Archief - msspa.exe

Op aanraden van iemand post ik hier een log.
Tijdens het opstarten van windows krijg ik een foutmelding van msspa.exe
Heb even gegoogled en vind niks over dit bestand.
Heb het bestand wel gevonden in de \system32 en in de \windows\prefetch.

Hier de log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:35, on 30/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
G:\Program Files\Eset\nod32kui.exe
G:\Program Files\Common Files\Symantec Shared\ccApp.exe
G:\Program Files\Norton Ghost\Agent\GhostTray.exe
G:\WINDOWS\CTHELPER.EXE
G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
G:\Program Files\Logitech\iTouch\iTouch.exe
G:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
G:\Program Files\PowerISO\PWRISOVM.EXE
G:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\Program Files\Winamp\winampa.exe
G:\WINDOWS\system32\oodtray.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Messenger\msmsgs.exe
G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
G:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
G:\WINDOWS\System32\GEARSec.exe
G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
G:\Program Files\Eset\nod32krn.exe
G:\Program Files\Norton Ghost\Agent\VProSvc.exe
G:\WINDOWS\system32\oodag.exe
G:\WINDOWS\system32\perfs.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\wdfmgr.exe
G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
G:\Program Files\Canon\CAL\CALMAIN.exe
G:\WINDOWS\System32\alg.exe
G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
G:\Program Files\Spyware Doctor\svcntaux.exe
G:\Program Files\Spyware Doctor\swdsvc.exe
G:\Program Files\Spyware Doctor\SDTrayApp.exe
G:\Program Files\BitLord\BitLord.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe
G:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - G:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [JMB36X Configure] G:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] G:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AsusServiceProvider] G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [nod32kui] "G:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "G:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [zBrowser Launcher] G:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] G:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "G:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] G:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OODefragTray] G:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [SDTray] "G:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LaunchList] G:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = G:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://G:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - G:\Documents and Settings\Zibro\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - G:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "G:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - G:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - G:\WINDOWS\System32\GEARSec.exe
O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
O23 - Service: NBService - Nero AG - G:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - G:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Ghost - Symantec Corporation - G:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - G:\WINDOWS\system32\oodag.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - G:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: perfmons Service (perfmons) - Unknown owner - G:\WINDOWS\system32\perfs.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\RpcSandraSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - G:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - G:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9621 bytes

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

resultaat van combofix:

ComboFix 07-09-21.2 - "Zibro" 2007-10-01 18:34:05.1 - NTFSx86
Microsoft Windows XP Professional [GMT 2:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

G:\WINDOWS\system32\config\SAM.SAV

.
((((((((((((((((((((((((( Files Created from 2007-09-01 to 2007-10-01 )))))))))))))))))))))))))))))))
.

2007-10-01 18:32 51,200 --a------ G:\WINDOWS\NirCmd.exe
2007-09-30 19:57 <DIR> d-------- G:\Program Files\Trend Micro
2007-09-30 19:47 79,688 --a------ G:\WINDOWS\system32\drivers\iksyssec.sys
2007-09-30 19:47 626,688 --a------ G:\WINDOWS\system32\msvcr80.dll
2007-09-30 19:47 62,280 --a------ G:\WINDOWS\system32\drivers\iksysflt.sys
2007-09-30 19:47 41,288 --a------ G:\WINDOWS\system32\drivers\ikfilesec.sys
2007-09-30 19:47 29,000 --a------ G:\WINDOWS\system32\drivers\kcom.sys
2007-09-30 19:47 <DIR> d-------- G:\Program Files\Spyware Doctor
2007-09-30 19:47 <DIR> d-------- G:\DOCUME~1\Zibro\APPLIC~1\PC Tools
2007-09-29 17:07 <DIR> d-------- G:\DOCUME~1\LOCALS~1\APPLIC~1\Real
2007-09-21 17:30 <DIR> d-------- G:\Program Files\IMVU
2007-09-21 17:30 <DIR> d-------- G:\DOCUME~1\Zibro\APPLIC~1\IMVU
2007-09-19 19:56 168,448 --a------ G:\WINDOWS\system32\perfmonss.exe
2007-09-19 19:56 <DIR> d-------- G:\Program Files\MagicISO
2007-09-16 20:32 <DIR> d-------- G:\WINDOWS\system32\oodag
2007-09-16 20:13 <DIR> d-------- G:\Program Files\OO Software
2007-09-16 19:51 <DIR> d-a------ G:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-09-16 19:51 <DIR> d-------- G:\Program Files\BinarySense
2007-09-16 19:51 <DIR> d-------- G:\DOCUME~1\Zibro\APPLIC~1\BinarySense
2007-09-14 20:01 82,432 --a------ G:\WINDOWS\system32\msxml4r.dll
2007-09-14 20:01 44,544 --a------ G:\WINDOWS\system32\msxml4a.dll
2007-09-14 20:01 401,408 --a------ G:\WINDOWS\system32\pvmjpg30.dll
2007-09-14 20:01 1,230,336 --a------ G:\WINDOWS\system32\msxml4.dll
2007-09-14 19:58 57,856 --a------ G:\WINDOWS\system32\masd32.dll
2007-09-14 19:58 27,648 --a------ G:\WINDOWS\system32\ma32.dll
2007-09-14 19:58 196,096 --a------ G:\WINDOWS\system32\macd32.dll
2007-09-14 19:58 138,752 --a------ G:\WINDOWS\system32\mase32.dll
2007-09-14 19:58 136,192 --a------ G:\WINDOWS\system32\mamc32.dll
2007-09-14 19:56 41,219 --a------ G:\WINDOWS\RSETPATH.exe
2007-09-14 19:55 49,152 --a------ G:\WINDOWS\system32\PCLEGetGuid.dll
2007-09-14 19:53 <DIR> d-------- G:\Program Files\Pinnacle
2007-09-14 19:46 <DIR> d-------- G:\WINDOWS\SxsCaPendDel
2007-09-14 11:10 51,328 --a--c--- G:\WINDOWS\system32\dllcache\msdv.sys
2007-09-14 11:10 51,328 --a------ G:\WINDOWS\system32\drivers\msdv.sys
2007-09-14 11:09 48,128 --a--c--- G:\WINDOWS\system32\dllcache\61883.sys
2007-09-14 11:09 48,128 --a------ G:\WINDOWS\system32\drivers\61883.sys
2007-09-14 11:09 38,912 --a--c--- G:\WINDOWS\system32\dllcache\avc.sys
2007-09-14 11:09 38,912 --a------ G:\WINDOWS\system32\drivers\avc.sys
2007-09-13 23:05 <DIR> d-------- G:\DOCUME~1\Zibro\Contacts
2007-09-13 23:04 <DIR> d----c--- G:\WINDOWS\system32\DRVSTORE
2007-09-11 13:16 1,712,128 --a------ G:\WINDOWS\system32\GDIPLUS.DLL
2007-09-11 13:11 84,992 --a------ G:\WINDOWS\system32\ATL70.DLL
2007-09-11 13:10 14,165 --a------ G:\WINDOWS\system32\drivers\Pclepci.sys
2007-09-11 13:09 171,520 --a------ G:\WINDOWS\system32\drivers\MarvinBus.sys
2007-09-11 13:07 <DIR> d-------- G:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle Studio
2007-09-11 13:03 <DIR> d-------- G:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle
2007-09-02 14:04 <DIR> d-------- G:\Program Files\Common Files\DirectX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-01 15:01 --------- d-------- G:\DOCUME~1\Zibro\APPLIC~1\The Bat!
2007-09-19 20:37 --------- d-------- G:\DOCUME~1\Zibro\APPLIC~1\LimeWire
2007-09-14 19:54 --------- d--h----- G:\Program Files\InstallShield Installation Information
2007-09-13 23:05 --------- d-------- G:\Program Files\MSN Messenger
2007-08-18 16:54 --------- d-------- G:\DOCUME~1\Zibro\APPLIC~1\ZoomBrowser EX
2007-08-18 16:54 --------- d-------- G:\DOCUME~1\ALLUSE~1\APPLIC~1\ZoomBrowser
2007-08-15 15:17 --------- d-------- G:\Program Files\Medieval Software
2007-08-11 20:19 --------- d-------- G:\Program Files\Creative
2006-06-23 08:48 32768 -ra------ G:\WINDOWS\inf\UpdateUSB.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X Configure"="G:\WINDOWS\system32\JMRaidTool.exe" [2006-06-02 10:45]
"NeroFilterCheck"="G:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
"AsusServiceProvider"="G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe" [2006-08-03 11:25]
"Ai Nap"="G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" [2006-08-31 17:01]
"nod32kui"="G:\Program Files\Eset\nod32kui.exe" [2006-12-13 20:00]
"ccApp"="G:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 16:30]
"Norton Ghost 10.0"="G:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-09-09 20:09]
"CTHelper"="CTHELPER.EXE" [2006-08-11 15:56 G:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 15:56 G:\WINDOWS\system32\CTXFIHLP.EXE]
"HPDJ Taskbar Utility"="G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-11-10 21:20]
"zBrowser Launcher"="G:\Program Files\Logitech\iTouch\iTouch.exe" [2004-03-18 10:33]
"SunJavaUpdateSched"="G:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07]
"PWRISOVM.EXE"="G:\Program Files\PowerISO\PWRISOVM.EXE" [2006-03-18 04:24]
"QuickTime Task"="G:\Program Files\QuickTime Alternative\qttask.exe" [2006-09-01 16:57]
"ATICCC"="G:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 10:12]
"GrooveMonitor"="G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47]
"TkBellExe"="G:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-12-28 21:31]
"WinampAgent"="G:\Program Files\Winamp\winampa.exe" [2006-11-21 19:38]
"OODefragTray"="G:\WINDOWS\system32\oodtray.exe" [2007-05-11 02:08]
"SDTray"="G:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-09-20 15:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="G:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
"MSMSGS"="G:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:56]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 20:04]
"LaunchList"="G:\Program Files\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 15:41]

G:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Snelle start.lnk - G:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]

G:\DOCUME~1\Zibro\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

R0 JGOGO;JMicron Hot-Plug Driver;G:\WINDOWS\system32\DRIVERS\JGOGO.sys
R0 JRAID;JRAID;G:\WINDOWS\system32\DRIVERS\jraid.sys
R1 V2IMount;V2IMount;G:\WINDOWS\system32\drivers\V2IMount.sys
R2 HDDlife HDD Access service;HDDlife HDD Access service;"G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe"
R2 perfmons;perfmons Service;G:\WINDOWS\system32\perfs.exe
R3 LCcfltr;Logitech USB Filter Driver;G:\WINDOWS\system32\Drivers\LCcFltr.Sys
R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;G:\WINDOWS\system32\DRIVERS\RTL8029.SYS
S3 itchfltr;iTouch Keyboard Filter;G:\WINDOWS\system32\DRIVERS\itchfltr.sys
S3 RTCore32;RTCore32;\??\G:\DOCUME~1\Zibro\LOCALS~1\Temp\Rar$EX00.656\RTCore32.sys
S3 SenFiltService;SenFilt Service;G:\WINDOWS\system32\drivers\Senfilt.sys

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-01 18:35:44
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-01 18:36:22
G:\ComboFix-quarantined-files.txt ... 2007-10-01 18:36
.
--- E O F ---



hijackthislog:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:38:54, on 1/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
G:\Program Files\Eset\nod32kui.exe
G:\Program Files\Common Files\Symantec Shared\ccApp.exe
G:\Program Files\Norton Ghost\Agent\GhostTray.exe
G:\WINDOWS\CTHELPER.EXE
G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
G:\Program Files\Logitech\iTouch\iTouch.exe
G:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
G:\Program Files\PowerISO\PWRISOVM.EXE
G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
G:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\Program Files\Winamp\winampa.exe
G:\WINDOWS\system32\oodtray.exe
G:\Program Files\Spyware Doctor\SDTrayApp.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Messenger\msmsgs.exe
G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
G:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
G:\WINDOWS\System32\GEARSec.exe
G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
G:\Program Files\Eset\nod32krn.exe
G:\Program Files\Norton Ghost\Agent\VProSvc.exe
G:\WINDOWS\system32\oodag.exe
G:\WINDOWS\system32\perfs.exe
G:\Program Files\Spyware Doctor\svcntaux.exe
G:\Program Files\Spyware Doctor\swdsvc.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\wdfmgr.exe
G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
G:\Program Files\Canon\CAL\CALMAIN.exe
G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
G:\WINDOWS\System32\alg.exe
G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
G:\WINDOWS\explorer.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe
G:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - G:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [JMB36X Configure] G:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] G:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AsusServiceProvider] G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [nod32kui] "G:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "G:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [zBrowser Launcher] G:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] G:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "G:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] G:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OODefragTray] G:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [SDTray] "G:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LaunchList] G:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = G:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://G:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - G:\Documents and Settings\Zibro\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - G:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "G:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - G:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - G:\WINDOWS\System32\GEARSec.exe
O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
O23 - Service: NBService - Nero AG - G:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - G:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Ghost - Symantec Corporation - G:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - G:\WINDOWS\system32\oodag.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - G:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: perfmons Service (perfmons) - Unknown owner - G:\WINDOWS\system32\perfs.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\RpcSandraSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - G:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - G:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9582 bytes

Deze mag je nog fixen in hijackthis:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

* Je Java software is verouderd.
Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.
Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

Download Java Runtime Environment (JRE) 6u2.

• Scroll omlaag naar : "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Klik op de "Download" knop aan de rechterkant.
• Vink aan: "Accept License Agreement".
• De pagina zal herladen.
• Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen, en bewaar het naar je Bureaublad.
• Sluit alle programma's die eventueel open zijn - Zeker je web browser!
• Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.
• Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
• Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
• Herhaal dit tot alle oudere versies verdwenen zijn.
• Na het verwijderen van alle oudere versies, herstart je pc.
• Dubbelklik vervolgens op jre-6u2-windows-i586-p.exe op je Bureaublad om de nieuwste versie van Java te installeren.

Vertel dan hoe alles verder werkt.

Nog altijd hetzelfde. Soms onmiddelijk na het opstarten, soms na een paar minuten komt de msspa.exe error tevoorschijn.

Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

G:\WINDOWS\system32\perfmonss.exe

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje.

G:\WINDOWS\system32\perfmonss.exe moved successfully.

Created on 10/02/2007 22:27:28

********************************************
hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:05, on 2/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
G:\Program Files\Eset\nod32kui.exe
G:\Program Files\Common Files\Symantec Shared\ccApp.exe
G:\Program Files\Norton Ghost\Agent\GhostTray.exe
G:\WINDOWS\CTHELPER.EXE
G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
G:\Program Files\Logitech\iTouch\iTouch.exe
G:\Program Files\PowerISO\PWRISOVM.EXE
G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
G:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\Program Files\Winamp\winampa.exe
G:\WINDOWS\system32\oodtray.exe
G:\Program Files\Spyware Doctor\SDTrayApp.exe
G:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Messenger\msmsgs.exe
G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
G:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
G:\WINDOWS\System32\GEARSec.exe
G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
G:\Program Files\Eset\nod32krn.exe
G:\WINDOWS\system32\oodag.exe
G:\WINDOWS\system32\perfs.exe
G:\Program Files\Spyware Doctor\svcntaux.exe
G:\Program Files\Spyware Doctor\swdsvc.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\wdfmgr.exe
G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
G:\Program Files\Canon\CAL\CALMAIN.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
G:\WINDOWS\System32\alg.exe
G:\Program Files\Norton Ghost\Agent\VProSvc.exe
G:\Program Files\The Bat!\thebat.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe
G:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - G:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [JMB36X Configure] G:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] G:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AsusServiceProvider] G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [nod32kui] "G:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "G:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [zBrowser Launcher] G:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] G:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "G:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] G:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OODefragTray] G:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [SDTray] "G:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LaunchList] G:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = G:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://G:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - G:\Documents and Settings\Zibro\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - G:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "G:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - G:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - G:\WINDOWS\System32\GEARSec.exe
O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
O23 - Service: NBService - Nero AG - G:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - G:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Ghost - Symantec Corporation - G:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - G:\WINDOWS\system32\oodag.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - G:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: perfmons Service (perfmons) - Unknown owner - G:\WINDOWS\system32\perfs.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\RpcSandraSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - G:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - G:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9409 bytes

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Herstart dan je pc en kijk of het gebeterd is.

nog steeds dezelfde foutmelding.

Heb net eens spyware doctor geinstalleerd en hij heeft deze trojan gevonden:
Trojan-PWS.Tanspy

in registersleutel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\load

zou het dit misschien kunnen zijn en kan ik dat veilig verwijderen zonder brokken?

Ik kheb hetzelfde aan de hand bij mijn vista.
Maar ik ga nieuwe thread maken voor een goed overzicht...

Ga naar start==>uitvoeren==>typ:


Druk dan op Enter. Ga dan naar je C: schijf en open daar het kladblokbestand: export.txt en post de inhoud erva,n hier.

bedankt jurgen voor al de moeite. Heb gisteren die trojan verwijderd waar ik het over had en het probleem lijkt nu opgelost te zijn.

Graag gedaan.

hmm nog steeds niet dus. Na 2 dagen afwezigheid is het er nu terug. Ik merk geen mankementen ik krijg gewoon die ene foutmelding die ik wegklik en verder niets.

Toon toch even een screenshot.

gewoon een plain windows foutmelding schermpje ziehier

Ga naar http://www.virustotal.com/nl/ en upload het volgend bestandje:

G:\WINDOWS\system32\perfs.exe

Post het resultaat hier.

wel wel


Bestand perfs.exe ontvangen op 2007.10.07 13:53:18 (CET)

Resultaat: 15/32 (46.88%)



Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2007.10.6.0 2007.10.05 -
AntiVir 7.6.0.20 2007.10.05 TR/Dldr.Agent.drw
Authentium 4.93.8 2007.10.05 -
Avast 4.7.1051.0 2007.10.06 -
AVG 7.5.0.488 2007.10.07 Downloader.Agent.TJE
BitDefender 7.2 2007.10.07 Trojan.Delf.OTF
CAT-QuickHeal 9.00 2007.10.06 TrojanDownloader.Agent.drw
ClamAV 0.91.2 2007.10.07 -
DrWeb 4.44.0.09170 2007.10.07 -
eSafe 7.0.15.0 2007.10.04 Win32.Agent.drw
eTrust-Vet 31.2.5190 2007.10.06 Win32/VMalum.ADUZ
Ewido 4.0 2007.10.07 -
FileAdvisor 1 2007.10.07 -
Fortinet 3.11.0.0 2007.10.07 W32/AdCli.A!tr.dldr
F-Prot 4.3.2.48 2007.10.06 -
F-Secure 6.70.13030.0 2007.10.06 Trojan-Downloader.Win32.Agent.drw
Ikarus T3.1.1.12 2007.10.07 Trojan.Delf.OTF
Kaspersky 7.0.0.125 2007.10.07 Trojan-Downloader.Win32.Agent.drw
McAfee 5135 2007.10.05 -
Microsoft 1.2908 2007.10.07 -
NOD32v2 2576 2007.10.07 -
Norman 5.80.02 2007.10.05 -
Panda 9.0.0.4 2007.10.06 Trj/Downloader.MDW
Prevx1 V2 2007.10.07 Malware.Gen
Rising 19.43.60.00 2007.10.07 -
Sophos 4.22.0 2007.10.07 Troj/AdCli-A
Sunbelt 2.2.907.0 2007.10.06 -
Symantec 10 2007.10.07 -
TheHacker 6.2.6.078 2007.10.06 -
VBA32 3.12.2.4 2007.10.07 Trojan-Downloader.Win32.Agent.drw
VirusBuster 4.3.26:9 2007.10.06 -
Webwasher-Gateway 6.0.1 2007.10.05 Trojan.Dldr.Agent.drw

Ga naar start==>uitvoeren==>typ: sc stop perfmons
en klik op 'ok'

Ga dan terug naar Uitvoeren en typ nu: sc delete perfmons

Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

G:\WINDOWS\system32\perfs.exe

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje.

G:\WINDOWS\system32\perfs.exe moved successfully.

Created on 10/08/2007 22:49:59

***********************************************************


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:52:07, on 8/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
G:\WINDOWS\System32\GEARSec.exe
G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
G:\Program Files\Eset\nod32krn.exe
G:\Program Files\Norton Ghost\Agent\VProSvc.exe
G:\WINDOWS\system32\oodag.exe
G:\WINDOWS\system32\perfs.exe
G:\Program Files\Spyware Doctor\svcntaux.exe
G:\Program Files\Spyware Doctor\swdsvc.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\wdfmgr.exe
G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
G:\Program Files\Canon\CAL\CALMAIN.exe
G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
G:\WINDOWS\System32\alg.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
G:\Program Files\Eset\nod32kui.exe
G:\Program Files\Common Files\Symantec Shared\ccApp.exe
G:\Program Files\Norton Ghost\Agent\GhostTray.exe
G:\WINDOWS\CTHELPER.EXE
G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
G:\Program Files\Logitech\iTouch\iTouch.exe
G:\Program Files\PowerISO\PWRISOVM.EXE
G:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\Program Files\Winamp\winampa.exe
G:\WINDOWS\system32\oodtray.exe
G:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
G:\Program Files\Spyware Doctor\SDTrayApp.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Messenger\msmsgs.exe
G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
G:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\The Bat!\thebat.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe
G:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - G:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [JMB36X Configure] G:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NeroFilterCheck] G:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AsusServiceProvider] G:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe
O4 - HKLM\..\Run: [Ai Nap] "G:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [nod32kui] "G:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "G:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] G:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [zBrowser Launcher] G:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] G:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "G:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] G:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [OODefragTray] G:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "G:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "G:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LaunchList] G:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = G:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://G:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - G:\Documents and Settings\Zibro\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - G:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "G:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - G:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - G:\WINDOWS\System32\GEARSec.exe
O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - G:\Program Files\BinarySense\HDDlife 3\hldasvc.exe
O23 - Service: NBService - Nero AG - G:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - G:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Ghost - Symantec Corporation - G:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - G:\WINDOWS\system32\oodag.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - G:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Pro Home 2007.SP1\RpcSandraSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - G:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - G:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9403 bytes