Archief - rustock virus

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
d

da_ghost

Legacy Member
Gelieve niet in andermans topic te posten aub.


Hey heb hetzelfde probleem met dit virus :(

de windows update boeit eigenlijk niet maar die continu reboots wel. heb die fix gedaan en hier heb je mijn logs, het probleem is dat ik nog steeds een BSOD krijg en mijn pc reboot.

************************* Rustock.b-fix v. 1.01 -- By ejvindh *************************
do 31/05/2007 15:06:41,89

******************* Pre-run Status of system *******************

Rootkit driver PE386 is found. Starting the unload-procedure....

Rustock.b-ADS attached to the System32-folder:
:lzx32.sys 78606
Total size: 78606 bytes.
Attempting to remove ADS...
system32: deleted 78606 bytes in 1 streams.

Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32


******************* Post-run Status of system *******************

Rustock.b-driver on the system: NONE!

Rustock.b-ADS attached to the System32-folder:
No System32-ADS found.

Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32


******************************* End of Logfile ********************************

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\crkbrmjy

*******************

Script file located at: \??\C:\Program Files\knugwyst.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver PE386 unloaded successfully.
Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.

Completed script processing.

*******************

Finished! Terminate.

Logfile of HijackThis v1.99.1
Scan saved at 15:23:33, on 31/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\windows\NOTEPAD.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\windows\System32\svchost.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\windows\system32\notepad.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\HighGrow\HighGrow.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\REINHI~1\LOCALS~1\Temp\Rar$EX03.672\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\jo\winstall.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [HighGrow] "C:\Program Files\HighGrow\HighGrow.exe" /A
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Ontvang alles met FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Ontvang met FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150835542203
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.singlehoteleden.ch/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{887F0367-362C-4816-A834-6523C028B2AD}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: mszsrn32 - C:\windows\system32\mszsrn32.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


mocht er eens iemand naar mijn logs willen kijken en zegen welk ik moet doen :s zit echt vast, ik probeer mijn werk te doen en elke keer dat ik een paar bladzijden heb getypt reboot die met resultaat al mijn werk kwijt :'(
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
d

da_ghost

Legacy Member
dit zijn de logs die je vroeg.


combofix.txt

"reinhilde" - 2007-05-31 20:12:31 Service Pack 2
ComboFix 07-05.27.BV - Running from: "C:\Program Files\Mozilla Firefox\"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


"C:\DOCUME~1\REINHI~1\BUREAU~1.\internet explorer.lnk"
"C:\DOCUME~1\REINHI~1\BUREAU~1\internet.lnk"
"C:\windows\system32\unsvchosts.lzma"
"C:\uniq"
"C:\Program Files\inetget2"
"C:\Program Files\Common Files\{284F7~1"


((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_NM
-------\nm


((((((((((((((((((((((((((((((( Files Created from 2007-04-28 to 2007-05-31 ))))))))))))))))))))))))))))))))))


2007-05-31 15:40 <DIR> d-------- C:\Program Files\Security Task Manager
2007-05-31 15:14 <DIR> d-------- C:\avenger
2007-05-31 15:06 <DIR> d-------- C:\Rustbfix
2007-05-29 02:11 796,672 --a------ C:\WINDOWS\GPInstall.exe
2007-05-29 02:11 <DIR> d-------- C:\Program Files\UNO Freeware
2007-05-28 15:39 <DIR> d-------- C:\Program Files\Veoh Networks
2007-05-25 21:06 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-05-25 21:06 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-05-25 21:06 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-05-25 21:06 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-05-25 21:05 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-05-25 21:05 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-05-25 21:05 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-05-25 21:05 <DIR> d-------- C:\Program Files\Alwil Software
2007-05-24 12:28 <DIR> d-------- C:\Program Files\G-Lock Software
2007-05-24 12:28 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\GetRightToGo
2007-05-23 23:22 182,272 --a------ C:\WINDOWS\patchw32.dll
2007-05-23 23:22 <DIR> d-------- C:\Program Files\ubi.com
2007-05-23 23:22 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
2007-05-23 23:15 <DIR> d-------- C:\Program Files\Red Storm Entertainment
2007-05-22 17:39 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\vlc
2007-05-22 17:33 <DIR> d-------- C:\Program Files\VideoLAN
2007-05-19 14:16 <DIR> d-a------ C:\Program Files\lastfmproxy-1.1
2007-05-18 13:24 <DIR> d-------- C:\Program Files\Picasa2
2007-05-10 20:53 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\Joost
2007-05-10 20:52 <DIR> d-------- C:\Program Files\Joost
2007-05-10 20:13 <DIR> d-------- C:\Program Files\NudgeMania
2007-05-10 17:57 <DIR> d-------- C:\Program Files\Axis Communications
2007-05-10 17:56 <DIR> d-------- C:\Program Files\DFX
2007-05-10 17:09 98,304 --a------ C:\WINDOWS\system32\ccrpucw6.dll
2007-05-10 17:08 <DIR> d-------- C:\Program Files\Winamp5
2007-05-10 15:23 <DIR> d-------- C:\Program Files\SopCast
2007-05-10 15:23 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\SopCast
2007-05-10 15:21 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\.Tribler
2007-05-10 13:46 <DIR> d-------- C:\Program Files\Tribler
2007-05-10 13:30 <DIR> d-------- C:\Program Files\GPL MPEG Decoder
2007-05-10 13:30 <DIR> d-------- C:\Program Files\AC3Filter
2007-05-10 03:06 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-10 01:04 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\DAPE
2007-05-10 01:01 <DIR> d-------- C:\Program Files\Deepnet Explorer
2007-05-10 01:01 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\Deepnet Explorer
2007-05-10 00:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\RoboForm
2007-05-10 00:54 <DIR> d-------- C:\Program Files\Siber Systems
2007-05-10 00:53 <DIR> d-------- C:\Program Files\Maxthon
2007-05-08 14:08 <DIR> d-------- C:\Program Files\Drempels
2007-05-08 14:07 <DIR> d-------- C:\Program Files\Liquidpaint
2007-05-05 15:03 <DIR> d-------- C:\Documents and Settings\reinhilde\amsn
2007-05-05 15:03 <DIR> d-------- C:\DOCUME~1\REINHI~1\amsn
2007-05-05 15:02 <DIR> d-------- C:\Program Files\aMSN
2007-05-05 12:42 <DIR> d-------- C:\Program Files\VDMSound
2007-05-05 12:07 155 --a------ C:\DelUS.bat
2007-05-04 06:34 <DIR> d-------- C:\Program Files\DOSBox-0.70
2007-05-04 05:01 <DIR> d-------- C:\Program Files\WinVorbis
2007-05-04 04:45 <DIR> d-------- C:\Program Files\winLAME
2007-05-03 19:43 <DIR> d-------- C:\Program Files\The Ur-Quan Masters
2007-05-03 19:43 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\uqm
2007-05-03 17:01 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\fretsonfire
2007-05-03 17:00 <DIR> d-------- C:\Program Files\Frets on Fire
2007-05-03 13:56 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\DivX
2007-05-03 13:46 116,472 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-05-03 13:36 <DIR> d-------- C:\Program Files\DivX
2007-05-03 13:36 <DIR> d-------- C:\Documents and Settings\reinhilde\.drdivx2
2007-05-03 13:36 <DIR> d-------- C:\DOCUME~1\REINHI~1\.drdivx2
2007-05-02 20:04 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-05-02 20:04 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-05-02 20:04 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-05-02 20:04 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-05-02 20:02 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-05-02 20:02 593,920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-05-02 20:02 57,344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-05-02 20:02 53,248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-05-02 20:02 344,064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-05-02 20:02 294,912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-05-02 20:02 294,912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-05-02 20:02 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-05-02 20:01 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-05-02 20:01 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-05-02 20:01 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-05-02 20:01 740,442 --a------ C:\WINDOWS\system32\DivX.dll
2007-05-02 13:40 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\InternetCalls
2007-05-02 04:33 124,472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-05-02 04:33 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-04-30 12:45 <DIR> d-------- C:\Program Files\InternetCalls.com
2007-04-26 15:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
2007-04-26 15:54 <DIR> d-------- C:\Program Files\Fairy Godmother Tycoon
2007-04-26 15:54 <DIR> d-------- C:\Program Files\BFG
2007-04-21 22:03 <DIR> d-------- C:\Program Files\Yahoo!
2007-04-20 02:37 630,784 --a------ C:\WINDOWS\system32\vp7vfw.dll
2007-04-20 02:37 <DIR> d-------- C:\Program Files\On2 Technologies
2007-04-20 02:19 <DIR> d-------- C:\Program Files\CallIT
2007-04-20 02:05 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\Skype
2007-04-20 02:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-04-20 02:03 <DIR> d-------- C:\Program Files\Skype
2007-04-19 10:44 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys
2007-04-19 10:44 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys
2007-04-19 10:43 18,688 --a------ C:\WINDOWS\system32\drivers\irsir.sys
2007-04-18 12:17 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\OpenOffice.org2
2007-04-17 23:16 34 --a------ C:\WINDOWS\tse.bin
2007-04-17 23:16 <DIR> d-------- C:\Program Files\Torrent Search Expert
2007-04-17 14:46 <DIR> d-------- C:\Program Files\LJConfig
2007-04-14 17:30 <DIR> d-------- C:\Program Files\Eidos Interactive
2007-04-14 15:20 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\SpamBayes
2007-04-14 15:19 <DIR> d-------- C:\Program Files\SpamBayes
2007-04-11 11:42 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\Trillian
2007-04-11 11:31 <DIR> d-------- C:\Program Files\Trillian4
2007-04-10 02:57 <DIR> d-------- C:\Program Files\InterVideo Information Service
2007-04-10 02:57 <DIR> d-------- C:\Program Files\Common Files\Ulead
2007-04-09 19:43 <DIR> d-------- C:\Program Files\Uplink
2007-04-09 19:40 <DIR> d-------- C:\Program Files\TrendyFlash Site Builder
2007-04-05 20:00 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-05 19:21 <DIR> d-------- C:\DOCUME~1\REINHI~1\APPLIC~1\Uniblue
2007-04-05 19:20 <DIR> d-------- C:\Program Files\Uniblue
2007-04-05 16:55 <DIR> d---s---- C:\DOCUME~1\LOCALS~1\UserData
2007-04-04 20:34 <DIR> d-------- C:\Program Files\Ubisoft


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-31 18:40:14 -------- d-----w C:\DOCUME~1\REINHI~1\APPLIC~1\uTorrent
2007-05-31 18:17:31 -------- d-----w C:\Program Files\FlashGet
2007-05-31 14:14:14 -------- d-----w C:\Program Files\ScummVM
2007-05-31 13:41:33 -------- d-----w C:\Program Files\Windows Live Toolbar
2007-05-29 00:00:00 -------- d-----w C:\DOCUME~1\REINHI~1\APPLIC~1\Hamachi
2007-05-28 23:51:27 25,544 ----a-w C:\windows\system32\drivers\hamachi.sys
2007-05-28 13:43:11 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-28 10:03:32 -------- d-----w C:\DOCUME~1\REINHI~1\APPLIC~1\.Tribler
2007-05-27 10:15:53 -------- d-----w C:\Program Files\Winamp
2007-05-26 21:18:28 -------- d-----w C:\Program Files\Windows Live Safety Center
2007-05-25 22:45:19 -------- d-----w C:\Program Files\Net Tools
2007-05-25 22:33:21 -------- d-----w C:\Program Files\Cain
2007-05-22 19:48:13 -------- d-----w C:\Program Files\WinPcap
2007-05-18 11:23:40 -------- d-----w C:\Program Files\Zylom Games
2007-05-05 10:41:43 -------- d-----w C:\Program Files\YoutubeCrazyVideos
2007-05-05 10:12:02 -------- d-----w C:\Program Files\MediaMonkey
2007-05-05 10:10:46 -------- d-----w C:\Program Files\Paint.NET
2007-05-05 09:48:46 -------- d-----w C:\Program Files\7-Zip
2007-05-04 23:00:13 -------- d-----w C:\Program Files\InterVideo
2007-05-04 22:56:00 -------- d-----w C:\Program Files\FileZilla
2007-05-04 22:54:11 -------- d-----w C:\DOCUME~1\REINHI~1\APPLIC~1\Vso
2007-05-04 22:54:09 81,920 ----a-w C:\DOCUME~1\REINHI~1\APPLIC~1\ezpinst.exe
2007-05-04 22:54:09 47,360 ----a-w C:\DOCUME~1\REINHI~1\APPLIC~1\pcouffin.sys
2007-05-03 16:38:10 -------- d-----w C:\DOCUME~1\REINHI~1\APPLIC~1\Free Download Manager
2007-05-02 18:04:14 118,520 ------w C:\windows\system32\pxinsi64.exe
2007-04-25 13:10:48 -------- d-----w C:\Program Files\Eidos
2007-04-18 16:15:26 2,854,400 ----a-w C:\windows\system32\msi.dll
2007-04-17 21:43:11 -------- d-----w C:\DOCUME~1\REINHI~1\APPLIC~1\LimeWire
2007-04-17 21:41:21 -------- d-----w C:\Program Files\LimeWire
2007-04-14 15:22:48 -------- d-----w C:\Program Files\VirtualDJ
2007-04-13 13:14:33 -------- d-----w C:\Program Files\Lx_cats
2007-04-12 10:59:36 -------- d-----w C:\Program Files\HighGrow
2007-04-10 00:52:52 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-04-07 21:06:49 -------- d-----w C:\DOCUME~1\REINHI~1\APPLIC~1\Screenshot Sender
2007-04-07 09:36:56 -------- d-----w C:\Program Files\Messenger Plus! Live
2007-04-07 09:36:49 -------- d-----w C:\Program Files\MSN Messenger
2007-04-06 20:44:10 -------- d-----w C:\Program Files\Google
2007-04-05 18:03:12 -------- d-----w C:\DOCUME~1\REINHI~1\APPLIC~1\Lavasoft
2007-04-05 17:58:25 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-03-30 23:01:32 0 ----a-w C:\windows\nsreg.dat
2007-03-30 12:58:59 -------- d-----w C:\Program Files\OpenOffice.org 2.0
2007-03-29 14:36:46 466,164 ----a-w C:\windows\system32\perfh013.dat
2007-03-29 14:36:45 81,578 ----a-w C:\windows\system32\perfc013.dat
2007-03-22 14:38:42 1,003,465 ----a-w C:\windows\Acount maker.exe
2007-03-22 12:06:32 84,992 ----a-w C:\windows\system32\Zoomquilt II Screensaver_uninst.exe
2007-03-17 13:45:54 293,376 ----a-w C:\windows\system32\winsrv.dll
2007-03-08 15:39:10 579,072 ----a-w C:\windows\system32\user32.dll
2007-03-08 15:39:10 40,960 ----a-w C:\windows\system32\mf3216.dll
2007-03-08 15:39:10 281,600 ----a-w C:\windows\system32\gdi32.dll
2007-03-08 15:37:59 1,843,712 ----a-w C:\windows\system32\win32k.sys
2007-03-07 23:51:00 129,784 ------w C:\windows\system32\pxafs.dll
2007-03-04 14:22:08 79 ----a-w C:\windows\popcinfo.dat
2007-03-02 10:44:45 94,208 ----a-w C:\windows\system32\zmbv.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=C:\Program Files\FlashGet\jccatch.dll [2006-12-11 18:35]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 04:25]
{F156768E-81EF-470C-9057-481BA8380DBA}=C:\Program Files\FlashGet\getflash.dll [2006-11-06 16:09]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 10:59]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 17:34]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-19 14:51]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\windows\system32\ctfmon.exe" [2004-08-04 15:00]
"HighGrow"="C:\Program Files\HighGrow\HighGrow.exe" [2005-04-19 17:26]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 12:48]
"@"="" []
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{3CF9ECE0-1A9F-11D2-8C73-00C06C2005DE}"="C:\Program Files\GPSoftware\Directory Opus\dopuslib.dll" [2006-05-07 13:14]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mszsrn32]
C:\windows\system32\mszsrn32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
C:\Program Files\HPQ\Default Settings\cpqset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
~"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
"C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pdfFactory Pro Dispatcher v3]
"C:\windows\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]
"C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vidalia]
"C:\Program Files\Vidalia\vidalia.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SDhelper"=3 (0x3)
"rpcapd"=3 (0x3)
"MsaSvc"=2 (0x2)
"iPodService"=3 (0x3)
"GFI LANguard N.S.S. 5.0 attendant service"=2 (0x2)
"svcWRSSSDK"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"NOD32krn"=2 (0x2)
"NMIndexingService"=3 (0x3)
"NBService"=3 (0x3)
"lxbu_device"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"SNDSrvc"=3 (0x3)
"SAVScan"=3 (0x3)
"pdfFactory Pro Dispatcher v3"=2 (0x2)
"NSCService"=3 (0x3)
"NProtectService"=2 (0x2)
"NPFMntor"=2 (0x2)
"Norton Ghost"=2 (0x2)
"navapsvc"=2 (0x2)
"GEARSecurity"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

*Newly Created Service* - ELBYCDIO

Contents of the 'Scheduled Tasks' folder
2007-05-01 05:15:01 C:\windows\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-31 20:45:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]


[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\BTHPORT\Parameters\Services\{00001105-0000-1000-8000-00805f9b34fb}]


[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\BTHPORT\Parameters\Services\{00001115-0000-1000-8000-00805f9b34fb}]


Completion time: 2007-05-31 20:49:53 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-31 20:49

--- E O F ---


combofix-quarantined-files.txt

Code: 
2006-06-12 00:00      767    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\REINHI~1\BUREAU~1\Internet Explorer.lnk.vir
2006-06-21 20:40      104    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\REINHI~1\BUREAU~1\Internet.lnk.vir
2006-11-24 20:31      0    --a------    C:\Qoobox\Quarantine\C\uniq.vir
2007-02-13 12:41      911    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\unsvchosts.lzma.vir
2007-05-31 20:27      1214    --a------    C:\Qoobox\Quarantine\Registry_backups\LEGACY_NM.reg.cf
2007-05-31 20:27      17658    --a------    C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.cf


Map PATH-lijst
Het volumenummer is 284F-7FB8
C:\QOOBOX
\---Quarantine
    +---C
    |   |   uniq.vir
    |   |   
    |   +---DOCUME~1
    |   |   \---REINHI~1
    |   |       \---BUREAU~1
    |   |               Internet Explorer.lnk.vir
    |   |               Internet.lnk.vir
    |   |               
    |   \---WINDOWS
    |       \---system32
    |               unsvchosts.lzma.vir
    |               
    \---Registry_backups
            LEGACY_NM.reg.cf
            services_nm.reg.cf


hijackthis.log

Logfile of HijackThis v1.99.1
Scan saved at 21:10:11, on 31/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\Explorer.EXE
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\HighGrow\HighGrow.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\windows\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\reinhilde\Bureaublad\rustock virus\hijackthis\HijackThis.exe

O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [HighGrow] "C:\Program Files\HighGrow\HighGrow.exe" /A
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Ontvang alles met FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Ontvang met FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{887F0367-362C-4816-A834-6523C028B2AD}: NameServer = 192.168.1.1,192.168.1.2
O20 - Winlogon Notify: mszsrn32 - C:\windows\system32\mszsrn32.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

En bedankt voor de moeite die je wilt doen om mij te helpen :)
J

Jurgenv1

Legacy Member
Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

C:\WINDOWS\GPInstall.exe

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje en vertel hoe alles verder werkt.
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan