d-------- C:\Program Files\WhatPulse
2006-11-16 20:16 <DIR> d-------- C:\Program Files\MySQL
2006-11-15 22:02 <DIR> d-------- C:\Documents and Settings\Tevreden klant\Application Data\uk.co.planetside
2006-11-10 07:13 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2006-11-10 07:12 <DIR> d-------- C:\Program Files\Common Files\L&H
2006-11-10 07:11 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2006-11-10 07:10 <DIR> d-------- C:\Program Files\Microsoft Visual Studio
2006-11-10 07:10 <DIR> d-------- C:\Program Files\Common Files\DESIGNER
2006-11-10 07:09 <DIR> d-------- C:\WINDOWS\SHELLNEW
2006-11-10 07:09 <DIR> d-------- C:\Program Files\Microsoft.NET
2006-11-10 07:09 <DIR> d-------- C:\Program Files\Microsoft Office
2006-11-10 07:07 <DIR> dr-h----- C:\MSOCache
2006-11-10 07:06 <DIR> d-------- C:\Program Files\AppsPro
2006-11-09 20:41 <DIR> d-------- C:\Program Files\Sauerbraten
2006-11-08 17:59 <DIR> d-------- C:\Program Files\LeoCAD
2006-11-04 14:14 1,245,696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-04 00:44 <DIR> d-------- C:\Program Files\Xvid


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

2006-12-02 09:25 -------- d-------- C:\Program Files\Common Files
2006-12-02 09:19 -------- d-------- C:\Program Files\Mozilla Firefox
2006-12-02 09:18 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\Xfire
2006-12-02 09:14 -------- d-------- C:\Program Files\Microsoft AntiSpyware
2006-12-02 03:18 -------- d-------- C:\Program Files\mIRC
2006-12-02 00:27 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-12-01 23:55 -------- d-------- C:\Program Files\Anti-Leech
2006-12-01 23:14 -------- d---s---- C:\Program Files\Xfire
2006-12-01 19:56 -------- d-------- C:\Program Files\FlashGet
2006-11-29 16:13 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\combustion4
2006-11-25 15:44 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\uTorrent
2006-11-24 19:59 -------- d-------- C:\Program Files\Bf2 Sound Tools
2006-11-22 17:26 -------- d-------- C:\Program Files\Windows Media Player
2006-11-19 18:22 -------- d-------- C:\Program Files\Eidos
2006-11-19 15:38 -------- d-------- C:\Program Files\Terragen
2006-11-19 01:02 -------- d-------- C:\Program Files\Internet Explorer
2006-11-18 15:14 -------- d-------- C:\Program Files\TrackMania Nations ESWC
2006-11-16 20:26 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2006-11-14 10:08 -------- d-------- C:\Program Files\Electronic Arts
2006-11-13 23:02 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-11 23:16 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\IGN_DLM
2006-11-11 15:07 -------- d-------- C:\Program Files\L3DT
2006-11-10 17:48 -------- d---s---- C:\Documents and Settings\Tevreden klant\Application Data\Microsoft
2006-11-10 07:12 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-11-10 07:10 -------- d-------- C:\Program Files\Microsoft Works
2006-11-10 07:10 -------- d-------- C:\Program Files\Common Files\System
2006-11-06 17:13 -------- d-------- C:\Program Files\Sierra
2006-11-06 17:09 -------- d-------- C:\Program Files\EA GAMES
2006-11-04 00:01 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\bsplayer
2006-11-03 22:16 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\Hamachi
2006-11-03 20:31 15440 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2006-11-03 20:26 -------- d-------- C:\Program Files\Anti-Blaxx
2006-11-02 10:53 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\Skype
2006-11-02 09:53 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\DivX
2006-11-01 21:24 -------- d-------- C:\Program Files\Rockstar Games
2006-11-01 14:54 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2006-11-01 14:52 765952 --a------ C:\WINDOWS\system32\xvidcore.dll
2006-10-31 20:32 -------- d-------- C:\Program Files\Ubisoft
2006-10-31 20:32 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\Gearbox Software
2006-10-31 19:23 -------- d-------- C:\Program Files\Teamspeak2_RC2
2006-10-29 21:22 -------- d-------- C:\Program Files\ReadPlease 2003
2006-10-29 21:13 -------- d-------- C:\Program Files\AliveMedia
2006-10-28 22:59 -------- d-------- C:\Program Files\Virtualdub
2006-10-28 19:39 -------- d-------- C:\Program Files\The Sir. Community
2006-10-28 16:41 -------- d-------- C:\Program Files\Google
2006-10-27 21:19 -------- d-------- C:\Program Files\ImageWarp
2006-10-24 16:23 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\Macromedia
2006-10-24 16:19 -------- d-------- C:\Program Files\Macromedia
2006-10-21 18:52 -------- d-------- C:\Program Files\Debugging Tools for Windows
2006-10-21 11:47 15384 --a------ C:\Documents and Settings\Tevreden klant\Application Data\phpdesigner2007.xml
2006-10-21 11:47 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\PHP Designer 2007
2006-10-20 14:23 619352 --a------ C:\WINDOWS\system32\WINSSWEBAGENT.DLL
2006-10-18 17:54 -------- d-------- C:\Program Files\GameSpy
2006-10-14 21:58 -------- d-------- C:\Program Files\Sony Setup
2006-10-14 21:58 -------- d-------- C:\Program Files\Sony
2006-10-14 14:57 -------- d-------- C:\Program Files\DivX
2006-10-14 10:55 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\SmartFTP
2006-10-13 13:41 144384 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-11 20:56 -------- d-------- C:\Program Files\Graphmatica
2006-10-08 15:39 -------- d-------- C:\Documents and Settings\Tevreden klant\Application Data\InstallShield
2006-10-08 12:35 -------- d-------- C:\Program Files\AAALOGO
2006-10-07 00:52 -------- d-------- C:\Program Files\Autodesk
2006-10-02 20:04 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 20:04 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 20:04 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 20:04 635486 --a------ C:\WINDOWS\system32\DivX.dll
2006-10-02 16:58 -------- d-------- C:\Program Files\NetMeeting
2006-09-28 19:52 98304 --a------ C:\WINDOWS\system32\CddbLangNL.dll
2006-09-28 19:52 98304 --a------ C:\WINDOWS\system32\CddbLangFR.dll
2006-09-28 19:52 98304 --a------ C:\WINDOWS\system32\CddbLangES.dll
2006-09-28 19:52 98304 --a------ C:\WINDOWS\system32\CddbLangDE.dll
2006-09-28 19:52 77824 --a------ C:\WINDOWS\system32\CddbLangJA.dll
2006-09-28 19:52 765952 --a------ C:\WINDOWS\system32\CDDBUI.dll
2006-09-28 19:52 655360 --a------ C:\WINDOWS\system32\CDDBControl.dll
2006-09-28 19:52 102400 --a------ C:\WINDOWS\system32\CddbLangIT.dll
2006-09-27 02:52 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-09-27 02:50 260608 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-09-27 02:43 90112 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-09-27 02:43 77824 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-09-27 02:43 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-09-27 02:43 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-09-27 02:43 118784 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-09-27 02:41 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-09-27 02:41 425984 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-09-27 02:34 2415648 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-09-27 02:29 1086144 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-09-27 02:23 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-09-27 02:21 5144576 --a------ C:\WINDOWS\system32\atioglxx.dll
2006-09-27 02:18 303104 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-09-27 02:16 221184 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-09-27 02:15 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-09-27 02:10 294912 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-09-26 21:05 520192 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-09-13 06:07 1084416 --a------ C:\WINDOWS\system32\msxml3.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"EA Core"="C:\\Program Files\\Electronic Arts\\EA Link\\Core.exe -silent"
"WhatPulse"="C:\\Program Files\\WhatPulse\\WhatPulse.exe"
"Bztt"="C:\\Documents and Settings\\Tevreden klant\\Application Data\\??crosoft\\alg.exe"
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"Buru"="\"C:\\PROGRA~1\\COMMON~1\\SMBOLS~1\\ati2evxx.exe\" -vt ndrv"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Logitech Utility"="Logi_MwX.Exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"au"="C:\\Program Files\\Dealio\\DealioAU.exe"
"Xfire Music"="\"C:\\Program Files\\Xfire\\xfiremusic.exe\""
"XFP: Multi-IM"="\"C:\\Program Files\\Xfire Plus\\Multi-IM\\MultiIM.exe\""
"WINDOWS"="c:\\pdwpamt.exe"
@=""
"Pando"="C:\\Program Files\\Pando Networks\\Pando\\Pando.exe /Automation"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\WhatPulse.exe]
@="C:\\Program Files\\WhatPulse\\WhatPulse.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
@=""

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000002

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoActiveDesktop"=dword:00000000
"ClassicShell"=dword:00000000
"ForceActiveDesktopOn"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PCPitstop Optimize Registration Reminder"="C:\\Program Files\\PCPitstop\\Optimize\\Reminder.exe"
"mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe"
"Logitech Utility"="Logi_MwX.Exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cli"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mozilla Quick Launch]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Netscp"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -aim"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NBJ"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FirebirdServerDefaultInstance"=dword:00000002

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Update Rising Conflicts.job

Completion time: 06-12-02 9:26:04.04
C:\ComboFix.txt ... 06-12-02 09:26

Klik om te vergroten...

• Klik op Avenger.zip om het uit te pakken naar je bureaublad

• Onder "Script file to execute" kies "Input Script Manually".
• Klik op het vergrootglas icoontje die een niew venster zal openen met de naam "View/edit script"
• Kopieer en plak volgend volledig vetgedrukt erin:
  

  Drivers to unload:
  pe386

  Klik om te vergroten...

  
  Opgelet: Bovenstaande code werd enkel gemaakt voor deze computer/situatie/user. Indien je deze code op een andere computer gebruikt kan het schade toebrengen!
• Klik Done
• Daarna klik op het Groen verkeerslicht om het script uit te voeren
• Antwoord "Yes/Ja" wanneer daarnaar gevraagd wordt.

• Uw computer herstarten. ( In gevallen waar het script een code bevat met "Drivers to Unload", dan zal The Avenger tweemaal uw systeem herstarten)
• Na herstart, zal het vlug een zwart command window openen. Dit is normaal.
• Na herstart, zal het een log maken die zal openen met de resultaten van The Avenger. Deze log zal te vinden zijn op C:\avenger.txt
• The Avenger maakt ook backups aan met alle bestanden, etc., die eerder werden verwijderd door The Avenger, deze backups bevinden zich op volgende plaats: C:\avenger\backup.zip.