Archief - Veel virussen

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:01:02, on 6/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\\WINDOWS\\System32\\smss.exe
C:\\WINDOWS\\system32\\csrss.exe
C:\\WINDOWS\\system32\\winlogon.exe
C:\\WINDOWS\\system32\\services.exe
C:\\WINDOWS\\system32\\lsass.exe
C:\\WINDOWS\\system32\\Ati2evxx.exe
C:\\WINDOWS\\system32\\svchost.exe
C:\\WINDOWS\\system32\\svchost.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\Program Files\\Common Files\\Symantec Shared\\ccEvtMgr.exe
C:\\WINDOWS\\system32\\Ati2evxx.exe
C:\\Program Files\\Citrix\\ICA Client\\ssonsvr.exe
C:\\WINDOWS\\system32\\spoolsv.exe
C:\\Program Files\\VPN Client\\VPN Client\\cvpnd.exe
C:\\WINDOWS\\system32\\lkcitdl.exe
C:\\WINDOWS\\system32\\lkads.exe
C:\\WINDOWS\\Explorer.EXE
C:\\WINDOWS\\system32\\lktsrv.exe
C:\\Program Files\\National Instruments\\MAX\\nimxs.exe
C:\\Program Files\\Norton AntiVirus\\navapsvc.exe
C:\\Program Files\\National Instruments\\Shared\\Security\\nidmsrv.exe
C:\\WINDOWS\\SOUNDMAN.EXE
C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe
C:\\Program Files\\CyberLink\\PowerVCRII\\Agent.exe
C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe
C:\\WINDOWS\\system32\\nisvcloc.exe
C:\\Program Files\\Winamp\\winampa.exe
C:\\Program Files\\D-Tools\\daemon.exe
C:\\Program Files\\National Instruments\\Shared\\Tagger\\tagsrv.exe
C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe
C:\\Program Files\\Spyware Doctor\\pctsTray.exe
C:\\WINDOWS\\system32\\Rundll32.exe
C:\\Program Files\\Norton AntiVirus\\AdvTools\\NPROTECT.EXE
C:\\Program Files\\MSN Messenger\\msnmsgr.exe
C:\\Program Files\\Logitech\\MouseWare\\system\\em_exec.exe
C:\\Program Files\\Spyware Doctor\\pctsAuxs.exe
C:\\Program Files\\Spyware Doctor\\pctsSvc.exe
C:\\Program Files\\JavaCore\\JavaCore.exe
C:\\Program Files\\nvcoi\\nvcoi.exe
C:\\Program Files\\U.S. Robotics 802.11g WLAN\\USRWLANG.exe
C:\\WINDOWS\\system32\\slserv.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\WINDOWS\\system32\\wdfmgr.exe
C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\SymWSC.exe
C:\\WINDOWS\\system32\\wscntfy.exe
C:\\WINDOWS\\System32\\alg.exe
C:\\Documents and Settings\\Christopher\\Bureaublad\\FixVundo.exe
C:\\Program Files\\VPN Client\\VPN Client\\vpngui.exe
C:\\Program Files\\Mozilla Firefox\\firefox.exe
C:\\Documents and Settings\\Christopher\\Bureaublad\\HiJackThis_v2.exe
C:\\WINDOWS\\System32\\wbem\\wmiprvse.exe

R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.hln.be/
R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\Program Files\\Adobe\\Acrobat 7.0\\ActiveX\\AcroIEHelper.dll
O2 - BHO: {1c84fcf1-c059-b17a-bb94-4435aa842307} - {703248aa-5344-49bb-a71b-950c1fcf48c1} - C:\\WINDOWS\\system32\\dqpnyubx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {B0F2D835-007B-4F98-9194-E8466FED7D74} - C:\\WINDOWS\\system32\\vtsqp.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\\Program Files\\Norton AntiVirus\\NavShExt.dll
O2 - BHO: (no name) - {ED120D76-BF31-412C-A99B-783C6676E128} - C:\\WINDOWS\\system32\\nnnlljg.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\\Program Files\\Norton AntiVirus\\NavShExt.dll
O4 - HKLM\\..\\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\\..\\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\\..\\Run: [SunJavaUpdateSched] "C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe"
O4 - HKLM\\..\\Run: [Agent] "C:\\Program Files\\CyberLink\\PowerVCRII\\Agent.exe"
O4 - HKLM\\..\\Run: [Remote_Agent] "C:\\Program Files\\CyberLink\\PowerVCRII\\RemoteAgent.exe"
O4 - HKLM\\..\\Run: [RemoteControl] "C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe"
O4 - HKLM\\..\\Run: [WinampAgent] "C:\\Program Files\\Winamp\\winampa.exe"
O4 - HKLM\\..\\Run: [DAEMON Tools-1033] "C:\\Program Files\\D-Tools\\daemon.exe" -lang 1033
O4 - HKLM\\..\\Run: [SideWinderTrayV4] C:\\PROGRA~1\\MICROS~4\\GAMECO~1\\common\\swtrayv4.exe
O4 - HKLM\\..\\Run: [CloneCDTray] "C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe" /s
O4 - HKLM\\..\\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\\..\\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\\..\\Run: [ccApp] C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe
O4 - HKLM\\..\\Run: [ccRegVfy] C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe
O4 - HKLM\\..\\Run: [Advanced Tools Check] C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE
O4 - HKLM\\..\\Run: [a4bf4cbd] rundll32.exe "C:\\WINDOWS\\system32\\vrwkpwum.dll",b
O4 - HKLM\\..\\Run: [ISTray] "C:\\Program Files\\Spyware Doctor\\pctsTray.exe"
O4 - HKLM\\..\\Run: [BMa78c7f21] Rundll32.exe "C:\\WINDOWS\\system32\\uxdnpgej.dll",s
O4 - HKCU\\..\\Run: [MessengerPlus3] "C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe" /WinStart
O4 - HKCU\\..\\Run: [msnmsgr] "C:\\Program Files\\MSN Messenger\\msnmsgr.exe" /background
O4 - HKCU\\..\\Run: [JavaCore] C:\\Program Files\\\\JavaCore\\\\JavaCore.exe
O4 - HKCU\\..\\Run: [nvcoi] C:\\Program Files\\nvcoi\\nvcoi.exe
O4 - HKUS\\S-1-5-19\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'Lokale service'
O4 - HKUS\\S-1-5-20\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'Netwerkservice'
O4 - HKUS\\S-1-5-18\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'SYSTEM'
O4 - HKUS\\.DEFAULT\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'Default user'
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\\Program Files\\Microsoft Office\\Office\\OSA9.EXE
O4 - Global Startup: U.S. Robotics 802.11g Wireless Network Utility.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_04\\bin\\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_04\\bin\\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\MSMSGS.EXE (file missing)
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://spacevmij.spaces.live.com/PhotoUpload/MsnPUpld.cab
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{0877ABB2-9943-4BBF-B660-058A12E822E2}: Domain = ugent.be
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{0877ABB2-9943-4BBF-B660-058A12E822E2}: NameServer = 157.193.40.42,157.193.71.1
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\Parameters: SearchList = ugent.be
O20 - Winlogon Notify: nnnlljg - nnnlljg.dll (file missing)
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\\WINDOWS\\System32\\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\\WINDOWS\\System32\\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\\WINDOWS\\system32\\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\\WINDOWS\\system32\\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\\Program Files\\Common Files\\Symantec Shared\\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\\Program Files\\Common Files\\Symantec Shared\\ccPwdSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\\Program Files\\VPN Client\\VPN Client\\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\Program Files\\Common Files\\InstallShield\\Driver\\11\\Intel 32\\IDriverT.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\\WINDOWS\\system32\\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\\WINDOWS\\system32\\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\\WINDOWS\\system32\\lktsrv.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\\Program Files\\National Instruments\\MAX\\nimxs.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\\Program Files\\Norton AntiVirus\\navapsvc.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\\Program Files\\National Instruments\\Shared\\Security\\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\\Program Files\\National Instruments\\Shared\\License Manager\\Bin\\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\\WINDOWS\\system32\\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments, Inc. - C:\\Program Files\\National Instruments\\Shared\\Tagger\\tagsrv.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\\Program Files\\Norton AntiVirus\\AdvTools\\NPROTECT.EXE
O23 - Service: OpcEnum - OPC Foundation - C:\\WINDOWS\\system32\\OpcEnum.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\\Program Files\\WinPcap\\rpcapd.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\\PROGRA~1\\COMMON~1\\SYMANT~1\\SCRIPT~1\\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\\Program Files\\Spyware Doctor\\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\\Program Files\\Spyware Doctor\\pctsSvc.exe
O23 - Service: SmartLinkService (SLService) - - C:\\WINDOWS\\SYSTEM32\\slserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\SymWSC.exe

--
End of file - 9999 bytes

die paar files die deleted/missing zijn heeft hij al handmatig via die console in winXP repair verwijderd nadat norton die vond maar niet kon verwijderen

Klik om te vergroten...

ComboFix 08-03-06.4 - Christopher 2008-03-07 11:18:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.662 [GMT 1:00]
Gestart vanuit: C:\\Documents and Settings\\Christopher\\Bureaublad\\ComboFix.exe

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\\Program Files\\Common Files\\Yazzle1281OinAdmin.exe
C:\\Program Files\\Common Files\\Yazzle1281OinUninstaller.exe
C:\\WINDOWS\\b152.exe
C:\\WINDOWS\\mrofinu.exe
C:\\WINDOWS\\mrofinu572.exe
.
---- Previous Run -------
.
C:\\Documents and Settings\\Christopher\\Application Data\\macromedia\\Flash Player\\#SharedObjects\\XFZA4Q79\\iforex.com
C:\\Documents and Settings\\Christopher\\Application Data\\macromedia\\Flash Player\\#SharedObjects\\XFZA4Q79\\iforex.com\\Emerp\\Events\\flash_object.swf\\user_data.sol
C:\\Documents and Settings\\Christopher\\Application Data\\macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#iforex.com
C:\\Documents and Settings\\Christopher\\Application Data\\macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#iforex.com\\settings.sol
C:\\Program Files\\inetget2
C:\\Program Files\\JavaCore
C:\\Program Files\\JavaCore\\JavaCore.exe
C:\\Program Files\\JavaCore\\UnInstall.exe
C:\\Program Files\\Temporary
C:\\Temp\\sanR24
C:\\WINDOWS\\BMa78c7f21.xml
C:\\WINDOWS\\Downloaded Program Files\\Quarantine
C:\\WINDOWS\\pskt.ini
C:\\WINDOWS\\system32\\dqpnyubx.dll
C:\\WINDOWS\\system32\\iDlo01
C:\\WINDOWS\\system32\\jkfpbifg.dll
C:\\WINDOWS\\system32\\kprniuxe.dll
C:\\WINDOWS\\system32\\kwllvxgf.dll
C:\\WINDOWS\\system32\\mcrh.tmp
C:\\WINDOWS\\system32\\pac.txt
C:\\WINDOWS\\system32\\pqstv.ini
C:\\WINDOWS\\system32\\pqstv.ini2
C:\\WINDOWS\\system32\\uxdnpgej.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-02-07 to 2008-03-07 ))))))))))))))))))))))))))))))
.

2008-03-06 21:24 . 2008-03-06 21:24 <DIR> d-------- C:\\Program Files\\Alwil Software
2008-03-06 21:24 . 2007-12-04 14:04 837,496 --a------ C:\\WINDOWS\\system32\\aswBoot.exe
2008-03-06 21:24 . 2004-01-09 10:13 380,928 --a------ C:\\WINDOWS\\system32\\actskin4.ocx
2008-03-06 21:24 . 2007-12-04 13:54 95,608 --a------ C:\\WINDOWS\\system32\\AvastSS.scr
2008-03-06 21:24 . 2007-12-04 15:55 94,544 --a------ C:\\WINDOWS\\system32\\drivers\\aswmon2.sys
2008-03-06 21:24 . 2007-12-04 15:56 93,264 --a------ C:\\WINDOWS\\system32\\drivers\\aswmon.sys
2008-03-06 21:24 . 2007-12-04 15:51 42,912 --a------ C:\\WINDOWS\\system32\\drivers\\aswTdi.sys
2008-03-06 21:24 . 2007-12-04 15:49 26,624 --a------ C:\\WINDOWS\\system32\\drivers\\aavmker4.sys
2008-03-06 21:24 . 2007-12-04 15:53 23,152 --a------ C:\\WINDOWS\\system32\\drivers\\aswRdr.sys
2008-03-06 11:40 . 2008-03-06 12:40 <DIR> d-------- C:\\VundoFix Backups
2008-03-06 10:57 . 2008-03-07 10:26 <DIR> d-------- C:\\Program Files\\Exterminate It!
2008-03-06 10:16 . 2005-07-23 13:41 <DIR> d--h----- C:\\Documents and Settings\\Administrator\\Sjablonen
2008-03-06 10:16 . 2005-07-23 15:33 <DIR> d--h----- C:\\Documents and Settings\\Administrator\\Onlangs geopend
2008-03-06 10:16 . 2005-07-23 15:33 <DIR> d--h----- C:\\Documents and Settings\\Administrator\\Netwerkprinteromgeving
2008-03-06 10:16 . 2005-07-23 15:33 <DIR> d-------- C:\\Documents and Settings\\Administrator\\Mijn documenten
2008-03-06 10:16 . 2005-07-23 15:33 <DIR> dr------- C:\\Documents and Settings\\Administrator\\Menu Start
2008-03-06 10:16 . 2005-07-23 15:33 <DIR> d-------- C:\\Documents and Settings\\Administrator\\Favorieten
2008-03-06 10:16 . 2005-07-23 15:33 <DIR> d-------- C:\\Documents and Settings\\Administrator\\Bureaublad
2008-03-05 14:46 . 2008-03-05 14:46 <DIR> d-------- C:\\Program Files\\nvcoi
2008-03-05 10:24 . 2008-03-05 10:24 <DIR> d-------- C:\\Program Files\\MProg 3.0a
2008-03-05 08:37 . 2008-03-06 10:03 1,303,018 ---hs---- C:\\WINDOWS\\system32\\gcjjcjys.ini
2008-03-04 14:38 . 2008-03-07 10:58 <DIR> d---s---- C:\\WINDOWS\\Tasks
2008-03-04 14:38 . 2007-12-04 12:07 <DIR> dr--s---- C:\\WINDOWS\\Fonts
2008-03-04 14:38 . 2007-12-02 08:37 <DIR> d-------- C:\\WINDOWS\\system
2008-03-04 14:38 . 2007-12-04 14:37 <DIR> d-------- C:\\WINDOWS\\Microsoft.NET
2008-03-04 14:38 . 2008-03-04 14:32 <DIR> d-------- C:\\WINDOWS\\M?crosoft
2008-03-04 14:38 . 2007-12-04 12:06 <DIR> d-------- C:\\Program Files\\Microsoft.NET
2008-03-04 14:38 . 2008-03-04 14:36 <DIR> d-------- C:\\Program Files\\s?stem32
2008-03-04 14:38 . 2008-01-10 12:14 <DIR> d---s---- C:\\Documents and Settings\\Christopher\\Application Data\\Microsoft
2008-03-04 14:37 . 2008-03-04 14:37 <DIR> d-------- C:\\WINDOWS\\system32\\A?pPatch
2008-03-04 14:37 . 2008-03-04 14:35 <DIR> d-------- C:\\WINDOWS\\system32\\?ppPatch
2008-03-04 14:37 . 2008-03-04 14:32 <DIR> d-------- C:\\WINDOWS\\system32\\a?sembly
2008-03-04 14:37 . 2008-03-04 14:32 <DIR> d-------- C:\\WINDOWS\\system32\\M?crosoft.NET
2008-03-04 14:37 . 2008-03-04 14:37 <DIR> d-------- C:\\WINDOWS\\?icrosoft
2008-03-04 14:37 . 2008-03-07 11:26 <DIR> d-------- C:\\WINDOWS\\system32
2008-03-04 14:37 . 2008-03-04 14:32 <DIR> d-------- C:\\WINDOWS\\S?mantec
2008-03-04 14:37 . 2008-03-04 14:37 <DIR> d-------- C:\\Program Files\\s?stem
2008-03-04 14:37 . 2008-03-04 14:33 <DIR> d-------- C:\\Program Files\\Common Files\\s?mbols
2008-03-04 14:37 . 2008-03-04 14:37 <DIR> d-------- C:\\Program Files\\?ssembly
2008-03-04 14:37 . 2008-03-04 14:37 <DIR> d-------- C:\\Program Files\\?icrosoft
2008-03-04 14:37 . 2008-03-04 14:37 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\s?curity
2008-03-04 14:37 . 2008-01-10 12:14 <DIR> d---s---- C:\\Documents and Settings\\Christopher\\Application Data\\Microsoft
2008-03-04 14:37 . 2008-03-04 14:31 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\?ppPatch
2008-03-04 14:37 . 2008-03-04 14:37 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\?icrosoft.NET
2008-03-04 14:37 . 2008-03-04 14:37 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\?icrosoft.NET
2008-03-04 14:37 . 2008-03-04 14:32 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\a?sembly
2008-03-04 14:37 . 2008-03-04 14:36 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\A?pPatch
2008-03-04 14:36 . 2005-07-23 14:04 <DIR> d---s---- C:\\WINDOWS\\system32\\Microsoft
2008-03-04 14:36 . 2008-03-07 10:58 <DIR> d---s---- C:\\WINDOWS\\Tasks
2008-03-04 14:36 . 2005-07-24 10:40 <DIR> d-------- C:\\WINDOWS\\AppPatch
2008-03-04 14:36 . 2008-03-04 14:36 <DIR> d-------- C:\\Program Files\\s?stem32
2008-03-04 14:36 . 2008-03-04 14:36 <DIR> d-------- C:\\Program Files\\Common Files\\A?pPatch
2008-03-04 14:36 . 2008-03-04 14:36 <DIR> d-------- C:\\Program Files\\Common Files\\?ymbols
2008-03-04 14:36 . 2008-03-04 14:33 <DIR> d-------- C:\\Program Files\\Common Files\\?ppPatch
2008-03-04 14:36 . 2008-03-04 14:33 <DIR> d-------- C:\\Program Files\\Common Files\\?icrosoft
2008-03-04 14:36 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\S?mantec
2008-03-04 14:36 . 2008-03-04 14:32 <DIR> d-------- C:\\Program Files\\?asks
2008-03-04 14:36 . 2008-03-07 10:58 <DIR> d-------- C:\\Program Files\\Symantec
2008-03-04 14:36 . 2007-12-04 12:06 <DIR> d-------- C:\\Program Files\\Microsoft.NET
2008-03-04 14:36 . 2008-03-04 14:36 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\T?sks
2008-03-04 14:36 . 2008-03-04 14:36 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\A?pPatch
2008-03-04 14:36 . 2008-01-10 12:14 <DIR> d---s---- C:\\Documents and Settings\\Christopher\\Application Data\\Microsoft
2008-03-04 14:35 . 2008-03-04 14:35 <DIR> d-------- C:\\Program Files\\Common Files\\M?crosoft.NET
2008-03-04 14:35 . 2008-03-04 14:35 <DIR> d-------- C:\\Program Files\\Common Files\\?asks
2008-03-04 14:35 . 2005-07-24 09:50 <DIR> d-------- C:\\Program Files\\Common Files\\System
2008-03-04 14:35 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\T?sks
2008-03-04 14:35 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\a?sembly
2008-03-04 14:35 . 2008-03-04 14:36 <DIR> d-------- C:\\Program Files\\Common Files\\A?pPatch
2008-03-04 14:35 . 2008-03-04 14:35 <DIR> d-------- C:\\Program Files\\Common Files\\M?crosoft.NET
2008-03-04 14:35 . 2008-03-04 14:33 <DIR> d-------- C:\\Program Files\\?ppPatch
2008-03-04 14:35 . 2008-03-04 14:31 <DIR> d-------- C:\\Program Files\\M?crosoft
2008-03-04 14:35 . 2008-02-01 10:20 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\Adobe
2008-03-04 14:35 . 2008-03-04 14:37 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\?icrosoft.NET
2008-03-04 14:35 . 2008-01-10 12:14 <DIR> d---s---- C:\\Documents and Settings\\Christopher\\Application Data\\Microsoft
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\WINDOWS\\system32\\s?stem32
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\WINDOWS\\system32\\?ystem32
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\WINDOWS\\system32\\?ymantec
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\WINDOWS\\system32\\?ecurity
2008-03-04 14:34 . 2008-03-04 14:31 <DIR> d-------- C:\\WINDOWS\\system32\\?asks
2008-03-04 14:34 . 2008-03-04 14:31 <DIR> d-------- C:\\WINDOWS\\system32\\s?mbols
2008-03-04 14:34 . 2008-03-04 14:32 <DIR> d-------- C:\\WINDOWS\\system32\\s?curity
2008-03-04 14:34 . 2007-12-04 12:07 <DIR> dr--s---- C:\\WINDOWS\\Fonts
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\WINDOWS\\?ymantec
2008-03-04 14:34 . 2005-07-24 10:40 <DIR> d-------- C:\\WINDOWS\\AppPatch
2008-03-04 14:34 . 2006-03-24 14:57 <DIR> d-------- C:\\WINDOWS\\security
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\T?sks
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\S?mantec
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\M?crosoft
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\a?sembly
2008-03-04 14:34 . 2005-07-24 09:50 <DIR> d-------- C:\\Program Files\\Common Files\\System
2008-03-04 14:34 . 2005-07-27 06:59 <DIR> d-------- C:\\Program Files\\Common Files\\Adobe
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\T?sks
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\M?crosoft
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\Common Files\\M?crosoft
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\?ystem
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Program Files\\?ecurity
2008-03-04 14:34 . 2005-12-07 14:07 <DIR> d-------- C:\\Program Files\\Adobe
2008-03-04 14:34 . 2008-03-04 14:31 <DIR> d-------- C:\\Program Files\\T?sks
2008-03-04 14:34 . 2008-03-04 14:33 <DIR> d-------- C:\\Program Files\\A?pPatch
2008-03-04 14:34 . 2008-03-04 14:34 <DIR> d-------- C:\\Documents and Settings\\Christopher\\Application Data\\s?mbols

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-07 10:13 --------- d-----w C:\\Program Files\\Common Files\\Symantec Shared
2008-03-07 10:08 --------- d-----w C:\\Documents and Settings\\All Users\\Application Data\\Symantec
2008-03-07 09:58 --------- d-----w C:\\Program Files\\Symantec
2008-03-07 02:15 --------- d---a-w C:\\Documents and Settings\\All Users\\Application Data\\TEMP
2008-03-04 14:46 --------- d-----w C:\\Program Files\\mIRC
2008-03-04 13:38 --------- d-----w C:\\Program Files\\??stem32
2008-03-04 13:38 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?icrosoft
2008-03-04 13:37 --------- d-----w C:\\Program Files\\Common Files\\??mbols
2008-03-04 13:37 --------- d-----w C:\\Program Files\\?ssembly
2008-03-04 13:37 --------- d-----w C:\\Program Files\\?icrosoft
2008-03-04 13:37 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?ppPatch
2008-03-04 13:37 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?icrosoft.NET
2008-03-04 13:37 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?icrosoft.NET
2008-03-04 13:37 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\??sembly
2008-03-04 13:37 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\??pPatch
2008-03-04 13:36 --------- d-----w C:\\Program Files\\Common Files\\?ymbols
2008-03-04 13:36 --------- d-----w C:\\Program Files\\Common Files\\?ppPatch
2008-03-04 13:36 --------- d-----w C:\\Program Files\\Common Files\\?icrosoft
2008-03-04 13:36 --------- d-----w C:\\Program Files\\Common Files\\??mantec
2008-03-04 13:36 --------- d-----w C:\\Program Files\\?asks
2008-03-04 13:36 --------- d-----w C:\\Program Files\\??mantec
2008-03-04 13:36 --------- d-----w C:\\Program Files\\??crosoft.NET
2008-03-04 13:36 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?icrosoft
2008-03-04 13:35 --------- d-----w C:\\Program Files\\Common Files\\?asks
2008-03-04 13:35 --------- d-----w C:\\Program Files\\Common Files\\??stem
2008-03-04 13:35 --------- d-----w C:\\Program Files\\Common Files\\??sks
2008-03-04 13:35 --------- d-----w C:\\Program Files\\Common Files\\??sembly
2008-03-04 13:35 --------- d-----w C:\\Program Files\\Common Files\\??pPatch
2008-03-04 13:35 --------- d-----w C:\\Program Files\\Common Files\\??crosoft.NET
2008-03-04 13:35 --------- d-----w C:\\Program Files\\?ppPatch
2008-03-04 13:35 --------- d-----w C:\\Program Files\\??crosoft
2008-03-04 13:35 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?dobe
2008-03-04 13:35 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\??crosoft.NET
2008-03-04 13:35 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\??crosoft
2008-03-04 13:33 --------- d-----w C:\\Program Files\\Common Files\\?ppPatch
2008-03-04 13:33 --------- d-----w C:\\Program Files\\Common Files\\?icrosoft
2008-03-04 13:33 --------- d-----w C:\\Program Files\\?ppPatch
2008-03-04 13:33 --------- d-----w C:\\Program Files\\?icrosoft.NET
2008-03-04 13:33 --------- d-----w C:\\Program Files\\?icrosoft
2008-03-04 13:33 --------- d-----w C:\\Program Files\\?dobe
2008-03-04 13:33 --------- d-----w C:\\Program Files\\??sembly
2008-03-04 13:33 --------- d-----w C:\\Program Files\\??mbols
2008-03-04 13:33 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?ystem
2008-03-04 13:33 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?dobe
2008-03-04 13:33 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\??pPatch
2008-03-04 13:33 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\??curity
2008-03-04 13:31 --------- d-----w C:\\Program Files\\Common Files\\?ymantec
2008-03-04 13:31 --------- d-----w C:\\Program Files\\Common Files\\?icrosoft.NET
2008-03-04 13:31 --------- d-----w C:\\Program Files\\Common Files\\??pPatch
2008-03-04 13:31 --------- d-----w C:\\Program Files\\?ymantec
2008-03-04 13:31 --------- d-----w C:\\Program Files\\?racle
2008-03-04 13:31 --------- d-----w C:\\Program Files\\?racle
2008-03-04 13:31 --------- d-----w C:\\Program Files\\??pPatch
2008-03-04 13:31 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?racle
2008-03-04 13:31 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?ppPatch
2008-03-04 13:31 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\?asks
2008-02-26 09:15 --------- d-----w C:\\Program Files\\Texas Instruments
2008-01-30 11:48 --------- d-----w C:\\Documents and Settings\\Christopher\\Application Data\\BitTorrent
2008-01-17 19:16 --------- d-----w C:\\Program Files\\MSN Messenger
2008-01-17 19:16 --------- d-----w C:\\Program Files\\Messenger Plus! Live
2007-12-16 11:50 451,072 ----a-w C:\\WINDOWS\\Radeon Omega Drivers v3.8.421 Uninstall.exe
2007-12-15 15:58 30 ----a-w C:\\deleteprefetch.bat
.

((((((((((((((((((((((((((((( snapshot@2008-03-07_10.54.50.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-07 10:26:09 16,384 ----atw C:\\WINDOWS\\Temp\\Perflib_Perfdata_6f0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"MessengerPlus3"="C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe" [2007-04-15 23:37 190024]
"msnmsgr"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe" [2007-01-19 11:54 5674352]

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"ATIPTA"="atiptaxx.exe" [2006-02-22 02:05 344064 C:\\WINDOWS\\system32\\atiptaxx.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-06-18 15:31 67584 C:\\WINDOWS\\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe" [2005-06-03 02:52 36975]
"Agent"="C:\\Program Files\\CyberLink\\PowerVCRII\\Agent.exe" [2002-10-01 14:57 94208]
"Remote_Agent"="C:\\Program Files\\CyberLink\\PowerVCRII\\RemoteAgent.exe" [2004-07-26 15:52 40960]
"RemoteControl"="C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe" [2004-11-02 19:24 32768]
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" [2005-10-27 00:01 33792]
"DAEMON Tools-1033"="C:\\Program Files\\D-Tools\\daemon.exe" [2004-08-22 17:05 81920]
"SideWinderTrayV4"="C:\\PROGRA~1\\MICROS~4\\GAMECO~1\\common\\swtrayv4.exe" [1999-05-12 19:01 20545]
"CloneCDTray"="C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe" [2005-05-19 14:47 57344]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\\WINDOWS\\LOGI_MWX.EXE]
"Tweak UI"="TWEAKUI.CPL" [2003-03-25 05:49 106544 C:\\WINDOWS\\system32\\tweakui.cpl]
"avast!"="C:\\Program Files\\Alwil Software\\Avast4\\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [2004-08-04 09:03 15360]

C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\
Adobe Reader Speed Launch.lnk - C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe [2004-12-14 04:44:06 29696]
Microsoft Office.lnk - C:\\Program Files\\Microsoft Office\\Office\\OSA9.EXE [1999-02-17 18:05:56 65588]
U.S. Robotics 802.11g Wireless Network Utility.lnk - C:\\Program Files\\U.S. Robotics 802.11g WLAN\\USRWLANG.exe [2005-07-23 13:58:19 290816]
VPN Client.lnk - C:\\WINDOWS\\Installer\\{176130BC-99A1-41FE-A78B-56045E33AD70}\\Icon3E5562ED7.ico [2007-10-08 07:59:11 6144]

[HKEY_LOCAL_MACHINE\\software\\microsoft\\windows nt\\currentversion\\winlogon\\notify\\nnnlljg]
nnnlljg.dll

[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\MSMSGS]
C:\\Program Files\\Messenger\\msmsgs.exe

[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\MsnMsgr]
--a------ 2007-01-19 11:54 5674352 C:\\Program Files\\MSN Messenger\\msnmsgr.exe

[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\QuickTime Task]
C:\\Program Files\\QuickTime\\qttask.exe

[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\Steam]
--a------ 2007-12-15 16:14 1266936 C:\\Games\\Steam\\Steam.exe

[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\services]
"usnsvc"=3 (0x3)
"lanmanserver"=2 (0x2)

[HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\\~\\services\\sharedaccess\\parameters\\firewallpolicy\\standardprofile\\AuthorizedApplications\\List]
"%windir%\\\\system32\\\\sessmgr.exe"=
"C:\\\\eMule\\\\emule.exe"=
"C:\\\\Program Files\\\\SmartFTP\\\\SmartFTP.exe"=
"C:\\\\Program Files\\\\mIRC\\\\mirc.exe"=
"C:\\\\Games\\\\Steam\\\\Steam.exe"=
"C:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe"=
"C:\\\\Program Files\\\\Maple 8\\\\bin.win\\\\mserver.exe"=
"C:\\\\Program Files\\\\BearShare\\\\BearShare.exe"=
"C:\\\\MATLAB701\\\\bin\\\\win32\\\\MATLAB.exe"=
"C:\\\\Program Files\\\\Skype\\\\Phone\\\\Skype.exe"=
"C:\\\\Program Files\\\\Java\\\\jre1.5.0_04\\\\bin\\\\javaw.exe"=
"C:\\\\WINDOWS\\\\system32\\\\javaw.exe"=
"C:\\\\WINDOWS\\\\system32\\\\java.exe"=
"C:\\\\Program Files\\\\USRWLAN\\\\USR 11G AP Utility\\\\Wireless_AP_Utility.exe"=
"C:\\\\Program Files\\\\SmartFTP Client 2.0\\\\SmartFTP.exe"=
"C:\\\\Program Files\\\\MSN Messenger\\\\msnmsgr.exe"=
"C:\\\\Program Files\\\\BitTorrent\\\\bittorrent.exe"=

R1 atitray;atitray;C:\\Program Files\\Radeon Omega Drivers\\v3.8.421\\ATI Tray Tools\\atitray.sys [2007-10-16 10:42]
R2 cvintdrv;cvintdrv;C:\\WINDOWS\\system32\\drivers\\cvintdrv.sys [2006-07-27 10:00]
R2 DriverX;DriverX;C:\\WINDOWS\\system32\\drivers\\DRIVERX.SYS [2003-11-16 18:08]
R2 mxssvr;NI Configuration Manager;"C:\\Program Files\\National Instruments\\MAX\\nimxs.exe" [2006-07-15 19:47]
R2 NITaggerService;National Instruments Variable Engine;"C:\\Program Files\\National Instruments\\Shared\\Tagger\\tagsrv.exe" [2006-07-25 17:36]
R3 CONAN;CONAN;C:\\WINDOWS\\system32\\drivers\\o2mmb.sys [2004-02-12 09:18]
R3 MbxStby;MbxStby;C:\\WINDOWS\\system32\\drivers\\MbxStby.sys [2004-01-28 22:15]
S2 Ca533av;Icatch(IV) Video Camera Device;C:\\WINDOWS\\system32\\Drivers\\Ca533av.sys [2002-10-21 10:37]
S3 pohci13F;pohci13F;C:\\DOCUME~1\\CHRIST~1\\LOCALS~1\\Temp\\pohci13F.sys [2001-09-05 13:05]
S3 USBCamera;Icatch(IV) Still Camera Device;C:\\WINDOWS\\system32\\Drivers\\Bulk533.sys [2002-07-25 10:19]
S3 V0080Dev;Creative Camera VF0080 Driver;C:\\WINDOWS\\system32\\DRIVERS\\V0080Dev.sys [2004-10-09 17:51]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\Remote Debugger\\x86\\msvsmon.exe" /service msvsmon80 []

[HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\mountpoints2\\{f7008f6f-5a1b-11db-9187-00030d14f81f}]
\\Shell\\AutoRun\\command - E:\\setupSNK.exe

.
Inhoud van de 'Gedeelde Taken' map
"2008-03-07 10:30:54 C:\\WINDOWS\\Tasks\\Symantec NetDetect.job"
- C:\\Program Files\\Symantec\\LiveUpdate\\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-07 11:27:08
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

PROCESS: C:\\WINDOWS\\explorer.exe [6.00.2900.2180]
-> C:\\Program Files\\WinRAR\\rarext.dll
.
Voltooingstijd: 2008-03-07 11:38:37
ComboFix-quarantined-files.txt 2008-03-07 10:38:32

Klik om te vergroten...

ogfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:46:49, on 7/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\\WINDOWS\\System32\\smss.exe
C:\\WINDOWS\\system32\\winlogon.exe
C:\\WINDOWS\\system32\\services.exe
C:\\WINDOWS\\system32\\lsass.exe
C:\\WINDOWS\\system32\\Ati2evxx.exe
C:\\WINDOWS\\system32\\svchost.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\Program Files\\Alwil Software\\Avast4\\aswUpdSv.exe
C:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe
C:\\WINDOWS\\system32\\Ati2evxx.exe
C:\\Program Files\\Citrix\\ICA Client\\ssonsvr.exe
C:\\WINDOWS\\system32\\spoolsv.exe
C:\\Program Files\\VPN Client\\VPN Client\\cvpnd.exe
C:\\WINDOWS\\system32\\lkcitdl.exe
C:\\WINDOWS\\system32\\lkads.exe
C:\\WINDOWS\\system32\\lktsrv.exe
C:\\Program Files\\National Instruments\\MAX\\nimxs.exe
C:\\Program Files\\National Instruments\\Shared\\Security\\nidmsrv.exe
C:\\WINDOWS\\system32\\nisvcloc.exe
C:\\Program Files\\National Instruments\\Shared\\Tagger\\tagsrv.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\WINDOWS\\system32\\wscntfy.exe
C:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe
C:\\Program Files\\Alwil Software\\Avast4\\ashWebSv.exe
C:\\WINDOWS\\system32\\CF30165.exe
C:\\WINDOWS\\SOUNDMAN.EXE
C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe
C:\\Program Files\\CyberLink\\PowerVCRII\\Agent.exe
C:\\Program Files\\CyberLink\\PowerVCRII\\RemoteAgent.exe
C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe
C:\\Program Files\\Winamp\\winampa.exe
C:\\Program Files\\D-Tools\\daemon.exe
C:\\PROGRA~1\\MICROS~4\\GAMECO~1\\common\\swtrayv4.exe
C:\\Program Files\\Alwil Software\\Avast4\\ashDisp.exe
C:\\Program Files\\Logitech\\MouseWare\\system\\em_exec.exe
C:\\Program Files\\MSN Messenger\\msnmsgr.exe
C:\\Program Files\\U.S. Robotics 802.11g WLAN\\USRWLANG.exe
C:\\WINDOWS\\explorer.exe
C:\\Program Files\\VPN Client\\VPN Client\\vpngui.exe
C:\\Program Files\\MSN Messenger\\usnsvc.exe
C:\\Program Files\\Alwil Software\\Avast4\\ashSimpl.exe
C:\\Program Files\\Mozilla Firefox\\firefox.exe
C:\\Documents and Settings\\Christopher\\Bureaublad\\HiJackThis_v2.exe

R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.hln.be/
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\\..\\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\\..\\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\\..\\Run: [SunJavaUpdateSched] "C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe"
O4 - HKLM\\..\\Run: [Agent] "C:\\Program Files\\CyberLink\\PowerVCRII\\Agent.exe"
O4 - HKLM\\..\\Run: [Remote_Agent] "C:\\Program Files\\CyberLink\\PowerVCRII\\RemoteAgent.exe"
O4 - HKLM\\..\\Run: [RemoteControl] "C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe"
O4 - HKLM\\..\\Run: [WinampAgent] "C:\\Program Files\\Winamp\\winampa.exe"
O4 - HKLM\\..\\Run: [DAEMON Tools-1033] "C:\\Program Files\\D-Tools\\daemon.exe" -lang 1033
O4 - HKLM\\..\\Run: [SideWinderTrayV4] C:\\PROGRA~1\\MICROS~4\\GAMECO~1\\common\\swtrayv4.exe
O4 - HKLM\\..\\Run: [CloneCDTray] "C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe" /s
O4 - HKLM\\..\\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\\..\\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\\..\\Run: [avast!] "C:\\Program Files\\Alwil Software\\Avast4\\ashDisp.exe"
O4 - HKCU\\..\\Run: [MessengerPlus3] "C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe" /WinStart
O4 - HKCU\\..\\Run: [msnmsgr] "C:\\Program Files\\MSN Messenger\\msnmsgr.exe" /background
O4 - HKUS\\S-1-5-19\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'Lokale service'
O4 - HKUS\\S-1-5-20\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'Netwerkservice'
O4 - HKUS\\S-1-5-18\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'SYSTEM'
O4 - HKUS\\.DEFAULT\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\System32\\CTFMON.EXE (User 'Default user'
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\\Program Files\\Microsoft Office\\Office\\OSA9.EXE
O4 - Global Startup: U.S. Robotics 802.11g Wireless Network Utility.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_04\\bin\\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_04\\bin\\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\MSMSGS.EXE (file missing)
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://spacevmij.spaces.live.com/PhotoUpload/MsnPUpld.cab
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{0877ABB2-9943-4BBF-B660-058A12E822E2}: Domain = ugent.be
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{0877ABB2-9943-4BBF-B660-058A12E822E2}: NameServer = 157.193.40.42,157.193.71.1
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\Parameters: SearchList = ugent.be
O20 - Winlogon Notify: nnnlljg - nnnlljg.dll (file missing)
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\\WINDOWS\\System32\\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\\WINDOWS\\System32\\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\\Program Files\\Alwil Software\\Avast4\\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\\WINDOWS\\system32\\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\\WINDOWS\\system32\\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\\Program Files\\Alwil Software\\Avast4\\ashWebSv.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\\Program Files\\VPN Client\\VPN Client\\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\Program Files\\Common Files\\InstallShield\\Driver\\11\\Intel 32\\IDriverT.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\\WINDOWS\\system32\\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\\WINDOWS\\system32\\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\\WINDOWS\\system32\\lktsrv.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - C:\\Program Files\\National Instruments\\MAX\\nimxs.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\\Program Files\\National Instruments\\Shared\\Security\\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - C:\\Program Files\\National Instruments\\Shared\\License Manager\\Bin\\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\\WINDOWS\\system32\\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments, Inc. - C:\\Program Files\\National Instruments\\Shared\\Tagger\\tagsrv.exe
O23 - Service: OpcEnum - OPC Foundation - C:\\WINDOWS\\system32\\OpcEnum.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\\Program Files\\WinPcap\\rpcapd.exe
O23 - Service: SmartLinkService (SLService) - - C:\\WINDOWS\\SYSTEM32\\slserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\SymWSC.exe

--
End of file - 8089 bytes

Klik om te vergroten...

• Download en installeer AVG Anti-Spyware.
• Na de installatie open je AVG Anti-Spyware.
• Onder 'Status' klik je naast 'Resident shield' op Change state. (deze moet op 'Inactive' komen te staan)
  Wil je het Resident shield gebruiken in de toekomst, dan laat je dit op "Active" staan.
• Onder 'Status' klik je bij Last Update op Update now.
  Lukt dit niet, dan ga je in het menu naar 'Update' en klik je bij 'Manual update' op de knop Start update.
  
• Onder 'Scanner' ga je naar de tab 'Settings' en zorg je voor de volgende instellingen:
  • onder 'How to act?', klik je op 'Recommended actions' en selecteer je Quarantine.
  • onder 'How to scan?', zorg je dat alle opties geselecteerd zijn.
  • onder 'Possibly unwanted software:', zorg je dat alle opties geselecteerd zijn.
  • onder 'Reports:', selecteer je Automatically generate report after every scan.
  • onder 'Reports:', verwijder je het vinkje bij Only if threats were found.
  • onder 'What to scan?', selecteer je Scan every file.
• Sluit AVG Anti-Spyware. Laat het nog niet scannen.
• Start de computer op in veilige modus. Hoe je dit doet kan je hier lezen.
• Start AVG Anti-Spyware.
• Klik in het menu op 'Scanner'
• Kies Complete system scan.
• AVG Anti-Spyware gaat nu je volledige computer scannen.
• Als de scan beëindigd is, klik je onderaan op de knop Apply all Actions.
• Wacht to je de melding krijgt 'All actions have been applied'.
• Ga in het menu naar 'Reports', en klik op de knop 'Save report as' en sla het rapport van de scan op op je bureaublad.
• Sluit AVG Anti-Spyware af.
• Herstart de computer in normale modus en post het rapport van AVG Anti-Spyware.