Archief - trojan horse...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:33:09, on 14/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Belgium Identity Card\beidsystemtray.exe
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Mozilla Firefox\firefox.exe
I:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hoehel.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.aldi.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8888; https=127.0.0.1:8888
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [beidsystemtray] C:\Program Files\Belgium Identity Card\beidsystemtray.exe
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [LSA Shellu] C:\Documents and Settings\Papa\lsass.exe
O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll" DllInit
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.telenet.be
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: McAfee.com AV Engine (AsEngine) - Unknown owner - C:\WINDOWS\mcbin\av\rt\asengine.exe (file missing)
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VmVybWVpcmUgQmFydA\command.exe (file missing)
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: eID CRL Service - Zetes - C:\WINDOWS\system32\beidservicecrl.exe
O23 - Service: eID Privacy Service - Zetes - C:\WINDOWS\system32\beidservicepcsc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7620 bytes

* Download en bewaar SDFix
op je bureaublad.

Dubbelklik op SDFix.exe en kies voor Install om het tooltje uit te pakken in een eigen map op je bureaubad. Herstart dan je pc in Veilige modus

• In veilige modus, open de SDFix map op je bureaublad en dubbelklik op RunThis.bat om het tooltje te starten.
• Typ Y om het clean proces te starten.
• het verwijdert alle Trojan Services of Registry Entries die met deze infectie te maken hebben, als het tooltje klaar is zal het jou vertellen om eender welke toets te drukken om je pc te herstarten, doe dit ook.
• Wanneer de pc herstart zal het tooltje opnieuw runnen en het opruimproces beëindigen en je de melding Finished tonen, druk dan op eender welke toets om het scriptje te beëindigen en je bureaublad zullen tevoorschijn komen.
• Wanneer je bureaublad icoontjes verschijnen zal het rapportje van SDFix openen en ook in de map bewaren onder de naam Report.txt.
• Kopieer en plak nu de inhoud van dat rapportje hier met een nieuw hijackthis logje.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:28:00, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Belgium Identity Card\beidsystemtray.exe
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
I:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hoehel.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.aldi.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8888; https=127.0.0.1:8888
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [beidsystemtray] C:\Program Files\Belgium Identity Card\beidsystemtray.exe
O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll" DllInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{1B-B6-6B-B8-DW}] C:\WINDOWS\system32\dtmp\cegmgr76.exe DWram
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\dtmp\cegmgr76.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.telenet.be
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: McAfee.com AV Engine (AsEngine) - Unknown owner - C:\WINDOWS\mcbin\av\rt\asengine.exe (file missing)
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: eID CRL Service - Zetes - C:\WINDOWS\system32\beidservicecrl.exe
O23 - Service: eID Privacy Service - Zetes - C:\WINDOWS\system32\beidservicepcsc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7718 bytes



SDFix: Version 1.171
Run by Stijn on di 15/04/2008 at 18:41

Microsoft Windows XP [versie 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
cmdService
Network Monitor

Path :
C:\WINDOWS\VmVybWVpcmUgQmFydA\command.exe
C:\Program Files\Network Monitor\netmon.exe service

cmdService - Deleted
Network Monitor - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\VmVybWVpcmUgQmFydA\asappsrv.dll - Deleted
C:\WINDOWS\VmVybWVpcmUgQmFydA\pApVvqpDwAo0kAIVxE.vbs - Deleted
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt - Deleted
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt - Deleted
C:\Temp\1cb\syscheck.log - Deleted
C:\Program Files\Network Monitor\netmon.exe - Deleted
C:\WINDOWS\Fonts\Setup.exe - Deleted
C:\WINDOWS\smdat32a.sys - Deleted
C:\WINDOWS\system32\atmtd.dll - Deleted
C:\WINDOWS\system32\atmtd.dll._ - Deleted
C:\WINDOWS\system32\msnav32.ax - Deleted
C:\WINDOWS\system32\pac.txt - Deleted
C:\WINDOWS\uninstall_nmon.vbs - Deleted



Folder C:\Program Files\Network Monitor - Removed
Folder C:\Documents and Settings\LocalService\Application Data\NetMon - Removed
Folder C:\Temp\1cb - Removed
Folder C:\WINDOWS\Fonts\' - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-16 07:42:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:53,2c,69,f1,99,fd,06,4c,94,3b,74,49,79,85,0b,36,b8,f2,80,a9,73,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ad,77,4d,31,b3,a8,79,6d,0a,c4,a3,fb,1c,8f,54,9f,58,d0,56,f1,73,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,d9,f7,1a,d5,26,92,09,5c,29,2d,7f,ce,27,fc,dd,3f,ef,..
"khjeh"=hex:3a,7f,7f,6a,42,31,59,da,20,3b,14,e9,6a,b6,08,eb,04,b2,d2,3e,b4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1d,88,cf,32,1f,79,24,ac,6a,2b,86,7b,38,46,34,1a,2a,57,7c,c3,ab,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:30,7a,34,52,70,84,44,cf,1e,82,26,2b,4b,bd,59,81,ae,fc,43,ea,16,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:00,80,a7,de,e3,7f,ef,5f,f8,70,56,b8,1c,40,d7,a6,a6,99,5c,7f,44,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:c3,3a,60,50,72,f4,e2,c8,de,d0,2a,dc,2e,16,46,e5,f0,a9,af,75,a6,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:c8409d82
"s1"=dword:e595cfea
"s2"=dword:83a74677
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:53,2c,69,f1,99,fd,06,4c,94,3b,74,49,79,85,0b,36,b8,f2,80,a9,73,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ad,77,4d,31,b3,a8,79,6d,0a,c4,a3,fb,1c,8f,54,9f,58,d0,56,f1,73,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,d9,f7,1a,d5,26,92,09,5c,29,2d,7f,ce,27,fc,dd,3f,ef,..
"khjeh"=hex:3a,7f,7f,6a,42,31,59,da,20,3b,14,e9,6a,b6,08,eb,04,b2,d2,3e,b4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1d,88,cf,32,1f,79,24,ac,6a,2b,86,7b,38,46,34,1a,2a,57,7c,c3,ab,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:30,7a,34,52,70,84,44,cf,1e,82,26,2b,4b,bd,59,81,ae,fc,43,ea,16,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:00,80,a7,de,e3,7f,ef,5f,f8,70,56,b8,1c,40,d7,a6,a6,99,5c,7f,44,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:c3,3a,60,50,72,f4,e2,c8,de,d0,2a,dc,2e,16,46,e5,f0,a9,af,75,a6,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Bit Lord 1.1\\BitLord.exe"="C:\\Program Files\\Bit Lord 1.1\\BitLord.exe:*:Enabled:BitLord"
"C:\\Program Files\\Java\\jre1.5.0_06\\launch4j-tmp\\Charles.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\launch4j-tmp\\Charles.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"D:\\Valve\\Steam\\SteamApps\\persoon1keb\\day of defeat source\\hl2.exe"="D:\\Valve\\Steam\\SteamApps\\persoon1keb\\day of defeat source\\hl2.exe:*isabled:hl2"
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"="C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\Empires2.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\Empires2.exe:*:Enabled:Age of Empires II"
"D:\\Valve\\Steam\\SteamApps\\persoon1keb\\counter-strike source\\hl2.exe"="D:\\Valve\\Steam\\SteamApps\\persoon1keb\\counter-strike source\\hl2.exe:*isabled:hl2"
"C:\\Program Files\\Kazaa Lite K++\\clean.kmd"="C:\\Program Files\\Kazaa Lite K++\\clean.kmd:*:Enabled:clean"
"C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe:*:Enabled:Hulp op afstand - Windows Messenger en spraak"
"D:\\Valve\\Steam\\Steam.exe"="D:\\Valve\\Steam\\Steam.exe:*isabledteam"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*isabled:Microsoft DirectPlay Helper"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*isabled:LimeWire"
"C:\\Program Files\\IceChat5\\IceChat5.exe"="C:\\Program Files\\IceChat5\\IceChat5.exe:*:Enabled:IceChat5"
"C:\\Program Files\\Counter-Strike\\hl.exe"="C:\\Program Files\\Counter-Strike\\hl.exe:*isabled:Half-Life Launcher"
"C:\\UnrealTournament\\System\\UnrealTournament.exe"="C:\\UnrealTournament\\System\\UnrealTournament.exe:*isabled:UnrealTournament"
"C:\\Program Files\\Team17\\Worms 2\\Frontend.exe"="C:\\Program Files\\Team17\\Worms 2\\Frontend.exe:*isabled:Worms 2 Frontend"
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="C:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"E:\\KetnetKick\\KetnetKick\\KetnetKick.exe"="E:\\KetnetKick\\KetnetKick\\KetnetKick.exe:*isabled:kic"
"D:\\Valve\\Steam\\SteamApps\\persoon1keb\\half-life deathmatch source\\hl2.exe"="D:\\Valve\\Steam\\SteamApps\\persoon1keb\\half-life deathmatch source\\hl2.exe:*:Enabled:hl2"
"D:\\Valve\\Steam\\SteamApps\\persoon1keb\\half-life 2 deathmatch\\hl2.exe"="D:\\Valve\\Steam\\SteamApps\\persoon1keb\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabledkype. Take a deep breath "
"C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:FlashGet"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 2 May 2004 30,720 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc301.tmp"
Sun 2 May 2004 32,768 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc302.tmp"
Wed 3 Mar 2004 55,296 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc303.tmp"
Wed 3 Mar 2004 49,664 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc304.tmp"
Mon 16 Feb 2004 35,840 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc305.tmp"
Sun 2 May 2004 30,720 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc306.tmp"
Wed 3 Mar 2004 55,296 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc307.tmp"
Mon 16 Feb 2004 29,184 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc308.tmp"
Wed 28 Apr 2004 49,152 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc309.tmp"
Sun 2 May 2004 31,744 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc310.tmp"
Wed 28 Apr 2004 29,184 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc311.tmp"
Mon 16 Feb 2004 43,008 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc312.tmp"
Wed 3 Mar 2004 60,928 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc313.tmp"
Wed 3 Mar 2004 62,464 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc314.tmp"
Wed 28 Apr 2004 27,136 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc315.tmp"
Wed 28 Apr 2004 26,112 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc316.tmp"
Mon 16 Feb 2004 28,672 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc317.tmp"
Wed 3 Mar 2004 52,224 A..H. --- "C:\RECYCLER\S-1-5-21-359561344-1709136994-1300003180-1015\Dc318.tmp"
Tue 29 Jan 2008 59,297,980 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE4FD.tmp"
Tue 29 Jan 2008 58,697,284 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE4FF.tmp"
Tue 29 Jan 2008 59,141,488 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE500.tmp"
Tue 29 Jan 2008 59,184,264 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE501.tmp"
Tue 29 Jan 2008 59,308,364 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE502.tmp"
Tue 29 Jan 2008 58,795,612 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE503.tmp"
Tue 29 Jan 2008 59,645,788 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE504.tmp"
Tue 29 Jan 2008 58,523,892 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE505.tmp"
Tue 29 Jan 2008 59,198,428 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE506.tmp"
Tue 29 Jan 2008 59,221,112 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE507.tmp"
Tue 29 Jan 2008 58,987,608 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE508.tmp"
Tue 29 Jan 2008 59,209,784 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE509.tmp"
Tue 29 Jan 2008 59,613,540 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50A.tmp"
Tue 29 Jan 2008 58,212,252 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50B.tmp"
Tue 29 Jan 2008 58,981,896 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50C.tmp"
Tue 29 Jan 2008 59,338,236 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50D.tmp"
Tue 29 Jan 2008 58,995,356 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50E.tmp"
Tue 29 Jan 2008 59,200,164 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50F.tmp"
Tue 29 Jan 2008 58,929,892 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE510.tmp"
Tue 29 Jan 2008 57,988,484 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE511.tmp"
Tue 29 Jan 2008 62,308,412 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE513.tmp"
Tue 29 Jan 2008 59,525,808 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE514.tmp"
Tue 29 Jan 2008 75,574,316 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE515.tmp"
Thu 11 Mar 2004 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 23 Jul 2004 201,728 ...H. --- "C:\Documents and Settings\Persoon\Mijn documenten\~WRL0450.tmp"
Sat 7 Oct 2006 1,586 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti338.tmp"
Wed 26 Sep 2007 215,040 A..H. --- "C:\Documents and Settings\persoon3\Local Settings\Temp\~167.tmp"
Thu 27 Sep 2007 215,040 A..H. --- "C:\Documents and Settings\persoon3\Local Settings\Temp\~21F.tmp"
Wed 3 Jan 2007 106,496 A..H. --- "C:\Documents and Settings\Persoon\Local Settings\Temp\~133.tmp"
Fri 5 Jan 2007 106,496 A..H. --- "C:\Documents and Settings\Persoon\Local Settings\Temp\~1AC.tmp"
Mon 19 Mar 2007 48,128 ...H. --- "C:\Documents and Settings\persoon2\Mijn documenten\solliciteren\~WRL0001.tmp"
Tue 7 Aug 2007 126,976 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~10B.tmp"
Mon 8 Oct 2007 197,120 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~10C.tmp"
Sat 29 Sep 2007 215,040 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~112.tmp"
Thu 20 Mar 2008 211,968 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~12A.tmp"
Fri 6 Jul 2007 126,976 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~145.tmp"
Sat 23 Feb 2008 209,920 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~14F.tmp"
Sat 17 Feb 2007 122,880 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~15C.tmp"
Wed 22 Aug 2007 214,528 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~163.tmp"
Tue 18 Dec 2007 197,120 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~17D.tmp"
Sat 25 Aug 2007 214,528 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~181.tmp"
Tue 18 Dec 2007 197,120 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~182.tmp"
Mon 8 Oct 2007 197,120 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~1A7.tmp"
Thu 9 Aug 2007 126,976 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~1A8.tmp"
Sun 26 Aug 2007 214,528 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~1C.tmp"
Sat 16 Feb 2008 209,920 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~1E9.tmp"
Thu 12 May 2005 61,440 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~22.tmp"
Fri 31 Aug 2007 214,528 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~24F.tmp"
Sun 26 Aug 2007 214,528 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~26.tmp"
Mon 10 Sep 2007 215,040 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~28E.tmp"
Mon 29 Oct 2007 197,120 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~2A3.tmp"
Mon 20 Aug 2007 126,976 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~31F.tmp"
Thu 23 Aug 2007 214,528 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~45.tmp"
Sun 5 Aug 2007 126,976 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~5.tmp"
Sun 22 Jul 2007 126,976 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~5D.tmp"
Wed 10 Jan 2007 106,496 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~7D.tmp"
Tue 21 Aug 2007 214,528 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~A8.tmp"
Mon 3 Sep 2007 214,528 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~C1.tmp"
Sat 4 Aug 2007 126,976 A..H. --- "C:\Documents and Settings\persoon1\Local Settings\Temp\~CA.tmp"
Sat 24 Apr 2004 2,864,128 A..H. --- "C:\Documents and Settings\persoon2\Mijn documenten\1e lic onderwijspedagogiek\didactische werkvormen\~WRL1247.tmp"
Thu 7 Dec 2006 162,304 ...H. --- "C:\Documents and Settings\persoon2\Mijn documenten\AILO\stagemap\Begeleiding\~WRL0002.tmp"
Thu 7 Oct 2004 61,952 A..H. --- "C:\Documents and Settings\persoon2\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL0049.tmp"
Thu 7 Oct 2004 57,344 A..H. --- "C:\Documents and Settings\persoon2\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL0095.tmp"
Thu 7 Oct 2004 55,808 A..H. --- "C:\Documents and Settings\persoon2\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL1846.tmp"
Thu 7 Oct 2004 61,440 A..H. --- "C:\Documents and Settings\persoon2\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL3772.tmp"
Thu 7 Oct 2004 57,856 A..H. --- "C:\Documents and Settings\persoon2\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL3863.tmp"
Sun 10 Oct 2004 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"

Finished!

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

ComboFix 08-04-15.4 - persoon4 2008-04-16 17:51:29.1 - NTFSx86
Gestart vanuit: C:\Documents and Settings\persoon4\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\persoon1\Menu Start\Programma's\Opstarten\DW_Start.lnk
C:\Documents and Settings\persoon2\Menu Start\Programma's\Opstarten\DW_Start.lnk
C:\Documents and Settings\persoon4\Menu Start\Programma's\Opstarten\DW_Start.lnk
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\system32\BIkmlUvw.ini
C:\WINDOWS\system32\BIkmlUvw.ini2
C:\WINDOWS\system32\iehelper.dll
C:\WINDOWS\system32\IQYbefii.ini
C:\WINDOWS\system32\IQYbefii.ini2
C:\WINDOWS\system32\khfFVOEt.dll
C:\WINDOWS\system32\ljJDWOgF.dll
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\rk.bin
C:\WINDOWS\system32\rlls.dll
C:\WINDOWS\system32\UFPoonpo.ini
C:\WINDOWS\system32\UFPoonpo.ini2
C:\WINDOWS\system32\uvxwxyay.ini
C:\WINDOWS\system32\uvxwxyay.ini2
C:\WINDOWS\system32\wvUlmkIB.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_NWSAPAGENT
-------\Service_6to4
-------\Service_NwSapAgent


(((((((((((((((((((( Bestanden Gemaakt van 2008-03-16 to 2008-04-16 ))))))))))))))))))))))))))))))
.

2008-04-15 18:29 . 2008-04-15 18:30 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-15 18:19 . 2008-04-16 08:06 <DIR> d-------- C:\SDFix
2008-04-15 18:08 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-04-15 17:43 . 2008-04-15 17:46 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-04-15 17:43 . 2008-04-15 17:43 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-04-13 10:04 . 2008-04-13 10:04 8 --a------ C:\WINDOWS\system32\4861a499
2008-04-13 09:25 . 2008-04-13 09:25 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-04-13 08:39 . 2008-04-13 08:40 <DIR> d-------- C:\Documents and Settings\persoon1\.limewire
2008-04-12 14:49 . 2008-04-12 14:49 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2008-04-12 14:45 . 2008-04-15 23:56 <DIR> d-------- C:\WINDOWS\VmVybWVpcmUgQmFydA
2008-04-12 14:45 . 2008-04-12 14:45 <DIR> d-------- C:\WINDOWS\system32\pol3
2008-04-12 14:45 . 2008-04-12 14:45 <DIR> d-------- C:\WINDOWS\system32\PBL
2008-04-12 14:45 . 2008-04-12 14:45 <DIR> d-------- C:\WINDOWS\system32\MId2
2008-04-12 14:45 . 2008-04-12 14:45 <DIR> d-------- C:\WINDOWS\system32\dtmp
2008-04-12 14:45 . 2008-04-12 14:45 <DIR> d-------- C:\WINDOWS\system32\bharebio18
2008-04-12 14:45 . 2008-04-12 14:45 <DIR> d-------- C:\temp\wdlw14
2008-04-12 14:45 . 2008-04-15 16:23 63,839 --a------ C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll-uninst.exe
2008-04-11 04:06 . 2008-04-11 04:06 330,240 --a------ C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-13 17:52 --------- d-----w C:\Program Files\BeClean
2008-04-13 17:35 --------- d-----w C:\Program Files\Security Task Manager
2008-04-12 12:34 --------- d-----w C:\Program Files\FlashGet
2008-04-04 15:22 --------- d-----w C:\Documents and Settings\persoon3\Application Data\Skype
2008-03-24 14:42 --------- d-----w C:\Documents and Settings\persoon2\Application Data\dvdcss
2008-03-02 18:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\pdf995
2008-03-02 17:33 82,380 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2008-03-02 10:50 --------- d-----w C:\Program Files\Windows Live
2008-03-02 10:47 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-02 10:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-02 07:36 --------- d-----w C:\Documents and Settings\persoon1\Application Data\Zylom Games
2008-02-22 16:53 --------- d-----w C:\Documents and Settings\persoon1\Application Data\Hewlett-Packard
2008-02-20 13:55 --------- d-----w C:\Documents and Settings\persoon2\Application Data\Apple Computer
2008-02-18 16:27 --------- d-----w C:\Documents and Settings\persoon2\Application Data\AdobeUM
2008-02-16 08:58 342 ---ha-w C:\Documents and Settings\persoon2\hpothb07.dat
2007-11-06 17:17 809 ---ha-w C:\Documents and Settings\persoon3\hpothb07.dat
2007-09-25 20:59 14 ----a-w C:\Documents and Settings\persoon4\logoff1.bat
2007-08-01 08:09 157,232 ----a-w C:\Documents and Settings\persoon2\Application Data\GDIPFONTCACHEV1.DAT
2007-05-01 11:56 157,232 ----a-w C:\Documents and Settings\persoon3\Application Data\GDIPFONTCACHEV1.DAT
2007-04-25 08:51 157,232 ----a-w C:\Documents and Settings\persoon6\Application Data\GDIPFONTCACHEV1.DAT
2007-03-28 20:33 157,232 ----a-w C:\Documents and Settings\persoon4\Application Data\GDIPFONTCACHEV1.DAT
2006-09-13 13:07 144,392 ----a-w C:\Documents and Settings\persoon1\Application Data\GDIPFONTCACHEV1.DAT
2006-06-19 11:20 163 ---ha-w C:\Documents and Settings\persoon5\hpothb07.dat
2004-11-11 10:46 0 -c-ha-w C:\Documents and Settings\persoon6\hpothb07.dat
2004-11-11 10:29 185 ---ha-w C:\Documents and Settings\persoon6\Application Data\hpothb07.dat
2004-11-07 09:58 185 ---ha-w C:\Documents and Settings\All Users\Application Data\hpothb07.dat
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{20761db2-33a3-db5f-7f28-ef68ab868435}]
2008-04-11 04:06 330240 --a------ C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 13:22 86016]
"PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2005-05-23 18:09 127118]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [ ]
"beidsystemtray"="C:\Program Files\Belgium Identity Card\beidsystemtray.exe" [2007-02-19 16:15 188416]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-17 20:04 282624]
"{1B-B6-6B-B8-DW}"="c:\windows\system32\rwwnw64d.exe" [2008-04-16 18:38 49166]
"spa_start"="C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll" [2008-04-11 04:06 330240]
"g]eeV\mWhjlnspB"="C:\WINDOWS\system32\tcntpkdn.exe" [2008-04-16 18:49 196678]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:03 15360]

C:\Documents and Settings\persoon4\Menu Start\Programma's\Opstarten\
Deewoo.lnk - C:\WINDOWS\system32\tcntpkdn.exe [2008-04-16 18:49:47 196678]
DW_Start.lnk - C:\WINDOWS\system32\rwwnw64d.exe [2008-04-16 18:38:39 49166]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-06 02:17:18 147456]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 02:06:58 28672]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NosecurityTab"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NosecurityTab"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
PCANotify.dll 2003-10-31 11:01 8704 C:\WINDOWS\system32\PCANotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar Search Scope Monitor]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\mrofinu1188.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spa_start]
--a------ 2008-04-11 04:06 330240 C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Bit Lord 1.1\\BitLord.exe"=
"C:\\Program Files\\Java\\jre1.5.0_06\\launch4j-tmp\\Charles.exe"=
"D:\\Valve\\Steam\\SteamApps\\persoon2keb\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\Empires2.exe"=
"D:\\Valve\\Steam\\SteamApps\\persoon2keb\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Kazaa Lite K++\\clean.kmd"=
"C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"D:\\Valve\\Steam\\Steam.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\IceChat5\\IceChat5.exe"=
"C:\\Program Files\\Counter-Strike\\hl.exe"=
"C:\\UnrealTournament\\System\\UnrealTournament.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"E:\\KetnetKick\\KetnetKick\\KetnetKick.exe"=
"D:\\Valve\\Steam\\SteamApps\\persoon2keb\\half-life deathmatch source\\hl2.exe"=
"D:\\Valve\\Steam\\SteamApps\\persoon2keb\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:google
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
"1234:UDP"= 1234:UDP:vlc

R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2007-09-08 17:05]
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 17:11]
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2007-09-08 17:05]
R2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2006-07-03 08:39]
R2 eID CRL Service;eID CRL Service;C:\WINDOWS\system32\beidservicecrl.exe [2007-02-19 16:16]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2002-07-29 14:14]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2002-07-29 14:15]
S0 NaiFsRec;NaiFsRec;C:\WINDOWS\system32\drivers\NaiFsRec.sys [2001-02-16 22:54]
S1 lusbaudio;Logitech USB-microfoon;C:\WINDOWS\system32\drivers\OVSound2.sys [2001-08-17 22:05]
S1 tvtool;tvtool;C:\Program Files\TVTool\tvtool.sys []
S2 AsEngine;McAfee.com AV Engine;C:\WINDOWS\mcbin\av\rt\asengine.exe []
S2 PIEUsb;Pacific Image Electronics USB Scanner;C:\WINDOWS\system32\Drivers\usbscan.sys [2004-08-04 08:58]
S3 ACSSCR;ACR38 Smart Card Reader;C:\WINDOWS\system32\DRIVERS\a38usbxp.sys [2005-01-18 18:34]
S3 asbp2poa;asbp2poa;C:\DOCUME~1\Papa\LOCALS~1\Temp\asbp2poa.sys []
S3 eID Privacy Service;eID Privacy Service;C:\WINDOWS\system32\beidservicepcsc.exe [2007-02-19 16:16]
S3 KLSIENET;Driver for USB Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\usb101et.sys [2002-09-09 14:41]
S3 lc3pkt_2.1;LC3 Packet Driver;C:\Documents and Settings\persoon4\@stake\LC4\lc3pkt.sys []
S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\SophosMEMSWEEP.SYS []
S3 mpr_freader;MPR FileReader Driver;C:\Documents and Settings\persoon4\Mijn documenten\Multi Password Recovery\mpr_freader.sys [2006-04-17 04:22]
S3 mstTADsk;mst TotalAccess Disk Driver;C:\WINDOWS\system32\drivers\mstTADsk.sys [2003-08-14 13:42]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 23:10]
S3 QCEmerald;Logitech QuickCam Web;C:\WINDOWS\system32\DRIVERS\OVCE.sys [2001-08-17 22:05]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\aoesetup.exe /autorun
\Shell\directx\command - K:\DirectX\dxsetup.exe
\Shell\dplay\command - K:\DirectX\dplay61a.exe
\Shell\dxdiag\command - K:\goodies\ar40eng.exe
\Shell\dxinfo\command - K:\goodies\DirectX\dxinfo.exe
\Shell\dxtest\command - K:\DirectX\dxdiag.exe
\Shell\dxtool\command - K:\goodies\DirectX\dxtool.exe
\Shell\log\command - K:\goodies\machine\machine.exe -l
\Shell\machine\command - K:\goodies\machine\machine.exe
\Shell\setup\command - K:\aoesetup.exe /autorun
\Shell\zone\command - K:\goodies\mszone\zoneA600.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\Shell\AutoRun\command - N:\Autorun.exe

.
Inhoud van de 'Gedeelde Taken' map
"2008-04-08 16:42:08 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1204479559.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-16 18:36:54
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...


C:\WINDOWS\system32\rwwnw64d.exe 49166 bytes executable
C:\WINDOWS\system32\msnav32.ax 93 bytes

Scan succesvol afgerond
verborgen bestanden: 5

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"g]eeV\\mWhjlnspB"="C:\\WINDOWS\\system32\\tcntpkdn.exe DWram"
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\xfire_lsp.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\scardsvr.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\MDM.EXE
C:\WINDOWS\system32\mnmsrvc.exe
C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Voltooingstijd: 2008-04-16 18:53:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-16 16:52:51
ComboFix2.txt 2006-08-31 10:58:16

Pre-Run: 3,633,999,872 bytes beschikbaar
Post-Run: 6,397,538,304 bytes beschikbaar
.
2008-04-11 01:10:26 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:06:37, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\mnmsrvc.exe
C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\Belgium Identity Card\beidsystemtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
c:\windows\system32\rwwnw64d.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\tcntpkdn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
I:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hoehel.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.aldi.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8888; https=127.0.0.1:8888
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: nextads browser optimizer - {20761db2-33a3-db5f-7f28-ef68ab868435} - C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [beidsystemtray] C:\Program Files\Belgium Identity Card\beidsystemtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{1B-B6-6B-B8-DW}] c:\windows\system32\rwwnw64d.exe DWram
O4 - HKLM\..\Run: [g]eeV\mWhjlnspB] C:\WINDOWS\system32\tcntpkdn.exe DWram
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\tcntpkdn.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\rwwnw64d.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.telenet.be
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: McAfee.com AV Engine (AsEngine) - Unknown owner - C:\WINDOWS\mcbin\av\rt\asengine.exe (file missing)
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: eID CRL Service - Zetes - C:\WINDOWS\system32\beidservicecrl.exe
O23 - Service: eID Privacy Service - Zetes - C:\WINDOWS\system32\beidservicepcsc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 8009 bytes

* Open hijackthis en vink volgende regels aan:

O2 - BHO: nextads browser optimizer - {20761db2-33a3-db5f-7f28-ef68ab868435} - C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll
O4 - HKLM\..\Run: [{1B-B6-6B-B8-DW}] c:\windows\system32\rwwnw64d.exe DWram
O4 - HKLM\..\Run: [g]eeV\mWhjlnspB] C:\WINDOWS\system32\tcntpkdn.exe DWram

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Post dan een nieu wlogje van SDfix hier.

SDFix: Version 1.171
Run by Stijn on wo 16/04/2008 at 22:49

Microsoft Windows XP [versie 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\msnav32.ax - Deleted
C:\WINDOWS\system32\rwwnw64d.exe - Deleted
C:\WINDOWS\system32\zxdnt3d.cfg - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 08:09:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:53,2c,69,f1,99,fd,06,4c,94,3b,74,49,79,85,0b,36,b8,f2,80,a9,73,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ad,77,4d,31,b3,a8,79,6d,0a,c4,a3,fb,1c,8f,54,9f,58,d0,56,f1,73,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,d9,f7,1a,d5,26,92,09,5c,29,2d,7f,ce,27,fc,dd,3f,ef,..
"khjeh"=hex:3a,7f,7f,6a,42,31,59,da,20,3b,14,e9,6a,b6,08,eb,04,b2,d2,3e,b4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1d,88,cf,32,1f,79,24,ac,6a,2b,86,7b,38,46,34,1a,2a,57,7c,c3,ab,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:30,7a,34,52,70,84,44,cf,1e,82,26,2b,4b,bd,59,81,ae,fc,43,ea,16,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:00,80,a7,de,e3,7f,ef,5f,f8,70,56,b8,1c,40,d7,a6,a6,99,5c,7f,44,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:c3,3a,60,50,72,f4,e2,c8,de,d0,2a,dc,2e,16,46,e5,f0,a9,af,75,a6,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:c8409d82
"s1"=dword:e595cfea
"s2"=dword:83a74677
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000001
"ujdew"=hex:53,2c,69,f1,99,fd,06,4c,94,3b,74,49,79,85,0b,36,b8,f2,80,a9,73,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:ad,77,4d,31,b3,a8,79,6d,0a,c4,a3,fb,1c,8f,54,9f,58,d0,56,f1,73,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,d9,f7,1a,d5,26,92,09,5c,29,2d,7f,ce,27,fc,dd,3f,ef,..
"khjeh"=hex:3a,7f,7f,6a,42,31,59,da,20,3b,14,e9,6a,b6,08,eb,04,b2,d2,3e,b4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:1d,88,cf,32,1f,79,24,ac,6a,2b,86,7b,38,46,34,1a,2a,57,7c,c3,ab,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:30,7a,34,52,70,84,44,cf,1e,82,26,2b,4b,bd,59,81,ae,fc,43,ea,16,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:00,80,a7,de,e3,7f,ef,5f,f8,70,56,b8,1c,40,d7,a6,a6,99,5c,7f,44,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:c3,3a,60,50,72,f4,e2,c8,de,d0,2a,dc,2e,16,46,e5,f0,a9,af,75,a6,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"NextDetectionTime"="2008-04-17 06:00:57"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect]
"LastError"=dword:00000000

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Bit Lord 1.1\\BitLord.exe"="C:\\Program Files\\Bit Lord 1.1\\BitLord.exe:*:Enabled:BitLord"
"C:\\Program Files\\Java\\jre1.5.0_06\\launch4j-tmp\\Charles.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\launch4j-tmp\\Charles.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"D:\\Valve\\Steam\\SteamApps\\stefkeb\\day of defeat source\\hl2.exe"="D:\\Valve\\Steam\\SteamApps\\stefkeb\\day of defeat source\\hl2.exe:*isabled:hl2"
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"="C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\Empires2.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\Empires2.exe:*:Enabled:Age of Empires II"
"D:\\Valve\\Steam\\SteamApps\\stefkeb\\counter-strike source\\hl2.exe"="D:\\Valve\\Steam\\SteamApps\\stefkeb\\counter-strike source\\hl2.exe:*isabled:hl2"
"C:\\Program Files\\Kazaa Lite K++\\clean.kmd"="C:\\Program Files\\Kazaa Lite K++\\clean.kmd:*:Enabled:clean"
"C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe:*:Enabled:Hulp op afstand - Windows Messenger en spraak"
"D:\\Valve\\Steam\\Steam.exe"="D:\\Valve\\Steam\\Steam.exe:*isabledteam"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*isabled:Microsoft DirectPlay Helper"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*isabled:LimeWire"
"C:\\Program Files\\IceChat5\\IceChat5.exe"="C:\\Program Files\\IceChat5\\IceChat5.exe:*:Enabled:IceChat5"
"C:\\Program Files\\Counter-Strike\\hl.exe"="C:\\Program Files\\Counter-Strike\\hl.exe:*isabled:Half-Life Launcher"
"C:\\UnrealTournament\\System\\UnrealTournament.exe"="C:\\UnrealTournament\\System\\UnrealTournament.exe:*isabled:UnrealTournament"
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="C:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"E:\\KetnetKick\\KetnetKick\\KetnetKick.exe"="E:\\KetnetKick\\KetnetKick\\KetnetKick.exe:*isabled:kic"
"D:\\Valve\\Steam\\SteamApps\\stefkeb\\half-life deathmatch source\\hl2.exe"="D:\\Valve\\Steam\\SteamApps\\stefkeb\\half-life deathmatch source\\hl2.exe:*:Enabled:hl2"
"D:\\Valve\\Steam\\SteamApps\\stefkeb\\half-life 2 deathmatch\\hl2.exe"="D:\\Valve\\Steam\\SteamApps\\stefkeb\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabledkype. Take a deep breath "
"C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:FlashGet"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 29 Jan 2008 59,297,980 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE4FD.tmp"
Tue 29 Jan 2008 58,697,284 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE4FF.tmp"
Tue 29 Jan 2008 59,141,488 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE500.tmp"
Tue 29 Jan 2008 59,184,264 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE501.tmp"
Tue 29 Jan 2008 59,308,364 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE502.tmp"
Tue 29 Jan 2008 58,795,612 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE503.tmp"
Tue 29 Jan 2008 59,645,788 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE504.tmp"
Tue 29 Jan 2008 58,523,892 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE505.tmp"
Tue 29 Jan 2008 59,198,428 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE506.tmp"
Tue 29 Jan 2008 59,221,112 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE507.tmp"
Tue 29 Jan 2008 58,987,608 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE508.tmp"
Tue 29 Jan 2008 59,209,784 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE509.tmp"
Tue 29 Jan 2008 59,613,540 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50A.tmp"
Tue 29 Jan 2008 58,212,252 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50B.tmp"
Tue 29 Jan 2008 58,981,896 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50C.tmp"
Tue 29 Jan 2008 59,338,236 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50D.tmp"
Tue 29 Jan 2008 58,995,356 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50E.tmp"
Tue 29 Jan 2008 59,200,164 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE50F.tmp"
Tue 29 Jan 2008 58,929,892 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE510.tmp"
Tue 29 Jan 2008 57,988,484 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE511.tmp"
Tue 29 Jan 2008 62,308,412 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE513.tmp"
Tue 29 Jan 2008 59,525,808 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE514.tmp"
Tue 29 Jan 2008 75,574,316 A..H. --- "C:\{2426F42A-20BE-4F19-A8A5-640920671123}\00000001\SBE515.tmp"
Thu 11 Mar 2004 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 23 Jul 2004 201,728 ...H. --- "C:\Documents and Settings\persoon\Mijn documenten\~WRL0450.tmp"
Sat 7 Oct 2006 1,586 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti338.tmp"
Wed 3 Jan 2007 106,496 A..H. --- "C:\Documents and Settings\persoon\Local Settings\Temp\~133.tmp"
Fri 5 Jan 2007 106,496 A..H. --- "C:\Documents and Settings\persoon\Local Settings\Temp\~1AC.tmp"
Mon 19 Mar 2007 48,128 ...H. --- "C:\Documents and Settings\persoon\Mijn documenten\solliciteren\~WRL0001.tmp"
Wed 16 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2112b4f456fe6310ed58588b71b93f62\BIT23.tmp"
Sat 24 Apr 2004 2,864,128 A..H. --- "C:\Documents and Settings\persoon\Mijn documenten\1e lic onderwijspedagogiek\didactische werkvormen\~WRL1247.tmp"
Thu 7 Dec 2006 162,304 ...H. --- "C:\Documents and Settings\persoon\Mijn documenten\AILO\stagemap\Begeleiding\~WRL0002.tmp"
Thu 7 Oct 2004 61,952 A..H. --- "C:\Documents and Settings\persoon\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL0049.tmp"
Thu 7 Oct 2004 57,344 A..H. --- "C:\Documents and Settings\persoon\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL0095.tmp"
Thu 7 Oct 2004 55,808 A..H. --- "C:\Documents and Settings\persoon\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL1846.tmp"
Thu 7 Oct 2004 61,440 A..H. --- "C:\Documents and Settings\persoon\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL3772.tmp"
Thu 7 Oct 2004 57,856 A..H. --- "C:\Documents and Settings\persoon\Mijn documenten\2e lic onderwijspedagogiek\stage\stage\stage\~WRL3863.tmp"
Sun 10 Oct 2004 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:55:01, on 17/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\beidservicecrl.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\system32\tcntpkdn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
I:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hoehel.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.aldi.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8888; https=127.0.0.1:8888
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [beidsystemtray] C:\Program Files\Belgium Identity Card\beidsystemtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\{8efed651-08c5-9aa3-1f8c-8566e272f487}.dll" DllInit
O4 - HKLM\..\Run: [{1B-B6-6B-B8-DW}] C:\WINDOWS\system32\jownw64s.exe DWram
O4 - HKLM\..\Run: [g]eeV\mWhjlnspB] C:\WINDOWS\system32\tcntpkdn.exe DWram
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\tcntpkdn.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\jownw64s.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.telenet.be
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: McAfee.com AV Engine (AsEngine) - Unknown owner - C:\WINDOWS\mcbin\av\rt\asengine.exe (file missing)
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: eID CRL Service - Zetes - C:\WINDOWS\system32\beidservicecrl.exe
O23 - Service: eID Privacy Service - Zetes - C:\WINDOWS\system32\beidservicepcsc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\Cheetah Burner\Cheetah DVD Burner\NMSAccess.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7985 bytes

* Download Malwarebytes' Anti-Malware via hier of hier.

Dubbelklik mbam-setup.exe om het programma te installeren.

• Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Launch Malwarebytes' Anti-Malware, Klik daarna op "finish".
• Indien een update gevonden werd, zal het die downloaden en de laatste versie installeren.
• Wanneer het programma volledig up to date is, selecteer "Perform Quick Scan", daarna klik Scan.
• Het scannen kan een tijdje duren, dus wees geduldig.
• Wanneer de scan voltooid is, klik OK, daarna "Show Results" om de resultaten te zien.
• Zorg ervoor dat daar alles aangevinkt is, daarna klik: Remove Selected.
• Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie extra nota onderaan)
• De log wordt automatisch bewaard door MBAM die je kan zien door de "Logs" tab te klikken in MBAM.
• Kopieer en plak de resultaten van de log in je volgend antwoord, samen met een nieuw HijackThislog.

Extra Nota:
Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de Computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.