Archief - Wat mag er allemaal weg?

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\ATKKBService.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\system32\LckFldService.exe
D:\Program Files\Spyware Doctor\sdhelp.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\Spyware Doctor\swdoctor.exe
D:\Program Files\WhatPulse\WhatPulse.exe
D:\Program Files\Logitech\SetPoint\KEM.exe
D:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\System32\alg.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Winamp\winamp.exe
D:\Program Files\Hitman Pro\hitmanpro2.exe
D:\Program Files\WinPop\winpop.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Documents and Settings\Jhonaz\Bureaublad\HiJackThis_v2.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hln.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gozobil.lx.ro
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8A61098D-612B-4EF2-943D-64E920684061} - D:\WINDOWS\system32\efcddcc.dll
O2 - BHO: (no name) - {F670984E-346D-4461-A407-8E72FB6AD70B} - D:\WINDOWS\system32\awtss.dll
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Speedtouch] D:\Program Files\Thomson\SpeedTouch USB\stdialup.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "D:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "D:\Program Files\Hitman Pro\xphelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [zzzHPSETUP] E:\Setup.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [runner1] D:\WINDOWS\retadpu1000627.exe 61A847B5BBF72813329B385070FE01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "D:\WINDOWS\system32\pgprlplw.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [WhatPulse] D:\Program Files\WhatPulse\WhatPulse.exe
O4 - HKCU\..\Run: [Steam] D:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [WinPop] D:\Program Files\WinPop\winpop.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173531856937
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B12AD960-70F0-4DC0-9946-16EC68440485}: NameServer = 195.238.2.22 195.238.2.21
O20 - Winlogon Notify: awtss - D:\WINDOWS\system32\awtss.dll
O20 - Winlogon Notify: efcddcc - D:\WINDOWS\SYSTEM32\efcddcc.dll
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: L8motcocscsh - Logitech, Inc. - (no file)
O23 - Service: LckFldService - Unknown owner - D:\WINDOWS\system32\LckFldService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - D:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

Combo Fix:


((((((((((((((((((((((((( Files Created from 2007-05-20 to 2007-06-20 )))))))))))))))))))))))))))))))


2007-06-20 20:12 49,152 --a------ D:\WINDOWS\nircmd.exe
2007-06-20 19:32 <DIR> d-------- D:\Program Files\WinPop
2007-06-20 19:22 71,907 --a------ D:\DOCUME~1\Jhonaz\mon.exe
2007-06-20 19:22 31,254 --a------ D:\WINDOWS\system32\khfecab.dll
2007-06-20 19:21 240,554 --a------ D:\DOCUME~1\Jhonaz\doc.exe
2007-06-20 18:21 <DIR> d-------- D:\Program Files\UseNeXT
2007-06-20 18:21 <DIR> d-------- D:\DOCUME~1\Jhonaz\APPLIC~1\UseNeXT
2007-06-16 20:35 <DIR> d-------- D:\Program Files\Windows Live
2007-06-16 20:31 <DIR> d-------- D:\Program Files\Ares
2007-06-16 19:40 <DIR> d-------- D:\Program Files\eMule
2007-06-07 11:34 159,744 --a------ D:\WINDOWS\system32\lfpng13n.dll
2007-06-07 11:33 69,632 --a------ D:\WINDOWS\system32\lfgif13n.dll
2007-06-07 11:33 57,344 --a------ D:\WINDOWS\system32\lfbmp13n.dll
2007-06-07 11:33 55,808 --a------ D:\WINDOWS\system32\lfpsd13n.dll
2007-06-07 11:33 462,848 --a------ D:\WINDOWS\system32\ltkrn13n.dll
2007-06-07 11:33 450,560 --a------ D:\WINDOWS\system32\ltimg13n.dll
2007-06-07 11:33 401,408 --a------ D:\WINDOWS\system32\lfcmp13n.dll
2007-06-07 11:33 299,008 --a------ D:\WINDOWS\system32\ltdis13n.dll
2007-06-07 11:33 206,336 --a------ D:\WINDOWS\system32\ltefx13n.dll
2007-06-07 11:33 163,840 --a------ D:\WINDOWS\system32\ltfil13n.dll
2007-06-05 20:12 <DIR> d-------- D:\Program Files\Windows Live Safety Center
2007-06-05 18:39 <DIR> d-------- D:\DOCUME~1\Jhonaz\Menu Start
2007-06-05 17:32 46 --a------ D:\WINDOWS\system32\mslck.dat
2007-06-05 17:32 368,912 --a------ D:\WINDOWS\system32\vbar332.dll
2007-06-05 17:32 36,864 --a------ D:\WINDOWS\system32\LckFldService.exe
2007-06-05 17:32 16 --a------ D:\WINDOWS\system32\Mlkf.dll
2007-06-05 17:32 153,088 --a------ D:\WINDOWS\system32\fldlckun.exe
2007-06-02 19:31 <DIR> d-------- D:\Program Files\Cdex
2007-05-31 15:29 <DIR> d-------- D:\Program Files\MSXML 4.0
2007-05-30 18:19 <DIR> d-------- D:\Program Files\XP Codec Pack
2007-05-30 17:48 <DIR> d-------- D:\Program Files\iTunes
2007-05-30 17:48 <DIR> d-------- D:\Program Files\iPod
2007-05-30 14:31 <DIR> d-------- D:\Program Files\Nieuwe map
2007-05-30 14:27 131,072 --------- D:\WINDOWS\system32\mtrcom32.dll
2007-05-30 14:26 954,368 --------- D:\WINDOWS\system32\Faxcpp32.dll
2007-05-30 14:26 90,112 --------- D:\WINDOWS\system32\Tga32.dll
2007-05-30 14:26 89,360 --a------ D:\WINDOWS\system32\VB5DB.DLL
2007-05-30 14:26 81,920 --------- D:\WINDOWS\system32\Pcx32.dll
2007-05-30 14:26 40,960 --------- D:\WINDOWS\system32\Twscan32.dll
2007-05-30 14:26 241,664 --------- D:\WINDOWS\system32\Image32.dll
2007-05-30 14:26 237,568 --------- D:\WINDOWS\system32\Bitmani.dll
2007-05-30 14:26 221,184 --------- D:\WINDOWS\system32\Tiff32.dll
2007-05-30 14:26 167,936 --------- D:\WINDOWS\system32\Cp.dll
2007-05-30 14:26 122,880 --------- D:\WINDOWS\system32\Png32.dll
2007-05-30 14:26 118,784 --------- D:\WINDOWS\system32\Faxmng32.dll
2007-05-30 14:26 110,592 --------- D:\WINDOWS\system32\Jpeg32.dll
2007-05-30 14:26 <DIR> d-------- D:\Program Files\LifeScan
2007-05-22 19:23 <DIR> d-------- D:\Program Files\PolderbitS

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-20 16:10:36 -------- d-----w D:\Program Files\SpywareBlaster
2007-06-20 16:02:06 72,064 ----a-w D:\WINDOWS\system32\perfc013.dat
2007-06-20 16:02:06 437,900 ----a-w D:\WINDOWS\system32\perfh013.dat
2007-06-20 15:48:31 -------- d-----w D:\Program Files\MSN Messenger
2007-06-20 14:17:02 -------- d-----w D:\DOCUME~1\Jhonaz\APPLIC~1\Azureus
2007-06-20 13:50:00 -------- d-----w D:\Program Files\Hitman Pro
2007-06-16 16:05:43 -------- d-----w D:\Program Files\Messenger Plus! Live
2007-06-16 14:49:38 -------- d-----w D:\Program Files\Soulseek
2007-06-16 14:49:34 -------- d-----w D:\Program Files\Incomplete
2007-06-16 14:32:56 -------- d-----w D:\Program Files\LimeWire
2007-06-16 14:28:52 -------- d-----w D:\DOCUME~1\Jhonaz\APPLIC~1\LimeWire
2007-06-15 05:14:04 1,080 ----a-w D:\WINDOWS\AUTOLNCH.REG
2007-06-04 13:49:57 -------- d-----w D:\Program Files\Azureus
2007-05-30 09:56:07 -------- d--h--w D:\Program Files\InstallShield Installation Information
2007-05-18 17:32:04 -------- d-----w D:\Program Files\ffdshow
2007-05-16 15:19:43 683,520 ----a-w D:\WINDOWS\system32\inetcomm.dll
2007-05-16 09:31:00 -------- d-----w D:\Program Files\Winamp
2007-05-15 12:21:29 -------- d-----w D:\Program Files\GBA
2007-05-14 18:02:06 60,273 ----a-w D:\WINDOWS\system32\pthreadGC2.dll
2007-05-14 18:02:06 10,752 ----a-w D:\WINDOWS\system32\ff_vfw.dll
2007-05-13 15:16:05 -------- d-----w D:\DOCUME~1\Jhonaz\APPLIC~1\Google
2007-05-13 15:15:36 -------- d-----w D:\Program Files\Google
2007-05-07 13:29:46 -------- d-----w D:\Program Files\Microsoft ActiveSync
2007-05-07 13:28:25 -------- d-----w D:\Program Files\Microsoft.NET
2007-05-02 14:29:16 -------- d-----w D:\Program Files\QuickTime
2007-05-02 12:07:53 -------- d-----w D:\DOCUME~1\Jhonaz\APPLIC~1\Help
2007-04-25 14:22:52 144,896 ----a-w D:\WINDOWS\system32\schannel.dll
2007-04-25 14:21:46 -------- d-----w D:\Program Files\Yamicsoft
2007-04-24 12:37:00 -------- d-----w D:\DOCUME~1\Jhonaz\APPLIC~1\MusicIP
2007-04-18 16:15:26 2,854,400 ----a-w D:\WINDOWS\system32\msi.dll
2007-04-16 18:17:36 33,624 ----a-w D:\WINDOWS\system32\wups.dll
2007-04-16 18:15:54 1,710,936 ----a-w D:\WINDOWS\system32\wuaueng.dll
2007-04-16 18:15:48 549,720 ----a-w D:\WINDOWS\system32\wuapi.dll
2007-04-16 18:15:42 325,976 ----a-w D:\WINDOWS\system32\wucltui.dll
2007-04-16 18:15:36 203,096 ----a-w D:\WINDOWS\system32\wuweb.dll
2007-04-16 18:15:28 92,504 ----a-w D:\WINDOWS\system32\cdm.dll
2007-04-16 18:15:20 53,080 ----a-w D:\WINDOWS\system32\wuauclt.exe
2007-04-16 18:15:20 43,352 ----a-w D:\WINDOWS\system32\wups2.dll
2007-04-16 18:14:20 271,224 ----a-w D:\WINDOWS\system32\mucltui.dll
2007-04-16 18:14:18 208,248 ----a-w D:\WINDOWS\system32\muweb.dll
2007-04-05 17:40:52 4 ----a-w D:\WINDOWS\system32\micr0st.dll
2007-04-05 17:00:47 684 ----a-w D:\WINDOWS\mozver.dat
2007-04-03 21:26:39 155,648 ----a-w D:\WINDOWS\system32\libssl32.dll
2007-04-03 21:16:18 49,106 ----a-w D:\WINDOWS\system32\unins000.dat
2007-04-01 16:36:06 717,115,595 ----a-w D:\Program Files\Atomix VirtualDJ 3.1.exe
2007-03-27 01:39:14 20,480 ----a-w D:\WINDOWS\system32\ac3config.exe

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=D:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-12 21:10]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 14:50 D:\WINDOWS\SOUNDMAN.EXE]
"SpeedTouch USB Diagnostics"="D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48]
"Speedtouch"="D:\Program Files\Thomson\SpeedTouch USB\stdialup.exe" [2004-01-26 11:38]
"@"="" []
"NVIDIA nTune"="D:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" [2004-11-09 11:38]
"RegistryMechanic"="" []
"Hitman Pro Expiration Helper"="D:\Program Files\Hitman Pro\xphelper.exe" [2007-01-30 14:41]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-04-21 13:57]
"zzzHPSETUP"="E:\Setup.exe" []
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"WinampAgent"="D:\Program Files\Winamp\winampa.exe" [2007-05-15 02:52]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:33]
"msnmsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 15:18]
"Spyware Doctor"="D:\Program Files\Spyware Doctor\swdoctor.exe" [2005-10-23 22:15]
"WhatPulse"="D:\Program Files\WhatPulse\WhatPulse.exe" [2006-08-21 22:18]
"Steam"="D:\Program Files\Valve\Steam\\Steam.exe" [2007-05-31 17:38]
"WinPop"="D:\Program Files\WinPop\winpop.exe" [2007-06-20 19:32]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="D:\Program Files\Spyware Doctor\swdoctor.exe" /Q

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
D:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll


Contents of the 'Scheduled Tasks' folder
2007-06-20 13:15:02 D:\WINDOWS\tasks\AppleSoftwareUpdate.job


Hijack this
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\ATKKBService.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\system32\LckFldService.exe
D:\Program Files\Spyware Doctor\sdhelp.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\WhatPulse\WhatPulse.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Logitech\SetPoint\KEM.exe
D:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
D:\Program Files\Winamp\winamp.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\explorer.exe
D:\Documents and Settings\Jhonaz\Bureaublad\HiJackThis_v2.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hln.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gozobil.lx.ro
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Speedtouch] D:\Program Files\Thomson\SpeedTouch USB\stdialup.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "D:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "D:\Program Files\Hitman Pro\xphelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [zzzHPSETUP] E:\Setup.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [WhatPulse] D:\Program Files\WhatPulse\WhatPulse.exe
O4 - HKCU\..\Run: [Steam] D:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [WinPop] D:\Program Files\WinPop\winpop.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by140fd.bay140.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173531856937
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B12AD960-70F0-4DC0-9946-16EC68440485}: NameServer = 195.238.2.22 195.238.2.21
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: L8motcocscsh - Logitech, Inc. - (no file)
O23 - Service: LckFldService - Unknown owner - D:\WINDOWS\system32\LckFldService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - D:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

* Deïnstalleer hitmanpro.

* Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:


D:\Program Files\WinPop
D:\DOCUMENTS AND SETTINGS\Jhonaz\mon.exe
D:\WINDOWS\system32\khfecab.dll
D:\DOCUMENTS AND SETTINGS\Jhonaz\doc.exe

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht.

* Ga naar http://www.virustotal.com/en/indexf.html en upload de volgende bestanden:

D:\WINDOWS\system32\mtrcom32.dll
D:\WINDOWS\system32\Faxcpp32.dll
D:\WINDOWS\system32\Tga32.dll
D:\WINDOWS\system32\Pcx32.dll
D:\WINDOWS\system32\Twscan32.dll
D:\WINDOWS\system32\Image32.dll
D:\WINDOWS\system32\Tiff32.dll
D:\WINDOWS\system32\Png32.dll
D:\WINDOWS\system32\Faxmng32.dll
D:\WINDOWS\system32\Jpeg32.dll

* Post de resultaten hier met het logje van OTMoveIt en een nieuw hijackthis logje.