Archief - msn virus logje

eb de sticky eens gevolgd vo da msn virus ier zijn de logjes

adaware :

Ad-Aware SE Build 1.06r1
Logfile Created on:dinsdag 26 juni 2007 11:41:31
Created with Ad-Aware SE Personal, free for private use.
Using definitions fileE1R177 25.06.2007
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):22 total references
Tracking Cookie(TAC index:3):2 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


26-06-2007 11:41:31 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\siemens\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\ahead\nero wave editor\recent file list
Description : list of recently used files in nero wave editor


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X


MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\mediaplayer\player\recentfilelist
Description : list of recently used files in microsoft windows media player


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\office\11.0\common\general
Description : list of recently used symbols in microsoft office


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\search assistant\acmru
Description : list of recent search terms used with the search assistant


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\windows\currentversion\applets\paint\recent file list
Description : list of files recently opened using microsoft paint


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\nico mak computing\winzip\filemenu
Description : winzip recently used archives


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\realnetworks\realplayer\6.0\preferences
Description : list of recent skins in realplayer


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\realnetworks\realplayer\6.0\preferences
Description : list of recent clips in realplayer


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\realnetworks\realplayer\6.0\preferences
Description : last login time in realplayer


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


MRU List Object Recognized!
Location: : S-1-5-21-3560790128-2929172443-1515712396-1005\software\winrar\dialogedithistory\extrpath
Description : winrar "extract-to" history


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 196
ThreadCreationTime : 26-06-2007 9:39:25
BasePriority : Normal


#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 248
ThreadCreationTime : 26-06-2007 9:39:50
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 272
ThreadCreationTime : 26-06-2007 9:39:52
BasePriority : High


#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 316
ThreadCreationTime : 26-06-2007 9:39:57
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Besturingssysteem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Services en controllertoepassingen
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. Alle rechten voorbehouden.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 328
ThreadCreationTime : 26-06-2007 9:39:57
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 460
ThreadCreationTime : 26-06-2007 9:40:02
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 540
ThreadCreationTime : 26-06-2007 9:40:04
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [guard.exe]
FilePath : C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\
ProcessID : 632
ThreadCreationTime : 26-06-2007 9:40:06
BasePriority : Normal
FileVersion : 7, 5, 1, 22
ProductVersion : 7, 5, 1, 22
ProductName : AVG Anti-Spyware
CompanyName : GRISOFT s.r.o.
FileDescription : AVG Anti-Spyware guard
InternalName : AVG Anti-Spyware guard
LegalCopyright : Copyright © 2007 GRISOFT s.r.o.
OriginalFilename : guard.exe

#:9 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 668
ThreadCreationTime : 26-06-2007 9:40:08
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 856
ThreadCreationTime : 26-06-2007 9:40:26
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Besturingssysteem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Windows Verkenner
InternalName : explorer
LegalCopyright : © Microsoft Corporation. Alle rechten voorbehouden.
OriginalFilename : EXPLORER.EXE

#:11 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
ProcessID : 1004
ThreadCreationTime : 26-06-2007 9:41:05
BasePriority : Normal
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 22


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 22


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 22


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking Cookie Object Recognized!
Type : IECache Entry
Data : siemens@real[2].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:24
Value : Cookie[email protected]/
Expires : 24-06-2008 16:36:48
LastSync : Hits:24
UseCount : 0
Hits : 24

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : siemens@metriweb[1].txt
TAC Rating : 3
Category : Data Miner
Comment : Hits:2
Value : Cookie[email protected]/
Expires : 31-05-2008 18:14:20
LastSync : Hits:2
UseCount : 0
Hits : 2

Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 2
Objects found so far: 24



Deep scanning and examining files (C
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 24


Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 24

12:09:40 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:28:09.234
Objects scanned:208933
Objects identified:2
Objects ignored:0
New critical objects:2

AVG anit spyware :
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 13:49:56 26/06/2007

+ Scan result:



C:\Program Files\WinPop\winpop.exe -> Adware.Rond : Cleaned.
C:\System Volume Information\_restore{DD1FE510-77E8-487F-94E9-02476240F307}\RP1065\A0773206.exe -> Adware.Rond : Cleaned.
C:\System Volume Information\_restore{DD1FE510-77E8-487F-94E9-02476240F307}\RP1065\A0773207.exe -> Adware.Softomate : Cleaned.
C:\WINDOWS\b122.exe -> Adware.Softomate : Cleaned.
:mozilla.168:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.169:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.170:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.171:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.172:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.173:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.174:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.175:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.548:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.549:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.706:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.282:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Billboard : Cleaned.
:mozilla.640:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.356:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.575:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.239:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.241:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.244:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.245:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.488:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.324:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.155:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.258:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.364:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.365:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.94:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Intelli-tracker : Cleaned.
C:\Documents and Settings\siemens\Cookies\[email protected][1].txt -> TrackingCookie.Live : Cleaned.
:mozilla.226:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.608:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\siemens\Cookies\[email protected][1].txt -> TrackingCookie.Msn : Cleaned.
:mozilla.339:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.340:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.325:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.149:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.150:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.151:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.152:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.153:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.154:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Real : Cleaned.
:mozilla.503:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
:mozilla.687:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.688:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.690:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.691:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.707:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.132:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.133:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.134:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.135:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.136:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.137:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.50:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.51:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.796:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Sitestat : Cleaned.
:mozilla.288:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.289:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.290:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.291:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.292:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.293:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.294:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.295:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.296:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.297:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.298:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.299:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.301:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.302:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.758:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.759:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.760:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.281:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Toplist : Cleaned.
:mozilla.227:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Tracking101 : Cleaned.
:mozilla.547:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Trafic : Cleaned.
:mozilla.147:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Weborama : Cleaned.
:mozilla.228:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.229:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.230:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.231:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.232:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.138:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.139:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.140:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.141:C:\Documents and Settings\siemens\Application Data\Mozilla\Firefox\Profiles\80u37fg9.tetn\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\WinPop\UnInstall.exe -> Trojan.Small.oa : Cleaned.
C:\System Volume Information\_restore{DD1FE510-77E8-487F-94E9-02476240F307}\RP1065\A0773205.exe -> Trojan.Small.oa : Cleaned.


::Report end

ATF logje :
"siemens" - 2007-06-26 13:58:15 - ComboFix 07-06-26.8 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\inetget2
C:\Program Files\winpop
C:\Program Files\winupdates
C:\WINDOWS\retadpu1000627.exe
C:\WINDOWS\wr.txt


((((((((((((((((((((((((( Files Created from 2007-05-26 to 2007-06-26 )))))))))))))))))))))))))))))))


2007-06-28 20:22 71,411 --a------ C:\DOCUME~1\siemens\call.exe
2007-06-28 20:22 239,715 --a------ C:\DOCUME~1\siemens\services.exe
2007-06-28 16:33 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-06-26 13:57 49,152 --a------ C:\WINDOWS\nircmd.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-29 09:13:55 -------- d-----w C:\Program Files\MSN Messenger
2007-06-28 14:37:14 -------- d-----w C:\DOCUME~1\siemens\APPLIC~1\Real
2007-06-28 14:33:11 -------- d-----w C:\Program Files\Common Files\Real
2007-06-27 19:19:51 -------- d-----w C:\Program Files\mIRC
2007-05-30 12:10:42 10,872 ----a-w C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-05-16 15:19:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-09 15:21:51 -------- d-----w C:\Program Files\Windows Live Safety Center
2007-04-29 08:02:43 -------- d-----w C:\Program Files\Real
2007-04-27 16:26:44 -------- d-----w C:\Program Files\Razer
2007-04-27 16:26:43 -------- d-----w C:\Program Files\MegauploadToolbar
2007-04-27 16:26:42 -------- d-----w C:\Program Files\ISP Monitor
2007-04-27 16:20:06 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-04-25 14:22:52 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:15:26 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-18 16:15:11 72,748 ----a-w C:\WINDOWS\unins000.exe
2007-04-18 16:15:11 653 ----a-w C:\WINDOWS\unins000.dat
2007-04-16 21:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 21:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 21:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 21:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 21:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 21:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 21:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 21:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-03 22:11:10 34,308 ----a-w C:\WINDOWS\system32\Chip.dll
2007-03-26 15:48:44 31,265 ----a-w C:\WINDOWS\system32\usvr32.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02DCA195-602B-4B1F-83FF-381B7E804BDB}=C:\WINDOWS\system32\HDBHO.dll [2003-03-27 06:37]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 08:55]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [2006-11-09 16:21]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-22 08:37]
"razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 18:21]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 12:48]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 12:12]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-03 00:02]
"WatchDog"="C:\Program Files\mobile PhoneTools\WatchDog.exe" [2004-08-14 05:42]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-28 16:32]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" []
"ares"="C:\Program Files\Ares\Ares.exe" [2006-11-12 02:02]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:03]
"Steam"="" []
"ISPMonitor"="C:\Program Files\ISP Monitor\isp.exe" [2006-05-28 02:37]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=1 (0x1)
"AllowUnhashedWebView"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 14:29]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Snelle start.lnk
backup=C:\WINDOWS\pss\Adobe Reader Snelle start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^InterVideo WinCinema Manager.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\InterVideo WinCinema Manager.lnk
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Scannerdetector.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Scannerdetector.lnk
backup=C:\WINDOWS\pss\Scannerdetector.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Ulead Acquire Fast.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Ulead Acquire Fast.lnk
backup=C:\WINDOWS\pss\Ulead Acquire Fast.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^siemens^Menu Start^Programma's^Opstarten^BitTorrent.lnk]
path=C:\Documents and Settings\siemens\Menu Start\Programma's\Opstarten\BitTorrent.lnk
backup=C:\WINDOWS\pss\BitTorrent.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^siemens^Menu Start^Programma's^Opstarten^Registration Brothers In Arms.LNK]
path=C:\Documents and Settings\siemens\Menu Start\Programma's\Opstarten\Registration Brothers In Arms.LNK
backup=C:\WINDOWS\pss\Registration Brothers In Arms.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^siemens^Menu Start^Programma's^Opstarten^Xfire.lnk]
path=C:\Documents and Settings\siemens\Menu Start\Programma's\Opstarten\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\alchem]
C:\WINDOWS\alchem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
"C:\Program Files\Ares\Ares.exe" -h

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Asoa]
C:\Documents and Settings\siemens\Application Data\oloo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\ATI-CPanel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
"C:\Program Files\CCleaner\ccleaner.exe" /AUTO

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CKnS6Fvùõš/‚²ÆßfÏC:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CKnS6Fvùõš/‚²ÆßfÏC:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CKnS6Fvùõš/‚²ÆßfÏC:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CKnS6Fvùõš/‚²ÆßfÏC:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\lhfrfvud.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClockSync]
C:\Program Files\ClockSync\Sync.exe /q

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Create A Monster]
"C:\Program Files\Kudd.com\createAMonster.exe" -run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dbjmrn]
C:\Program Files\Wwpvmoc\Fttqi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Glass2k]
C:\Program Files\Glass2k\Glass2k.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hmjxlhloecar]
C:\WINDOWS\System32\whbzeaw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Instant Access]
rundll32.exe p2esocks_1022.dll,InstantAccess

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
"C:\Program Files\Internet Optimizer\optimize.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IST Service]
C:\Program Files\ISTsvc\istsvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock]
C:\Program Files\LClock\LClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
"C:\Program Files\MSN Apps\Updater\01.02.3000.1001\nl-be\msnappau.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pqbif]
C:\WINDOWS\pqbif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sais]
c:\program files\180solutions\sais.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search-Exe]
"C:\Program Files\se\v11\se.EXE" /H

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock]
C:\Program Files\Clock Tray Skins\ClockTraySkins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
"C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"c:\program files\valve\steam\steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\V9au]
C:\WINDOWS\diluf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\warez]
"C:\Program Files\Warez\Warez.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Update]
C:\WINDOWS\System32\uwnrapy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinLogon]
C:\WINDOWS\logon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates]
C:\Program Files\winupdates\winupdates.exe /auto

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wizard]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wlgws]
C:\WINDOWS\System32\??xplore.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]*ú"ü‰¸u0C:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]*ú"ü‰¸u0C:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]*ú"ü‰¸u0C:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]*ú"ü‰¸u0C:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\diluf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]*ú"ü‰üžiC:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]*ú"ü‰üžiC:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]*ú"ü‰üžiC:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]*ú"ü‰üžiC:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\diluf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0ÔÁß]*ú"ü‰üžigÝC:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0ÔÁß]*ú"ü‰üžigÝC:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0ÔÁß]*ú"ü‰üžigÝC:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0ÔÁß]*ú"ü‰üžigÝC:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\diluf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C]
C:\WINDOWS\diluf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C]
C:\WINDOWS\diluf.exe


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1EC46E4A-F3A8-0E0B-0800-060000000700}
C:\WINDOWS\system32\usvr32.exe

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

Contents of the 'Scheduled Tasks' folder
2007-06-28 11:27:00 C:\WINDOWS\tasks\WebReg 20050831132759.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-26 14:03:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\drivers\MFX.sys

scan completed successfully
hidden files: 1

**************************************************************************

Completion time: 2007-06-26 14:04:37
C:\ComboFix-quarantined-files.txt ... 2007-06-26 14:04

--- E O F ---


hijack logje :
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:05:26, on 26/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\mobile PhoneTools\WatchDog.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISP Monitor\isp.exe
C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\siemens\Bureaublad\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.imesh.com/intl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl-be\msntb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISPMonitor] C:\Program Files\ISP Monitor\isp.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: SANTIS USB and PC Card Utility.lnk = C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.0.0.59.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
O16 - DPF: {8048671E-C35D-42A3-A5EE-1E84ADB91C59} - http://www.ipxs.nl/php/ipxs.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\System32\UAService7.exe

--
End of file - 8522 bytes
voila beetje veel mo swoit

* Je Java software is verouderd.
Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.
Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

Download Java Runtime Environment (JRE) 6u1.

• Scroll omlaag naar : "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Klik op de "Download" knop aan de rechterkant.
• Vink aan: "Accept License Agreement".
• De pagina zal herladen.
• Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen, en bewaar het naar je Bureaublad.
• Sluit alle programma's die eventueel open zijn - Zeker je web browser!
• Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.
• Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
• Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
• Herhaal dit tot alle oudere versies verdwenen zijn.
• Na het verwijderen van alle oudere versies, herstart je pc.
• Dubbelklik vervolgens op jre-6u1-windows-i586-p.exe op je Bureaublad om de nieuwste versie van Java te installeren.

* Ik raad je aan Ares te deïnstalleren: http://p2p.malwareremoval.com/index.html

* Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

C:\WINDOWS\alchem.exe
C:\Program Files\Wwpvmoc
C:\WINDOWS\System32\whbzeaw.exe
C:\Program Files\Internet Optimizer
C:\Program Files\ISTsvc
C:\Program Files\winupdates
C:\WINDOWS\pqbif.exe
c:\program files\180solutions
C:\Program Files\se
C:\WINDOWS\diluf.exe
C:\Program Files\Warez
C:\WINDOWS\System32\uwnrapy.exe
C:\WINDOWS\logon.exe

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht

* Open Kladblok.
Kopieer de onderstaande vetgedrukte tekst en plak deze in een nieuw document.


Kies Bestand -> Opslaan
Selecteer bij "Opslaan in": Bureaublad
Vul bij "Bestandsnaam" in: servicefix.reg
Selecteer bij "Opslaan als type": Alle bestanden
Klik op "Opslaan".

Dubbelklik op servicefix.reg, dat nu op je bureaublad staat.
Ga ermee akkoord dat deze gegevens aan het register worden toegevoegd.

* Laat ATF cleaner nog eens runnen.

* Herstart dan je pc en post een nieuw hijackthis logje hier met het rapport van OTMoveIt en vertle hoe alles verder werkt.

hi jack logje :
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:00:50, on 26/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\UAService7.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Razer\razerhid.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\mobile PhoneTools\WatchDog.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISP Monitor\isp.exe
C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\Razer\razerofa.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\siemens\Bureaublad\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.imesh.com/intl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\nl-be\msntb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\mobile PhoneTools\WatchDog.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISPMonitor] C:\Program Files\ISP Monitor\isp.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: SANTIS USB and PC Card Utility.lnk = C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O10 - Unknown file in Winsock LSP: xfire_lsp_11078.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.0.0.59.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
O16 - DPF: {8048671E-C35D-42A3-A5EE-1E84ADB91C59} - http://www.ipxs.nl/php/ipxs.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\System32\UAService7.exe

--
End of file - 9008 bytes


OTMoveit rapport:
File/Folder C:\WINDOWS\alchem.exe not found.
File/Folder C:\Program Files\Wwpvmoc not found.
File/Folder C:\WINDOWS\System32\whbzeaw.exe not found.
File/Folder C:\Program Files\Internet Optimizer not found.
File/Folder C:\Program Files\ISTsvc not found.
File/Folder C:\Program Files\winupdates not found.
File/Folder C:\WINDOWS\pqbif.exe not found.
File/Folder c:\program files\180solutions not found.
File/Folder C:\Program Files\se not found.
File/Folder C:\WINDOWS\diluf.exe not found.
C:\Program Files\Warez\Protocols moved successfully.
C:\Program Files\Warez\plug-ins\warezrip moved successfully.
C:\Program Files\Warez\plug-ins moved successfully.
C:\Program Files\Warez\Media moved successfully.
C:\Program Files\Warez\log moved successfully.
C:\Program Files\Warez\Lang moved successfully.
C:\Program Files\Warez moved successfully.
File/Folder C:\WINDOWS\System32\uwnrapy.exe not found.
File/Folder C:\WINDOWS\logon.exe not found.

Created on 06/26/2007 16:46:47


alles werkt cv behalve da alles van objectdock na de reet is ma das nie erg ma wa ares betreft in die link van jouw staat da da bij save dus zou da mogen blijven staan om "legale"(en soms illegaal ) software te downen.

hippestijn zei:

alles werkt cv behalve da alles van objectdock na de reet is ma das nie erg ma wa ares betreft in die link van jouw staat da da bij save dus zou da mogen blijven staan om "legaale"(en soms illegaal ) software te downen.

Klik om te vergroten...

Legale is met 1 'a'

ola onze taalpurist laat van hem horen
bij deze met een "atje" minder

Ah, moet dan onlangs bij safe geplaatst zijn. My bad.


Probeer dan Objectdock te herinstalleren.