Archief - Virussen/spyware/traag internet

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
N

NielsParedis

Legacy Member
hoi,

Op de pc van ons ma en pa staat ene hoop rommel. Krijg de hele tijd op up vensters met reclame voor antivirus. De avg virusscan geeft constant gevonden virussen aan in temp internet files. Deze komen terug als ik ze heb leeggemaakt..

heb al gescand met adaware,ctf cleaner,search and destroy bot.

Dit in veilige modulus.Het gekke is dat ik in veilige modulus zelfs geen explorer krijg start ik deze handmatig op verdwijnt hij na enkele seconden....geen idee wat er met deze pc aan de hand is...

Hier het logje

Logfile of HijackThis v1.99.1
Scan saved at 21:01:16, on 30/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\LckFldService.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\DriveCleaner Free\udcwap.exe
C:\windows\system32\echraz.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
C:\PROGRA~1\Gomez\GOMEZP~1\jre\bin\java.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Paredis\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WA6PM_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcwap.exe"
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\lvuxsjpv.dll",realset
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Gomez PEER.lnk = C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...apple.com/snape/us/win/QuickTimeInstaller.exe
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} (Sandlot Loader Control) - http://www.shockwave.com/content/snailmail/sis/slgwebinstall.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.100.53.122/activex/AxisCamControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...amai.com/6712/player/install3.5/installer.exe
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\nhsuksme.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

bedankt
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
N

NielsParedis

Legacy Member
"Paredis" - 2007-07-01 12:35:35 - ComboFix 07-06-27.7 - Service Pack 2 NTFS

/wow section not completed

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\aeemsbyv.dll
C:\WINDOWS\system32\ahvnwnhd.dll
C:\WINDOWS\system32\aksykstc.dll
C:\WINDOWS\system32\arocsnot.dll
C:\WINDOWS\system32\axammdfm.dll
C:\WINDOWS\system32\bgywrogy.dll
C:\WINDOWS\system32\bobilqub.dll
C:\WINDOWS\system32\caatsaiw.dll
C:\WINDOWS\system32\cbquqonc.dll
C:\WINDOWS\system32\cdrlnkwl.dll
C:\WINDOWS\system32\cktrarhh.dll
C:\WINDOWS\system32\cuipjltp.dll
C:\WINDOWS\system32\denoyyms.dll
C:\WINDOWS\system32\dsnrjftv.dll
C:\WINDOWS\system32\eegnehsd.dll
C:\WINDOWS\system32\egtlvvtk.dll
C:\WINDOWS\system32\ekayewhm.dll
C:\WINDOWS\system32\evaetduy.dll
C:\WINDOWS\system32\evaktemh.dll
C:\WINDOWS\system32\fhixkqxp.dll
C:\WINDOWS\system32\fswjrnej.dll
C:\WINDOWS\system32\gfwvxwfg.dll
C:\WINDOWS\system32\gykfjsvk.dll
C:\WINDOWS\system32\hjcteqwo.dll
C:\WINDOWS\system32\hripigve.dll
C:\WINDOWS\system32\iauvburt.dll
C:\WINDOWS\system32\jswyfchh.dll
C:\WINDOWS\system32\jycwebyn.dll
C:\WINDOWS\system32\lvuxsjpv.dll
C:\WINDOWS\system32\mvvvvylw.dll
C:\WINDOWS\system32\nqxqveey.dll
C:\WINDOWS\system32\nwbkghlx.dll
C:\WINDOWS\system32\nydjftqi.dll
C:\WINDOWS\system32\ooxnxpcp.dll
C:\WINDOWS\system32\pwlnonnr.dll
C:\WINDOWS\system32\qaropbhf.dll
C:\WINDOWS\system32\qigfatad.dll
C:\WINDOWS\system32\qktbbwce.dll
C:\WINDOWS\system32\rcmhuihp.dll
C:\WINDOWS\system32\rgdatlcl.dll
C:\WINDOWS\system32\rrjbgjft.dll
C:\WINDOWS\system32\rrooyafp.dll
C:\WINDOWS\system32\smvrqtyo.dll
C:\WINDOWS\system32\swxuarva.dll
C:\WINDOWS\system32\tfbnjjgg.dll
C:\WINDOWS\system32\ubqonxlt.dll
C:\WINDOWS\system32\ufpjiecm.dll
C:\WINDOWS\system32\vgnbxpry.dll
C:\WINDOWS\system32\xdrpljsv.dll
C:\WINDOWS\system32\xdwldphv.dll
C:\WINDOWS\system32\xxohfgjs.dll
C:\WINDOWS\system32\ydrwdrtl.dll
C:\WINDOWS\system32\vybsmeea.ini
C:\WINDOWS\system32\dhnwnvha.ini
C:\WINDOWS\system32\ctskyska.ini
C:\WINDOWS\system32\tonscora.ini
C:\WINDOWS\system32\mfdmmaxa.ini
C:\WINDOWS\system32\ygorwygb.ini
C:\WINDOWS\system32\buqlibob.ini
C:\WINDOWS\system32\wiastaac.ini
C:\WINDOWS\system32\cnoquqbc.ini
C:\WINDOWS\system32\lwknlrdc.ini
C:\WINDOWS\system32\hhrartkc.ini
C:\WINDOWS\system32\ptljpiuc.ini
C:\WINDOWS\system32\smyyoned.ini
C:\WINDOWS\system32\vtfjrnsd.ini
C:\WINDOWS\system32\dshengee.ini
C:\WINDOWS\system32\ktvvltge.ini
C:\WINDOWS\system32\mhweyake.ini
C:\WINDOWS\system32\yudteave.ini
C:\WINDOWS\system32\hmetkave.ini
C:\WINDOWS\system32\pxqkxihf.ini
C:\WINDOWS\system32\jenrjwsf.ini
C:\WINDOWS\system32\cdeeg.bak1
C:\WINDOWS\system32\cdeeg.bak2
C:\WINDOWS\system32\cdeeg.ini
C:\WINDOWS\system32\cdeeg.ini2
C:\WINDOWS\system32\cdeeg.tmp
C:\WINDOWS\system32\gfwxvwfg.ini
C:\WINDOWS\system32\kvsjfkyg.ini
C:\WINDOWS\system32\owqetcjh.ini
C:\WINDOWS\system32\evgipirh.ini
C:\WINDOWS\system32\trubvuai.ini
C:\WINDOWS\system32\trubvuai.tmp
C:\WINDOWS\system32\hhcfywsj.ini
C:\WINDOWS\system32\nybewcyj.ini
C:\WINDOWS\system32\vpjsxuvl.ini
C:\WINDOWS\system32\wlyvvvvm.ini
C:\WINDOWS\system32\yeevqxqn.ini
C:\WINDOWS\system32\xlhgkbwn.ini
C:\WINDOWS\system32\pcpxnxoo.ini
C:\WINDOWS\system32\rnnonlwp.ini
C:\WINDOWS\system32\fhbporaq.ini
C:\WINDOWS\system32\datafgiq.ini
C:\WINDOWS\system32\ecwbbtkq.ini
C:\WINDOWS\system32\phiuhmcr.ini
C:\WINDOWS\system32\lcltadgr.ini
C:\WINDOWS\system32\tfjgbjrr.ini
C:\WINDOWS\system32\pfayoorr.ini
C:\WINDOWS\system32\oytqrvms.ini
C:\WINDOWS\system32\avrauxws.ini
C:\WINDOWS\system32\ggjjnbft.ini
C:\WINDOWS\system32\mceijpfu.ini
C:\WINDOWS\system32\yrpxbngv.ini
C:\WINDOWS\system32\vsjlprdx.ini
C:\WINDOWS\system32\vhpdlwdx.ini
C:\WINDOWS\system32\sjgfhoxx.ini
C:\WINDOWS\system32\ltrdwrdy.ini
C:\WINDOWS\system32\cdeeg.bak1
C:\WINDOWS\system32\cdeeg.bak2
C:\WINDOWS\system32\cdeeg.ini
C:\WINDOWS\system32\cdeeg.ini2
C:\WINDOWS\system32\cdeeg.tmp
C:\WINDOWS\system32\cdeeg.bak1
C:\WINDOWS\system32\cdeeg.bak2
C:\WINDOWS\system32\cdeeg.ini
C:\WINDOWS\system32\cdeeg.ini2
C:\WINDOWS\system32\cdeeg.tmp
C:\WINDOWS\system32\geedc.dll
C:\WINDOWS\system32\ddcyawu.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Paredis\APPLIC~1\Install.dat
C:\Program Files\Common Files\drivecleaner free
C:\Program Files\Common Files\drivecleaner free\udcwap.exe
C:\WINDOWS\system32\echraz.dat
C:\WINDOWS\system32\echraz.exe
C:\WINDOWS\system32\echraz_nav.dat
C:\WINDOWS\system32\echraz_navps.dat
C:\WINDOWS\system32\nvs2.inf


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-06-01 to 2007-07-01 )))))))))))))))))))))))))))))))


2007-07-01 12:35 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-30 20:48 <DIR> d-------- C:\Program Files\Gomez
2007-06-30 20:05 <DIR> dr-h----- C:\DOCUME~1\Paredis\Onlangs geopend
2007-06-30 19:53 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-30 19:53 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-06-30 19:53 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Sjablonen
2007-06-30 19:53 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Onlangs geopend
2007-06-30 19:53 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Netwerkprinteromgeving
2007-06-30 19:53 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Mijn documenten
2007-06-30 19:53 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Favorieten
2007-06-30 19:53 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Bureaublad
2007-06-30 19:50 <DIR> d-------- C:\Program Files\CCleaner
2007-06-30 19:40 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-06-30 19:39 <DIR> d-------- C:\Program Files\TweakNow RegCleaner Std
2007-06-23 06:32 4,628 --a------ C:\WINDOWS\system32\ganmuxgv.exe
2007-06-21 19:11 86,036 --a------ C:\WINDOWS\system32\dudxoemh.exe
2007-06-21 19:02 86,036 --a------ C:\WINDOWS\system32\xjoljata.exe
2007-06-07 08:04 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-30 18:48:02 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-30 17:45:38 -------- d-----w C:\Program Files\QuickTime
2007-06-30 11:42:41 -------- d-----w C:\Program Files\Windows Live Safety Center
2007-06-21 16:14:55 -------- d-----w C:\Program Files\Virtual DJ
2007-05-25 06:40:45 13 ----a-w C:\WINDOWS\system32\mslck.dat
2007-05-21 19:12:49 -------- d-----w C:\Program Files\Virtools Web Player 3.5
2007-05-20 14:56:16 -------- d-----w C:\DOCUME~1\Paredis\APPLIC~1\Raptisoft
2007-05-18 09:13:55 -------- d-----w C:\DOCUME~1\Paredis\APPLIC~1\Ice Age 2
2007-05-16 15:19:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-10 11:53:00 54,464 ----a-w C:\WINDOWS\system32\perfc013.dat
2007-05-10 11:53:00 367,286 ----a-w C:\WINDOWS\system32\perfh013.dat
2007-05-09 21:13:50 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-06 15:21:42 -------- d-----w C:\DOCUME~1\Paredis\APPLIC~1\GetRightToGo
2007-05-03 12:24:53 -------- d-----w C:\DOCUME~1\Paredis\APPLIC~1\BearShare
2007-04-25 14:22:52 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:15:26 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2007-04-08 12:13:13 131,584 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 19:38]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2005-05-31 01:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-07-07 12:29]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [2003-03-04 11:50 C:\WINDOWS\LOGI_MWX.EXE]
"LVCOMS"="C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54]
"LogitechGalleryRepair"="C:\Program Files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 18:32]
"LogitechImageStudioTray"="C:\Program Files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 18:31]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"SoundMan"="SOUNDMAN.EXE" [2002-11-19 15:01 C:\WINDOWS\soundman.exe]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57]
"nwiz"="nwiz.exe" [2006-06-01 17:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 17:22 C:\WINDOWS\system32\nvmctray.dll]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-23 08:51]
"WA6PM_Check"="C:\Program Files\Common Files\DriveCleaner Free\udcwap.exe" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 17:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-07-29 20:34]
"PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2003-04-29 11:40]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhdn32]
winhdn32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Usnsvc usnsvc


Contents of the 'Scheduled Tasks' folder
2007-06-29 15:15:00 C:\WINDOWS\tasks\1-Click Maintenance.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-01 12:41:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-01 12:43:46 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-01 12:43

--- E O F ---
N

NielsParedis

Legacy Member
Code: 
2005-11-27 11:14      2233783    --a--c---    C:\Qoobox\Quarantine\C\DOCUME~1\Paredis\APPLIC~1\Install.dat.vir
2007-04-19 17:58      163840    --a------    C:\Qoobox\Quarantine\C\Program Files\Common Files\DriveCleaner Free\udcwap.exe.vir
2007-06-03 00:14      33302    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ddcyawu.dll.vir
2007-06-03 00:23      263220    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\geedc.dll.vir
2007-06-06 13:18      668040    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cdeeg.ini.vir
2007-06-06 13:18      668040    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cdeeg.tmp.vir
2007-06-12 06:35      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\iauvburt.dll.vir
2007-06-12 15:16      3049992    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\trubvuai.ini.vir
2007-06-12 15:17      0    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\trubvuai.tmp.vir
2007-06-13 08:27      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\qigfatad.dll.vir
2007-06-13 08:27      948641    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\datafgiq.ini.vir
2007-06-14 08:41      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\caatsaiw.dll.vir
2007-06-14 08:42      931564    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\wiastaac.ini.vir
2007-06-15 08:23      125972    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\nydjftqi.dll.vir
2007-06-16 06:42      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\hripigve.dll.vir
2007-06-16 06:42      922250    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\evgipirh.ini.vir
2007-06-16 07:04      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\aeemsbyv.dll.vir
2007-06-16 07:04      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vybsmeea.ini.vir
2007-06-16 07:10      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\xdwldphv.dll.vir
2007-06-16 07:10      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vhpdlwdx.ini.vir
2007-06-16 13:40      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ekayewhm.dll.vir
2007-06-16 13:40      921890    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mhweyake.ini.vir
2007-06-16 15:31      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mvvvvylw.dll.vir
2007-06-16 15:31      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\wlyvvvvm.ini.vir
2007-06-16 15:39      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cuipjltp.dll.vir
2007-06-16 15:39      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ptljpiuc.ini.vir
2007-06-16 16:48      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\bobilqub.dll.vir
2007-06-16 16:48      465    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\buqlibob.ini.vir
2007-06-16 16:57      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cdrlnkwl.dll.vir
2007-06-16 16:57      921770    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\lwknlrdc.ini.vir
2007-06-16 17:24      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pwlnonnr.dll.vir
2007-06-16 17:24      921770    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\rnnonlwp.ini.vir
2007-06-16 18:28      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\gykfjsvk.dll.vir
2007-06-16 18:29      921770    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\kvsjfkyg.ini.vir
2007-06-16 20:13      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\denoyyms.dll.vir
2007-06-16 20:13      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\smyyoned.ini.vir
2007-06-16 21:16      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\rgdatlcl.dll.vir
2007-06-16 21:16      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\lcltadgr.ini.vir
2007-06-16 21:33      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ahvnwnhd.dll.vir
2007-06-16 21:33      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\dhnwnvha.ini.vir
2007-06-17 11:48      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cktrarhh.dll.vir
2007-06-17 11:48      922010    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\hhrartkc.ini.vir
2007-06-17 12:56      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\swxuarva.dll.vir
2007-06-17 12:57      921770    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\avrauxws.ini.vir
2007-06-17 15:07      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\qaropbhf.dll.vir
2007-06-17 15:07      921770    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\fhbporaq.ini.vir
2007-06-17 15:39      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\axammdfm.dll.vir
2007-06-17 15:39      921770    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mfdmmaxa.ini.vir
2007-06-17 16:03      125972    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ubqonxlt.dll.vir
2007-06-17 16:12      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\nqxqveey.dll.vir
2007-06-17 16:12      921770    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\yeevqxqn.ini.vir
2007-06-17 18:36      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\rrjbgjft.dll.vir
2007-06-17 18:37      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tfjgbjrr.ini.vir
2007-06-17 21:04      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\rcmhuihp.dll.vir
2007-06-17 21:07      921779    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\phiuhmcr.ini.vir
2007-06-18 08:12      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\eegnehsd.dll.vir
2007-06-18 08:13      921890    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\dshengee.ini.vir
2007-06-18 20:12      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\qktbbwce.dll.vir
2007-06-18 20:12      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ecwbbtkq.ini.vir
2007-06-19 08:05      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\jswyfchh.dll.vir
2007-06-19 08:05      898763    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\hhcfywsj.ini.vir
2007-06-19 13:00      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\xxohfgjs.dll.vir
2007-06-19 13:01      898656    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\sjgfhoxx.ini.vir
2007-06-20 14:04      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\gfwvxwfg.dll.vir
2007-06-20 14:04      901082    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\gfwxvwfg.ini.vir
2007-06-20 14:17      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\dsnrjftv.dll.vir
2007-06-20 14:17      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vtfjrnsd.ini.vir
2007-06-20 14:27      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\arocsnot.dll.vir
2007-06-20 14:27      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tonscora.ini.vir
2007-06-20 15:40      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\xdrpljsv.dll.vir
2007-06-20 15:40      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vsjlprdx.ini.vir
2007-06-20 18:38      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\jycwebyn.dll.vir
2007-06-20 18:39      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\nybewcyj.ini.vir
2007-06-20 21:07      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\egtlvvtk.dll.vir
2007-06-20 21:07      907011    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ktvvltge.ini.vir
2007-06-21 07:11      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\hjcteqwo.dll.vir
2007-06-21 07:54      907148    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\owqetcjh.ini.vir
2007-06-21 13:12      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\rrooyafp.dll.vir
2007-06-21 19:00      906191    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pfayoorr.ini.vir
2007-06-21 19:02      22    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\nvs2.inf.vir
2007-06-21 19:02      254865    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\echraz_nav.dat.vir
2007-06-21 19:14      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\evaktemh.dll.vir
2007-06-21 19:14      908903    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\hmetkave.ini.vir
2007-06-21 19:27      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\aksykstc.dll.vir
2007-06-21 19:27      908903    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ctskyska.ini.vir
2007-06-21 21:01      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\evaetduy.dll.vir
2007-06-21 21:01      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\yudteave.ini.vir
2007-06-22 07:33      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vgnbxpry.dll.vir
2007-06-22 07:34      909023    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\yrpxbngv.ini.vir
2007-06-22 08:20      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\fhixkqxp.dll.vir
2007-06-22 08:20      908903    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pxqkxihf.ini.vir
2007-06-22 12:21      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ufpjiecm.dll.vir
2007-06-22 12:22      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mceijpfu.ini.vir
2007-06-24 09:51      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ooxnxpcp.dll.vir
2007-06-24 12:20      915145    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pcpxnxoo.ini.vir
2007-06-25 18:39      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\fswjrnej.dll.vir
2007-06-25 18:40      914767    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\jenrjwsf.ini.vir
2007-06-25 22:27      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cbquqonc.dll.vir
2007-06-25 23:00      914536    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cnoquqbc.ini.vir
2007-06-26 11:27      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tfbnjjgg.dll.vir
2007-06-26 11:27      645    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ggjjnbft.ini.vir
2007-06-27 07:14      585    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ygorwygb.ini.vir
2007-06-27 07:20      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\bgywrogy.dll.vir
2007-06-27 19:04      270848    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\echraz.exe.vir
2007-06-29 18:48      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\nwbkghlx.dll.vir
2007-06-29 18:49      1002503    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\xlhgkbwn.ini.vir
2007-06-30 20:53      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\lvuxsjpv.dll.vir
2007-07-01 08:32      1000166    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vpjsxuvl.ini.vir
2007-07-01 08:36      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\smvrqtyo.dll.vir
2007-07-01 08:37      1000226    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\oytqrvms.ini.vir
2007-07-01 11:16      935084    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cdeeg.bak2.vir
2007-07-01 11:16      935475    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cdeeg.bak1.vir
2007-07-01 11:24      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ydrwdrtl.dll.vir
2007-07-01 12:35      999567    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ltrdwrdy.ini.vir
2007-07-01 12:38      1125    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\echraz_navps.dat.vir
2007-07-01 12:38      16078    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\echraz.dat.vir
2007-07-01 12:39      2956    --a------    C:\Qoobox\Quarantine\Registry_backups\services_DomainService.reg.cf
2007-07-01 12:39      846    --a------    C:\Qoobox\Quarantine\Registry_backups\LEGACY_DOMAINSERVICE.reg.cf
2007-07-01 12:39      930999    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cdeeg.ini2.vir
2007-07-01 12:40      104    --a------    C:\Qoobox\Quarantine\catchme.log


Map PATH-lijst
Het volumenummer is 4612-4ED5
C:\QOOBOX
\---Quarantine
    |   catchme.log
    |   
    +---C
    |   +---DOCUME~1
    |   |   \---Paredis
    |   |       \---APPLIC~1
    |   |               Install.dat.vir
    |   |               
    |   +---Program Files
    |   |   \---Common Files
    |   |       \---DriveCleaner Free
    |   |               udcwap.exe.vir
    |   |               
    |   \---WINDOWS
    |       \---system32
    |               aeemsbyv.dll.vir
    |               ahvnwnhd.dll.vir
    |               aksykstc.dll.vir
    |               arocsnot.dll.vir
    |               avrauxws.ini.vir
    |               axammdfm.dll.vir
    |               bgywrogy.dll.vir
    |               bobilqub.dll.vir
    |               buqlibob.ini.vir
    |               caatsaiw.dll.vir
    |               cbquqonc.dll.vir
    |               cdeeg.bak1.vir
    |               cdeeg.bak2.vir
    |               cdeeg.ini.vir
    |               cdeeg.ini2.vir
    |               cdeeg.tmp.vir
    |               cdrlnkwl.dll.vir
    |               cktrarhh.dll.vir
    |               cnoquqbc.ini.vir
    |               ctskyska.ini.vir
    |               cuipjltp.dll.vir
    |               datafgiq.ini.vir
    |               ddcyawu.dll.vir
    |               denoyyms.dll.vir
    |               dhnwnvha.ini.vir
    |               dshengee.ini.vir
    |               dsnrjftv.dll.vir
    |               echraz.dat.vir
    |               echraz.exe.vir
    |               echraz_nav.dat.vir
    |               echraz_navps.dat.vir
    |               ecwbbtkq.ini.vir
    |               eegnehsd.dll.vir
    |               egtlvvtk.dll.vir
    |               ekayewhm.dll.vir
    |               evaetduy.dll.vir
    |               evaktemh.dll.vir
    |               evgipirh.ini.vir
    |               fhbporaq.ini.vir
    |               fhixkqxp.dll.vir
    |               fswjrnej.dll.vir
    |               geedc.dll.vir
    |               gfwvxwfg.dll.vir
    |               gfwxvwfg.ini.vir
    |               ggjjnbft.ini.vir
    |               gykfjsvk.dll.vir
    |               hhcfywsj.ini.vir
    |               hhrartkc.ini.vir
    |               hjcteqwo.dll.vir
    |               hmetkave.ini.vir
    |               hripigve.dll.vir
    |               iauvburt.dll.vir
    |               jenrjwsf.ini.vir
    |               jswyfchh.dll.vir
    |               jycwebyn.dll.vir
    |               ktvvltge.ini.vir
    |               kvsjfkyg.ini.vir
    |               lcltadgr.ini.vir
    |               ltrdwrdy.ini.vir
    |               lvuxsjpv.dll.vir
    |               lwknlrdc.ini.vir
    |               mceijpfu.ini.vir
    |               mfdmmaxa.ini.vir
    |               mhweyake.ini.vir
    |               mvvvvylw.dll.vir
    |               nqxqveey.dll.vir
    |               nvs2.inf.vir
    |               nwbkghlx.dll.vir
    |               nybewcyj.ini.vir
    |               nydjftqi.dll.vir
    |               ooxnxpcp.dll.vir
    |               owqetcjh.ini.vir
    |               oytqrvms.ini.vir
    |               pcpxnxoo.ini.vir
    |               pfayoorr.ini.vir
    |               phiuhmcr.ini.vir
    |               ptljpiuc.ini.vir
    |               pwlnonnr.dll.vir
    |               pxqkxihf.ini.vir
    |               qaropbhf.dll.vir
    |               qigfatad.dll.vir
    |               qktbbwce.dll.vir
    |               rcmhuihp.dll.vir
    |               rgdatlcl.dll.vir
    |               rnnonlwp.ini.vir
    |               rrjbgjft.dll.vir
    |               rrooyafp.dll.vir
    |               sjgfhoxx.ini.vir
    |               smvrqtyo.dll.vir
    |               smyyoned.ini.vir
    |               swxuarva.dll.vir
    |               tfbnjjgg.dll.vir
    |               tfjgbjrr.ini.vir
    |               tonscora.ini.vir
    |               trubvuai.ini.vir
    |               trubvuai.tmp.vir
    |               ubqonxlt.dll.vir
    |               ufpjiecm.dll.vir
    |               vgnbxpry.dll.vir
    |               vhpdlwdx.ini.vir
    |               vpjsxuvl.ini.vir
    |               vsjlprdx.ini.vir
    |               vtfjrnsd.ini.vir
    |               vybsmeea.ini.vir
    |               wiastaac.ini.vir
    |               wlyvvvvm.ini.vir
    |               xdrpljsv.dll.vir
    |               xdwldphv.dll.vir
    |               xlhgkbwn.ini.vir
    |               xxohfgjs.dll.vir
    |               ydrwdrtl.dll.vir
    |               yeevqxqn.ini.vir
    |               ygorwygb.ini.vir
    |               yrpxbngv.ini.vir
    |               yudteave.ini.vir
    |               
    \---Registry_backups
            LEGACY_DOMAINSERVICE.reg.cf
            services_DomainService.reg.cf
N

NielsParedis

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 12:45:24, on 1/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\LckFldService.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Gomez\GOMEZP~1\jre\bin\java.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Paredis\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {722F82B0-95B0-4D8B-A529-40E4798ECE97} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WA6PM_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcwap.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Gomez PEER.lnk = C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...apple.com/snape/us/win/QuickTimeInstaller.exe
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} (Sandlot Loader Control) - http://www.shockwave.com/content/snailmail/sis/slgwebinstall.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.100.53.122/activex/AxisCamControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...amai.com/6712/player/install3.5/installer.exe
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
J

Jurgenv1

Legacy Member
Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

C:\WINDOWS\system32\ganmuxgv.exe
C:\WINDOWS\system32\dudxoemh.exe
C:\WINDOWS\system32\xjoljata.exe
.C:\Program Files\Common Files\DriveCleaner Free

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje.
N

NielsParedis

Legacy Member
C:\WINDOWS\system32\ganmuxgv.exe moved successfully.
C:\WINDOWS\system32\dudxoemh.exe moved successfully.
C:\WINDOWS\system32\xjoljata.exe moved successfully.
File/Folder C:\Program Files\Common Files\DriveCleaner Free not found.

Created on 07/01/2007 15:50:09



Logfile of HijackThis v1.99.1
Scan saved at 15:51:06, on 1/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\LckFldService.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Gomez\GOMEZP~1\jre\bin\java.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Paredis\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {722F82B0-95B0-4D8B-A529-40E4798ECE97} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WA6PM_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcwap.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Gomez PEER.lnk = C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...apple.com/snape/us/win/QuickTimeInstaller.exe
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} (Sandlot Loader Control) - http://www.shockwave.com/content/snailmail/sis/slgwebinstall.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.100.53.122/activex/AxisCamControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...amai.com/6712/player/install3.5/installer.exe
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
J

Jurgenv1

Legacy Member
* Open hijackthis en vink volgende regels aan:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {722F82B0-95B0-4D8B-A529-40E4798ECE97} - (no file)
O4 - HKLM\..\Run: [WA6PM_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcwap.exe"
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Herstart dan je pc en vertel hoe alles verder werkt.
N

NielsParedis

Legacy Member
Zo te zien normaal maar de virusalerts krijgen we door gans de dag...

hier het logje

Logfile of HijackThis v1.99.1
Scan saved at 17:07:47, on 1/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
C:\PROGRA~1\Gomez\GOMEZP~1\jre\bin\java.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\LckFldService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Paredis\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Gomez PEER.lnk = C:\Program Files\Gomez\GomezPEER\bin\GomezPEER.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...apple.com/snape/us/win/QuickTimeInstaller.exe
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab
O16 - DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} (Sandlot Loader Control) - http://www.shockwave.com/content/snailmail/sis/slgwebinstall.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.100.53.122/activex/AxisCamControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712...amai.com/6712/player/install3.5/installer.exe
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
N

NielsParedis

Legacy Member
Tot nu toe geen virussen meer gehad :).

Ook werkt internet terug snel... ik zal je iets laten weten als we nog errors krijgen.

maar het logje is in orde dan?

alvast bedankt
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan