Archief - Trojan - Hulp gevraagd

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
c

cool_boy_ke

Legacy Member
Ik denk dat ik een Trojan heb: C:\WINDOWS\system32\mdm.exe ?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:11:25, on 11/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
E:\Program Files\ISP Monitor\isp.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
E:\Program Files\Messenger\MSMSGS.EXE
E:\Program Files\Launchy\Launchy.exe
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
F:\Games\Steam\Steam.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mdm.exe
E:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Documents and Settings\MiguelFP\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Program Files\Free Download Manager\iefdmcks.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Auto EPSON Stylus Photo RX420 Series on BETELGUEZE] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P50 "Auto EPSON Stylus Photo RX420 Series on BETELGUEZE" /O21 "\\BETELGUEZE\EPSONSty" /M "Stylus Photo RX420"
O4 - HKCU\..\Run: [ISPMonitor] E:\Program Files\ISP Monitor\isp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AtiTrayTools] "E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Launchy.lnk = E:\Program Files\Launchy\Launchy.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ISP Monitor (ISPMonitorSrv) - How2 Studios - E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5839 bytes
J

Jurgenv1

Legacy Member
* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
  • Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
  • Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
  • Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
  • Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
  • Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
  • Klik daarna de groene pijl rechts om de scan te starten.
  • Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
  • Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
    check.gif
  • Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
    move.gif

    Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
  • Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
  • Sluit daarna Dr.Web Cureit.
  • Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
  • Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.
c

cool_boy_ke

Legacy Member
Hieronder staat niets speciaals:

isp.exe;e:\program files\isp monitor;Waarschijnlijk BACKDOOR.Trojan;Niet repareerbaar.Zullen verplaatst worden na herstart.;
pv.exe;E:\xampp\apache\bin;Program.PrcView.3725;Niet repareerbaar.Verplaatst.;
mirc.exe;F:\mIRC;Program.mIRC.621;Niet repareerbaar.Verplaatst.;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:09, on 12/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\PROGRA~1\MOZILL~1\FIREFOX.EXE
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
E:\Program Files\Messenger\MSMSGS.EXE
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
E:\Program Files\Launchy\Launchy.exe
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\MiguelFP\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Program Files\Free Download Manager\iefdmcks.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Auto EPSON Stylus Photo RX420 Series on BETELGUEZE] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P50 "Auto EPSON Stylus Photo RX420 Series on BETELGUEZE" /O21 "\\BETELGUEZE\EPSONSty" /M "Stylus Photo RX420"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AtiTrayTools] "E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Launchy.lnk = E:\Program Files\Launchy\Launchy.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ISP Monitor (ISPMonitorSrv) - How2 Studios - E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5703 bytes
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
c

cool_boy_ke

Legacy Member
ComboFix
ComboFix 07-08-09.3 - "MiguelFP" 2007-08-13 15:58:52.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.594 [GMT 2:00]


((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))


2007-08-13 15:58 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-13 14:00 <DIR> d-------- C:\HammerAutosave
2007-08-12 10:15 <DIR> d-------- C:\DOCUME~1\MiguelFP\DoctorWeb
2007-08-09 14:31 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\Joost
2007-08-09 09:33 65,536 --a------ C:\WINDOWS\system32\E_S00RP1.EXE
2007-08-01 11:58 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\Free Download Manager
2007-07-30 20:22 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2007-07-30 14:52 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-07-30 14:51 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-07-30 14:51 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-07-29 03:54 <DIR> d-------- C:\WINDOWS\ShellNew
2007-07-29 00:31 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-07-29 00:31 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-07-28 23:50 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\GetRightToGo
2007-07-28 23:31 297,472 --a------ C:\WINDOWS\uninst.exe
2007-07-28 23:31 <DIR> d-------- C:\DOCUME~1\MiguelFP\WINDOWS
2007-07-28 22:04 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\Inkscape
2007-07-28 22:04 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\gtk-2.0
2007-07-28 12:23 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-07-28 12:23 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-07-28 12:23 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-07-28 12:23 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-07-28 12:23 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-07-28 12:22 69,417 --a------ C:\WINDOWS\hpoins05.dat
2007-07-28 12:22 19,696 --------- C:\WINDOWS\hpomdl05.dat
2007-07-28 12:22 <DIR> d-------- C:\Temp\HP_WebRelease
2007-07-28 12:22 <DIR> d-------- C:\Temp
2007-07-25 19:27 94,208 --a------ C:\WINDOWS\system32\HPJIPX1U.DLL
2007-07-25 19:27 7,680 --a------ C:\WINDOWS\system32\HPBPROPS.DLL
2007-07-25 19:27 7,680 --a------ C:\WINDOWS\system32\HPBOIDPS.DLL
2007-07-25 19:27 53,248 --a------ C:\WINDOWS\system32\HPZIPM12.DLL
2007-07-25 19:27 49,252 --a------ C:\WINDOWS\system32\HPMNQUE.DLL
2007-07-25 19:27 49,250 --a------ C:\WINDOWS\system32\HPMNNDPS.DLL
2007-07-25 19:27 49,152 --a------ C:\WINDOWS\system32\HPBNRAC2.DLL
2007-07-25 19:27 49,152 --a------ C:\WINDOWS\system32\fxcompchannel.dll
2007-07-25 19:27 49,152 --------- C:\WINDOWS\system32\HPZIDR12.DLL
2007-07-25 19:27 45,056 --a------ C:\WINDOWS\system32\HPPAPTS0.DLL
2007-07-25 19:27 43,520 --a------ C:\WINDOWS\system32\HPZINW12.DLL
2007-07-25 19:27 39,424 --a------ C:\WINDOWS\system32\HPBPRO.DLL
2007-07-25 19:27 36,864 --a------ C:\WINDOWS\system32\HPPASNM0.DLL
2007-07-25 19:27 36,864 --a------ C:\WINDOWS\system32\HPPAPML0.DLL
2007-07-25 19:27 33,280 --------- C:\WINDOWS\system32\HPZIPR12.DLL
2007-07-25 19:27 311,296 --a------ C:\WINDOWS\system32\hpu4pm.DLL
2007-07-25 19:27 29,696 --------- C:\WINDOWS\system32\HPZIPT12.DLL
2007-07-25 19:27 25,600 --a------ C:\WINDOWS\system32\HPBOID.DLL
2007-07-25 19:27 241,721 --a------ C:\WINDOWS\system32\HPBMINI.DLL
2007-07-25 19:27 24,576 --a------ C:\WINDOWS\system32\HPBMIAPI.DLL
2007-07-25 19:27 212,992 --a------ C:\WINDOWS\system32\hpu4mlui.DLL
2007-07-25 19:27 204,800 --a------ C:\WINDOWS\system32\HPMCPMW.DLL
2007-07-25 19:27 20,480 --------- C:\WINDOWS\system32\HPZISN12.DLL
2007-07-25 19:27 163,840 --a------ C:\WINDOWS\system32\HPJCMN2U.DLL
2007-07-25 19:27 139,264 --a------ C:\WINDOWS\system32\hpu4rtcp.dll
2007-07-25 19:27 131,072 --a------ C:\WINDOWS\system32\hpu4HSJA.DLL
2007-07-25 19:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
2007-07-25 19:18 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\OpenOffice.org2
2007-07-25 10:52 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\SpaceMonger
2007-07-25 00:38 <DIR> d-------- C:\WINDOWS\pss
2007-07-25 00:24 143,360 --a------ C:\WINDOWS\system\EIELib.dll
2007-07-24 18:29 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\DeepBurner
2007-07-24 11:08 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-07-24 10:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-07-24 10:45 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-07-24 10:45 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-07-24 00:40 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-07-23 22:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-23 22:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-23 22:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-07-23 22:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-23 19:34 1,645,320 --a------ C:\WINDOWS\system\gdiplus.dll
2007-07-23 15:37 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\SmartFTP
2007-07-23 15:05 171,792 --a------ C:\WINDOWS\system32\wjview.exe
2007-07-23 15:04 49,424 --a------ C:\WINDOWS\system32\clspack.exe
2007-07-23 15:04 172,304 --a------ C:\WINDOWS\system32\jview.exe
2007-07-23 13:19 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\atitray
2007-07-22 20:23 947,472 --a------ C:\WINDOWS\system32\msjava.dll
2007-07-22 20:23 63,248 --a------ C:\WINDOWS\system32\javaprxy.dll
2007-07-22 20:23 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-07-22 20:23 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-07-22 20:23 44,544 --a------ C:\WINDOWS\clspack.exe
2007-07-22 20:23 404,752 --a------ C:\WINDOWS\system32\javart.dll
2007-07-22 20:23 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-07-22 20:23 286,992 --a------ C:\WINDOWS\system32\vmhelper.dll
2007-07-22 20:23 21,264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2007-07-22 20:23 187,152 --a------ C:\WINDOWS\system32\javacypt.dll
2007-07-22 20:23 171,280 --a------ C:\WINDOWS\system32\jit.dll
2007-07-22 20:23 154,384 --a------ C:\WINDOWS\system32\msawt.dll
2007-07-22 20:23 15,120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2007-07-22 20:23 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-07-22 20:23 113 --a------ C:\WINDOWS\system32\zonedon.reg
2007-07-22 20:23 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2007-07-22 20:23 103,424 --a------ C:\WINDOWS\extrac32.exe
2007-07-22 18:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-07-22 17:43 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-07-22 17:42 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2007-07-22 17:41 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2007-07-22 17:41 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2007-07-22 17:41 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2007-07-22 14:03 <DIR> d-------- C:\DOCUME~1\MiguelFP\APPLIC~1\Google
2007-07-22 13:54 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
2007-07-22 13:53 53,760 --a------ C:\WINDOWS\system32\drivers\vfwwdm32.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-13 15:56 --------- d-------- E:\Program Files\Soulseek
2007-08-13 14:27 --------- d-------- E:\Program Files\ISP Monitor
2007-08-12 21:32 --------- d-------- E:\Program Files\VTFEdit
2007-08-10 21:39 --------- d-------- E:\Program Files\Subdownloader
2007-08-10 12:47 --------- d-------- E:\Program Files\ILoveSteam
2007-08-10 01:06 --------- d-------- E:\Program Files\PeerGuardian2
2007-08-09 19:37 --------- d-------- E:\Program Files\Messenger
2007-08-09 14:31 --------- d-------- E:\Program Files\Joost
2007-08-08 19:01 --------- d-------- E:\Program Files\Audacity
2007-08-05 11:12 --------- d-------- E:\Program Files\SCAR 3.11
2007-08-03 16:05 --------- d--h----- E:\Program Files\InstallShield Installation Information
2007-08-01 11:58 --------- d-------- E:\Program Files\Free Download Manager
2007-07-31 20:28 --------- d-------- E:\Program Files\MSN Messenger
2007-07-31 12:48 --------- d-------- E:\Program Files\PC Wizard 2007
2007-07-31 12:31 --------- d-------- E:\Program Files\Google
2007-07-30 14:38 --------- d-------- E:\Program Files\America's Army Server Manager
2007-07-29 13:21 --------- d-------- E:\Program Files\SWF-AVI-GIF Converter
2007-07-29 13:20 --------- d-------- E:\Program Files\Runtime Software
2007-07-29 13:18 --------- d-------- E:\Program Files\123 AVI to GIF Converter
2007-07-29 00:50 --------- d-------- E:\Program Files\Recuva
2007-07-28 12:23 --------- d-------- E:\Program Files\HP
2007-07-25 19:32 --------- d-------- E:\Program Files\Hewlett-Packard
2007-07-25 16:42 --------- d-------- E:\Program Files\PowerQuest
2007-07-25 10:52 --------- d-------- E:\Program Files\SpaceMonger
2007-07-25 00:35 --------- d-------- E:\Program Files\TuneXP
2007-07-25 00:35 --------- d-------- E:\Program Files\CCleaner
2007-07-24 18:29 --------- d-------- E:\Program Files\Astonsoft
2007-07-24 13:36 --------- d-------- E:\Program Files\OpenOffice.org 2.2
2007-07-24 11:24 --------- d-------- E:\Program Files\EPSON
2007-07-24 10:54 --------- d-------- E:\Program Files\Bonjour
2007-07-23 23:04 --------- d-------- E:\Program Files\TightVNC
2007-07-23 22:53 --------- d-------- E:\Program Files\Lavasoft
2007-07-23 15:37 --------- d-------- E:\Program Files\SmartFTP Client
2007-07-23 13:18 --------- d-------- E:\Program Files\Ray Adams
2007-07-22 20:29 --------- d-------- E:\Program Files\Web Publish
2007-07-22 18:47 --------- d-------- E:\Program Files\Microsoft Visual Studio 8
2007-07-22 18:46 --------- d-------- E:\Program Files\Microsoft.NET
2007-07-22 17:45 --------- d-------- E:\Program Files\MSXML 6.0
2007-07-22 13:13 --------- d-------- E:\Program Files\Notepad++
2007-07-22 01:17 --------- d-------- E:\Program Files\K-Lite Codec Pack
2007-07-21 19:13 --------- d-------- E:\Program Files\DAEMON Tools
2007-07-21 16:33 --------- d-------- E:\Program Files\No-IP
2007-07-21 15:41 --------- d-------- E:\Program Files\Azureus
2007-07-21 13:45 86016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-07-21 13:45 --------- d-------- E:\Program Files\OpenAL
2007-07-21 10:51 --------- d-------- E:\Program Files\Foxit Software
2007-07-21 02:17 --------- d-------- E:\Program Files\Blender Foundation
2007-07-21 00:49 --------- d-------- E:\Program Files\Launchy
2007-05-16 17:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:12 85504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll
--------- E:\Program Files\Mafia


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-10-28 21:05]
"AVG7_CC"="E:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-24 00:40]
"Auto EPSON Stylus Photo RX420 Series on BETELGUEZE"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.exe" [2004-04-09 05:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"AtiTrayTools"="E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2007-05-22 11:04]
"MSMSGS"="E:\Program Files\Messenger\MSMSGS.exe" [2003-04-14 20:05]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Launchy.lnk - E:\Program Files\Launchy\Launchy.exe [2007-07-21 00:49:46]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"=1 (0x1)
"LinkResolveIgnoreLinkInfo"=1 (0x1)
"NoResolveSearch"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"=1 (0x1)
"LinkResolveIgnoreLinkInfo"=1 (0x1)
"NoResolveSearch"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)

R1 atitray;atitray;\??\E:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys
R1 PQNTDrv;PQNTDrv;C:\WINDOWS\system32\drivers\PQNTDrv.sys
R2 ISPMonitorSrv;ISP Monitor;E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
R3 NVENET;NVIDIA nForce Networking Controller Driver;C:\WINDOWS\system32\DRIVERS\NVENET.sys
S1 lusbaudio;Logitech USB Microphone;C:\WINDOWS\system32\drivers\OVSound2.sys
S3 cpuz127;cpuz127;\??\C:\DOCUME~1\MiguelFP\LOCALS~1\Temp\cpuz_x32.sys
S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 QCEmerald;Logitech QuickCam Web;C:\WINDOWS\system32\DRIVERS\OVCE.sys
S3 VHidMinidrv;Bluetooth HID Device Service;C:\WINDOWS\system32\drivers\VHIDMini.sys
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 Pml Driver HPZ12 Net Driver HPZ12


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-13 16:00:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-13 16:01:33

--- E O F ---



HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:05:06, on 13/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
E:\Program Files\Messenger\MSMSGS.EXE
E:\Program Files\Launchy\Launchy.exe
F:\Games\Steam\Steam.exe
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\explorer.exe
E:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Documents and Settings\MiguelFP\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Program Files\Free Download Manager\iefdmcks.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Auto EPSON Stylus Photo RX420 Series on BETELGUEZE] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P50 "Auto EPSON Stylus Photo RX420 Series on BETELGUEZE" /O21 "\\BETELGUEZE\EPSONSty" /M "Stylus Photo RX420"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AtiTrayTools] "E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Launchy.lnk = E:\Program Files\Launchy\Launchy.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ISP Monitor (ISPMonitorSrv) - How2 Studios - E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5626 bytes
J

Jurgenv1

Legacy Member
* Fix de volgende regels in hijackthis:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

* Vertel dan hoe alles verder werkt.
c

cool_boy_ke

Legacy Member
Ik had nergens last van ofzo, maar kvond die "C:\WINDOWS\system32\mdm.exe" verdacht en bij Google kwam ik uit dat het een Trojan was.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:53:35, on 13/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
E:\Program Files\Bonjour\mDNSResponder.exe
E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
E:\Program Files\Messenger\MSMSGS.EXE
E:\Program Files\Launchy\Launchy.exe
E:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\MiguelFP\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Program Files\Free Download Manager\iefdmcks.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Auto EPSON Stylus Photo RX420 Series on BETELGUEZE] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P50 "Auto EPSON Stylus Photo RX420 Series on BETELGUEZE" /O21 "\\BETELGUEZE\EPSONSty" /M "Stylus Photo RX420"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AtiTrayTools] "E:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Launchy.lnk = E:\Program Files\Launchy\Launchy.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - E:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ISP Monitor (ISPMonitorSrv) - How2 Studios - E:\Program Files\ISP Monitor\ISPMonitorSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5412 bytes
c

cool_boy_ke

Legacy Member
Hmm, m'n Steam games deden raar dus heb ik geformat :) Toch bedankt

(OT: Ik zou graag eens weten wat je allemaal moet doen en kunnen om zoals jou mensen te helpen ?)
J

Jurgenv1

Legacy Member
(OT: Ik zou graag eens weten wat je allemaal moet doen en kunnen om zoals jou mensen te helpen ?)
Klik om te vergroten...
Soort opleiding in het engels, duurt wel paar maanden en enige uren per dag. :)
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan