Archief - Worm/Virus. check pls.

Godzilla*Akira · 2 jun 2007

Heb dus recent, deze gevonden. win32

dbot-gen44 - win32:vb-ie en win.p2p-worm.alcan.a

Ik zelf gebruik geen p2p progs, maar andere personen wel, via hun account.
Heb free antivirus prog gedowned en gescanned. De eerste 2 zijn denk ik weg, maar ad-aware blijft, win.p2p-worm.alcan.a vinden.

Had iets van een 2000 infected files. die hij niet kon scannen, omdat het archive pw protected is. Diegene die ik kon verwijderen zijn verwijderd.

Kunnen jullie eens kijken.. Ben niet zeker of het hier thuis hoort.

Logfile of HijackThis v1.99.1
Scan saved at 11:32:19, on 2/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe
C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VCM\cm.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\BitLord\BitLord.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: VCM.lnk = C:\Program Files\VCM\cm.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178535828703
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe

PS, bij windows taakbeheer (ctrl+alt+del) tel ik meer processen, dan in de log...

Jurgenv1 · 2 jun 2007

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

Godzilla*Akira · 2 jun 2007

"Eigenaar" - 2007-06-02 17:55:44 Service Pack 2
ComboFix 07-05.27.BV - Running from: "C:\Program Files\Free Download Manager\"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\install.log"
"C:\Program Files\outlook"

((((((((((((((((((((((((((((((( Files Created from 2007-05-02 to 2007-06-02 ))))))))))))))))))))))))))))))))))

2007-06-02 17:45 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-02 13:00 <DIR> d-------- C:\DOCUME~1\IAN&AN~1\APPLIC~1\vlc
2007-06-02 12:34 <DIR> d-------- C:\DOCUME~1\IAN&AN~1\APPLIC~1\ATI
2007-06-02 12:23 <DIR> d-------- C:\DOCUME~1\IAN&AN~1\APPLIC~1\Talkback
2007-06-02 12:17 <DIR> d--h----- C:\DOCUME~1\IAN&AN~1\Sjablonen
2007-06-02 11:48 262,144 --ah----- C:\DOCUME~1\IAN&AN~1\ntuser.dat
2007-06-02 11:48 <DIR> d--h----- C:\DOCUME~1\IAN&AN~1\Onlangs geopend
2007-06-02 11:48 <DIR> d-------- C:\DOCUME~1\IAN&AN~1\Mijn documenten
2007-06-02 11:48 <DIR> d-------- C:\DOCUME~1\IAN&AN~1\Menu Start
2007-06-02 11:48 <DIR> d-------- C:\DOCUME~1\IAN&AN~1\Favorieten
2007-06-02 11:48 <DIR> d-------- C:\DOCUME~1\IAN&AN~1\Bureaublad
2007-06-02 09:38 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-06-02 09:38 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-06-02 09:38 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-06-02 09:38 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-06-02 09:38 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-06-02 09:38 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-06-02 09:38 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2007-06-02 09:38 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-06-02 09:38 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-06-02 09:38 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-06-02 09:38 <DIR> d-------- C:\Program Files\Alwil Software
2007-06-01 21:28 <DIR> d-------- C:\Documents and Settings\Eigenaar\Incomplete
2007-06-01 21:28 <DIR> d-------- C:\DOCUME~1\Eigenaar\Incomplete
2007-05-28 21:41 <DIR> dr-h----- C:\Documents and Settings\Eigenaar\Onlangs geopend
2007-05-28 21:41 <DIR> dr-h----- C:\DOCUME~1\Eigenaar\Onlangs geopend
2007-05-25 16:13 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-05-25 16:12 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-05-25 16:12 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-05-25 11:19 28,672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys
2007-05-18 19:21 <DIR> d-------- C:\Program Files\AresTorrentDownloader
2007-05-17 22:19 <DIR> d-------- C:\Program Files\Last.fm
2007-05-17 21:50 <DIR> d-------- C:\Documents and Settings\Eigenaar\Trillian
2007-05-17 21:50 <DIR> d-------- C:\DOCUME~1\Eigenaar\Trillian
2007-05-17 16:59 <DIR> d--h----- C:\WINDOWS\PIF
2007-05-14 18:12 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2007-05-14 18:12 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2007-05-14 18:12 <DIR> d-------- C:\Program Files\QuickTime
2007-05-14 18:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
2007-05-14 18:11 <DIR> d-------- C:\Program Files\Trillian
2007-05-11 17:15 <DIR> d-------- C:\Program Files\Steam
2007-05-10 20:52 <DIR> d-------- C:\UnrealTournament
2007-05-10 15:25 <DIR> d-------- C:\DOCUME~1\Eigenaar\APPLIC~1\System Tweaker
2007-05-10 11:31 <DIR> dr-h----- C:\DOCUME~1\LOCALS~1\Onlangs geopend
2007-05-09 23:35 <DIR> d-------- C:\Program Files\Uniblue
2007-05-09 23:35 <DIR> d-------- C:\DOCUME~1\Eigenaar\APPLIC~1\Uniblue
2007-05-09 21:38 <DIR> d-------- C:\Program Files\BitLord
2007-05-09 13:01 <DIR> d-------- C:\ATI
2007-05-09 12:10 <DIR> d-------- C:\Program Files\Logitech
2007-05-09 12:10 <DIR> d-------- C:\Program Files\Common Files\Logitech
2007-05-09 12:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-05-09 11:42 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-05-09 11:25 335 --a------ C:\WINDOWS\mozregistry.dat
2007-05-09 00:21 <DIR> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-05-08 13:56 118,784 --a------ C:\WINDOWS\GREUninstall.exe
2007-05-08 08:19 <DIR> d-------- C:\Program Files\AMD
2007-05-07 14:28 262,144 --a------ C:\DOCUME~1\ALLUSE~1\ntuser.dat
2007-05-07 14:18 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-05-07 13:05 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-05-07 13:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-05-07 13:03 <DIR> d---s---- C:\Documents and Settings\Eigenaar\UserData
2007-05-07 13:03 <DIR> d---s---- C:\DOCUME~1\Eigenaar\UserData
2007-05-07 13:03 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-05-07 11:29 <DIR> d-------- C:\DOCUME~1\Eigenaar\APPLIC~1\Lavasoft
2007-05-07 11:23 434,252 --a------ C:\WINDOWS\system32\Msvcrtd.dll
2007-05-07 11:23 162,304 --a------ C:\UNWISE.EXE
2007-05-07 11:23 15,340 --a------ C:\WINDOWS\system32\drivers\ndisrd.sys
2007-05-07 11:23 <DIR> d-------- C:\Program Files\VCM
2007-05-07 11:13 <DIR> d-------- C:\Program Files\Lavasoft
2007-05-07 11:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-05-06 23:57 <DIR> d-------- C:\WINDOWS\pss
2007-05-06 23:44 <DIR> d-------- C:\Program Files\Free Download Manager
2007-05-06 23:44 <DIR> d-------- C:\DOCUME~1\Eigenaar\APPLIC~1\Free Download Manager
2007-05-06 23:37 <DIR> d-------- C:\DOCUME~1\Eigenaar\APPLIC~1\Help
2007-05-06 23:25 <DIR> d-------- C:\Program Files\Common Files\Agnitum Shared
2007-05-06 23:25 <DIR> d-------- C:\Program Files\Agnitum
2007-05-06 23:12 <DIR> d-------- C:\DOCUME~1\Eigenaar\APPLIC~1\vlc
2007-05-06 22:56 <DIR> d-------- C:\Program Files\VideoLAN
2007-05-06 22:05 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-05-06 21:59 <DIR> d-------- C:\Program Files\World of Warcraft
2007-05-06 17:07 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-05-06 17:07 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-05-06 17:06 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-05-06 17:06 57,856 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-05-06 17:05 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-05-06 17:05 76,288 --a------ C:\WINDOWS\system32\usbui.dll
2007-05-06 17:05 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-05-06 17:05 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-05-06 17:05 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-05-06 17:05 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-05-06 17:05 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-05-06 17:05 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-05-06 17:05 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-05-06 17:05 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-05-06 17:05 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-05-06 17:05 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-05-06 17:05 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-05-06 17:05 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-05-06 17:05 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-05-06 17:05 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-05-06 17:05 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-05-06 17:05 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-05-06 17:05 <DIR> dr------- C:\Program Files
2007-05-06 17:05 <DIR> d--hs---- C:\WINDOWS\Installer
2007-05-06 17:05 <DIR> d-------- C:\Program Files\Common Files\SpeechEngines
2007-05-06 17:05 <DIR> d-------- C:\Program Files\Common Files\ODBC
2007-05-06 17:04 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-05-06 17:04 9,040 --a------ C:\WINDOWS\system\VER.DLL
2007-05-06 17:04 86,556 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-05-06 17:04 82,944 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-05-06 17:04 8,704 --a------ C:\WINDOWS\system32\batt.dll
2007-05-06 17:04 76,288 --a------ C:\WINDOWS\system32\storprop.dll
2007-05-06 17:04 70,192 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-05-06 17:04 70,144 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-05-06 17:04 70,144 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-05-06 17:04 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2007-05-06 17:04 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2007-05-06 17:04 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2007-05-06 17:04 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2007-05-06 17:04 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2007-05-06 17:04 5,120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-05-06 17:04 33,696 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-05-06 17:04 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-05-06 17:04 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-05-06 17:04 19,200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-05-06 17:04 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-05-06 17:04 15,872 --a------ C:\WINDOWS\TASKMAN.EXE
2007-05-06 17:04 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-05-06 17:04 126,976 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-05-06 17:04 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-05-06 17:04 109,552 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-05-06 17:04 103,936 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-05-06 17:04 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start
2007-05-06 17:04 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Documenten
2007-05-06 17:04 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Sjablonen
2007-05-06 17:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Favorieten
2007-05-06 17:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Bureaublad
2007-05-06 17:02 <DIR> d--hs---- C:\System Volume Information
2007-05-06 17:02 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2007-05-06 17:02 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2007-05-06 17:02 <DIR> d-------- C:\Documents and Settings
2007-05-06 17:02 <DIR> d-------- C:\DOCUME~1\Eigenaar\APPLIC~1\ATI
2007-05-06 16:59 <DIR> d-------- C:\Program Files\Common Files\ATI Technologies
2007-05-06 16:56 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-05-06 16:56 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2007-05-06 16:56 3,107,788 -ra------ C:\WINDOWS\system32\ativvaxx.dat
2007-05-06 16:56 128,813 --a------ C:\WINDOWS\system32\atiicdxx.dat
2007-05-06 16:56 <DIR> d-------- C:\Program Files\ATI Technologies
2007-05-06 16:54 <DIR> dr-hsc--- C:\WINDOWS\system32\dllcache
2007-05-06 16:54 <DIR> dr--s---- C:\WINDOWS\Fonts
2007-05-06 16:54 <DIR> dr------- C:\WINDOWS\Web
2007-05-06 16:54 <DIR> d--hs---- C:\WINDOWS\system32
2007-05-06 16:54 <DIR> d--h----- C:\WINDOWS\inf
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\WinSxS
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\twain_32
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\wins
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\wbem
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\usmt
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\spool
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\ShellExt
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\Setup
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\ras
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\oobe
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\npp
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\mui
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\inetsrv
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\IME
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\icsxml
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\ias
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\export
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\drivers\etc
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\drivers
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\dhcp
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\config
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\3com_dmi
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\3076
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\2052
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1054
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1043
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1042
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1041
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1037
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1033
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1031
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1028
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system32\1025
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\system
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\security
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Resources
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\repair
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Provisioning
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\PeerNet
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\pchealth
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\mui
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\msapps
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\msagent
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Media
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\ime
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Help
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Driver Cache
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Debug
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Cursors
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Connection Wizard
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\Config
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\AppPatch
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS\addins
2007-05-06 16:54 <DIR> d-------- C:\WINDOWS
2007-05-06 16:52 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-05-06 16:48 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-05-06 16:48 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-05-06 16:48 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-05-06 16:48 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-05-06 16:48 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-05-06 16:48 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-05-06 16:48 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-05-06 16:48 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-05-06 16:48 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe
2007-05-06 16:48 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2007-05-06 16:48 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-05-06 16:48 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-05-06 16:48 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-05-06 16:48 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-05-06 16:48 <DIR> d-------- C:\WINDOWS\system32\RTCOM
2007-05-06 16:47 9,709,568 -r------- C:\WINDOWS\RTLCPL.exe
2007-05-06 16:47 86,016 -r------- C:\WINDOWS\SoundMan.exe
2007-05-06 16:47 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2007-05-06 16:47 499,712 -r------- C:\WINDOWS\RtlExUpd.dll
2007-05-06 16:47 4,394,496 -r------- C:\WINDOWS\system32\drivers\RtkHDAud.Sys
2007-05-06 16:47 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-05-06 16:47 2,879,488 -r------- C:\WINDOWS\SkyTel.exe
2007-05-06 16:47 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe
2007-05-06 16:47 2,157,568 -r------- C:\WINDOWS\MicCal.exe
2007-05-06 16:47 16,269,312 -r------- C:\WINDOWS\RTHDCPL.exe
2007-05-06 16:47 1,183,744 -r------- C:\WINDOWS\RtlUpd.exe
2007-05-06 16:47 <DIR> d-------- C:\Program Files\Realtek
2007-05-06 16:38 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups
2007-05-06 16:34 8,049 --a------ C:\WINDOWS\mozver.dat
2007-05-06 16:29 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-05-06 16:28 348,160 --a------ C:\WINDOWS\system32\ati2cqag.dll
2007-05-06 16:28 264,704 --a------ C:\WINDOWS\system32\ati2dvag.dll
2007-05-06 16:28 2,827,968 --a------ C:\WINDOWS\system32\ati3duag.dll
2007-05-06 16:28 1,975,296 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-05-06 16:28 1,272,960 --a------ C:\WINDOWS\system32\ativvaxx.dll
2007-05-06 16:28 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-05-06 16:21 <DIR> d-------- C:\DOCUME~1\Eigenaar\APPLIC~1\Talkback

Godzilla*Akira · 2 jun 2007

2007-05-06 16:20 335 --a------ C:\WINDOWS\nsreg.dat
2007-05-06 16:17 <DIR> d-------- C:\Program Files\Marvell
2007-05-06 16:17 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-05-06 16:16 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2007-05-06 16:16 10,288 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2007-05-06 15:22 <DIR> d--hs---- C:\RECYCLER
2007-05-06 15:20 786,432 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-05-06 15:20 786,432 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-05-06 15:20 3,145,728 --ah----- C:\Documents and Settings\Eigenaar\NTUSER.DAT
2007-05-06 15:20 3,145,728 --ah----- C:\DOCUME~1\Eigenaar\NTUSER.DAT
2007-05-06 15:20 <DIR> dr------- C:\Documents and Settings\Eigenaar\Mijn documenten
2007-05-06 15:20 <DIR> dr------- C:\Documents and Settings\Eigenaar\Menu Start
2007-05-06 15:20 <DIR> dr------- C:\Documents and Settings\Eigenaar\Favorieten
2007-05-06 15:20 <DIR> dr------- C:\DOCUME~1\Eigenaar\Mijn documenten
2007-05-06 15:20 <DIR> dr------- C:\DOCUME~1\Eigenaar\Menu Start
2007-05-06 15:20 <DIR> dr------- C:\DOCUME~1\Eigenaar\Favorieten
2007-05-06 15:20 <DIR> d--h----- C:\Documents and Settings\Eigenaar\Sjablonen
2007-05-06 15:20 <DIR> d--h----- C:\Documents and Settings\Eigenaar\Netwerkprinteromgeving
2007-05-06 15:20 <DIR> d--h----- C:\DOCUME~1\Eigenaar\Sjablonen
2007-05-06 15:20 <DIR> d--h----- C:\DOCUME~1\Eigenaar\Netwerkprinteromgeving
2007-05-06 15:20 <DIR> d-------- C:\WINDOWS\SoftwareDistribution
2007-05-06 15:20 <DIR> d-------- C:\WINDOWS\Prefetch
2007-05-06 15:20 <DIR> d-------- C:\Documents and Settings\Eigenaar\Bureaublad
2007-05-06 15:20 <DIR> d-------- C:\DOCUME~1\Eigenaar\Bureaublad
2007-05-06 15:17 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-05-06 15:17 <DIR> d-------- C:\WINDOWS\system32\xircom
2007-05-06 15:17 <DIR> d-------- C:\Program Files\microsoft frontpage
2007-05-06 15:16 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-05-06 15:16 0 -rahs---- C:\MSDOS.SYS
2007-05-06 15:16 0 -rahs---- C:\IO.SYS
2007-05-06 15:16 0 --a------ C:\CONFIG.SYS
2007-05-06 15:16 0 --a------ C:\AUTOEXEC.BAT
2007-05-06 15:16 <DIR> dr------- C:\WINDOWS\Offline Web Pages
2007-05-06 15:16 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM
2007-05-06 15:16 <DIR> d--h----- C:\Program Files\WindowsUpdate
2007-05-06 15:16 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2007-05-06 15:15 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-05-06 15:15 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-05-06 15:15 67,584 --a------ C:\WINDOWS\system32\acctres.dll
2007-05-06 15:15 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-05-06 15:15 466,200 --a------ C:\WINDOWS\system32\wuapi.dll
2007-05-06 15:15 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-05-06 15:15 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2007-05-06 15:15 194,840 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-05-06 15:15 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-05-06 15:15 174,360 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-05-06 15:15 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2007-05-06 15:15 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-05-06 15:15 128,280 --a------ C:\WINDOWS\system32\wucltui.dll
2007-05-06 15:15 125,208 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-05-06 15:15 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-05-06 15:15 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2007-05-06 15:15 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-05-06 15:15 <DIR> d---s---- C:\WINDOWS\Tasks
2007-05-06 15:15 <DIR> d-------- C:\WINDOWS\system32\Macromed
2007-05-06 15:15 <DIR> d-------- C:\WINDOWS\system32\DirectX
2007-05-06 15:15 <DIR> d-------- C:\WINDOWS\srchasst
2007-05-06 15:15 <DIR> d-------- C:\Program Files\Common Files\MSSoap
2007-05-06 15:14 86,016 --a------ C:\WINDOWS\system32\isign32.dll
2007-05-06 15:14 81,920 --a------ C:\WINDOWS\system32\ils.dll
2007-05-06 15:14 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2007-05-06 15:14 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-05-06 15:14 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2007-05-06 15:14 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-06 15:14 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2007-05-06 15:14 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-05-06 15:14 50,176 --a------ C:\WINDOWS\system32\inetres.dll
2007-05-06 15:14 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2007-05-06 15:14 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-05-06 15:14 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-05-06 15:14 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-05-06 15:14 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-05-06 15:14 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-05-06 15:14 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2007-05-06 15:14 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-05-06 15:14 278,528 --a------ C:\WINDOWS\system32\mstask.dll
2007-05-06 15:14 278,528 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-05-06 15:14 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2007-05-06 15:14 241,152 --a------ C:\WINDOWS\system32\srrstr.dll
2007-05-06 15:14 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2007-05-06 15:14 21,748 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-05-06 15:14 192,000 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-05-06 15:14 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2007-05-06 15:14 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2007-05-06 15:14 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2007-05-06 15:14 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2007-05-06 15:14 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2007-05-06 15:14 <DIR> d-------- C:\WINDOWS\system32\Restore
2007-05-06 15:14 <DIR> d-------- C:\WINDOWS\Registration
2007-05-06 15:14 <DIR> d-------- C:\Program Files\Movie Maker
2007-05-06 15:13 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2007-05-06 15:13 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-05-06 15:13 94,208 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-05-06 15:13 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-05-06 15:13 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-05-06 15:13 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-05-06 15:13 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-05-06 15:13 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2007-05-06 15:13 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2007-05-06 15:13 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2007-05-06 15:13 662,528 --a------ C:\WINDOWS\system32\getuname.dll
2007-05-06 15:13 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2007-05-06 15:13 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-05-06 15:13 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-05-06 15:13 61,440 --a------ C:\WINDOWS\system32\remotepg.dll
2007-05-06 15:13 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2007-05-06 15:13 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-05-06 15:13 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-05-06 15:13 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2007-05-06 15:13 57,344 --a------ C:\WINDOWS\system32\sol.exe
2007-05-06 15:13 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2007-05-06 15:13 55,808 --a------ C:\WINDOWS\system32\freecell.exe
2007-05-06 15:13 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2007-05-06 15:13 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-05-06 15:13 539,136 --a------ C:\WINDOWS\system32\spider.exe
2007-05-06 15:13 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-05-06 15:13 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-05-06 15:13 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-05-06 15:13 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-05-06 15:13 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2007-05-06 15:13 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-05-06 15:13 412,160 --a------ C:\WINDOWS\system32\mstsc.exe
2007-05-06 15:13 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-05-06 15:13 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-05-06 15:13 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-05-06 15:13 39,424 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-05-06 15:13 352,768 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-05-06 15:13 35,840 --a------ C:\WINDOWS\system32\winchat.exe
2007-05-06 15:13 345,600 --a------ C:\WINDOWS\system32\mspaint.exe
2007-05-06 15:13 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-05-06 15:13 297,472 --a------ C:\WINDOWS\system32\termsrv.dll
2007-05-06 15:13 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-05-06 15:13 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-05-06 15:13 233,472 --a------ C:\WINDOWS\system32\avtapi.dll
2007-05-06 15:13 23,040 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-05-06 15:13 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2007-05-06 15:13 22,016 --a------ C:\WINDOWS\system32\msg.exe
2007-05-06 15:13 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-05-06 15:13 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2007-05-06 15:13 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-05-06 15:13 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-05-06 15:13 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-05-06 15:13 188,928 --a------ C:\WINDOWS\system32\cmprops.dll
2007-05-06 15:13 187,392 --a------ C:\WINDOWS\system32\accwiz.exe
2007-05-06 15:13 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-05-06 15:13 17,920 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-05-06 15:13 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-05-06 15:13 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-05-06 15:13 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-05-06 15:13 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-05-06 15:13 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-05-06 15:13 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-05-06 15:13 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-05-06 15:13 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2007-05-06 15:13 15,360 --a------ C:\WINDOWS\system32\shadow.exe
2007-05-06 15:13 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2007-05-06 15:13 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2007-05-06 15:13 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-05-06 15:13 142,336 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-05-06 15:13 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-05-06 15:13 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-05-06 15:13 132,608 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-05-06 15:13 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-05-06 15:13 128,000 --a------ C:\WINDOWS\system32\mshearts.exe
2007-05-06 15:13 124,416 --a------ C:\WINDOWS\system32\mplay32.exe
2007-05-06 15:13 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-05-06 15:13 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2007-05-06 15:13 114,688 --a------ C:\WINDOWS\system32\calc.exe
2007-05-06 15:13 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-05-06 15:13 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-05-06 15:13 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2007-05-06 15:13 104,448 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-05-06 15:13 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-05-06 15:13 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-05-06 15:13 <DIR> d-------- C:\WINDOWS\system32\MsDtc
2007-05-06 15:13 <DIR> d-------- C:\WINDOWS\system32\Com
2007-05-06 15:13 <DIR> d-------- C:\Program Files\Windows NT
2007-05-06 15:13 <DIR> d-------- C:\Program Files\MSN Gaming Zone
2007-05-06 15:13 <DIR> d-------- C:\Program Files\Messenger

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-07 12:28:21 76,582 ----a-w C:\WINDOWS\system32\perfc013.dat
2007-05-07 12:28:21 455,614 ----a-w C:\WINDOWS\system32\perfh013.dat
2007-03-17 13:45:54 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-11 16:13:51 149,622 ----a-w C:\WINDOWS\NGOUN.exe
2007-03-08 15:39:10 579,072 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:39:10 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:39:10 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:37:59 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{CC59E0F9-7E43-44FA-9FAA-8377850BF205}=C:\Program Files\Free Download Manager\iefdmcks.dll [2006-08-20 19:55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"Launch LCDMon"="C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe" [2007-04-26 16:54]
"Launch LGDCore"="C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" [2007-04-26 17:22]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"<NO NAME>"=
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideShutdownScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"=0 (0x0)

--------------------

Code:

2007-05-07 11:23      3186    --a------    C:\Qoobox\Quarantine\C\INSTALL.LOG.vir


Map PATH-lijst voor volume Ryuujin
Het volumenummer is A45F-9DCB
C:\QOOBOX
\---Quarantine
    +---C
    |       INSTALL.LOG.vir
    |       
    \---Registry_backups

PS; ik moest 1 ingeven ipv Y , kan dit?
Heb al eens op nieuw geprobeert, maar daar begint hij automatisch te scannen zonder ik iets moet ingeven.... :unsure:

Godzilla*Akira · 2 jun 2007

Logfile of HijackThis v1.99.1
Scan saved at 18:15:38, on 2/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Agnitum\Outpost Firewall\outpost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\VCM\cm.exe
C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: VCM.lnk = C:\Program Files\VCM\cm.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178535828703
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe

Jurgenv1 · 2 jun 2007

* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
Klik daarna de groene pijl rechts om de scan te starten.
Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:

Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
Sluit daarna Dr.Web Cureit.
Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post met een nieuw hijackthis logje.

Archief - Worm/Virus. check pls.

Godzilla*Akira

Legacy Member

Jurgenv1

Legacy Member

Godzilla*Akira

Legacy Member

Godzilla*Akira

Legacy Member

Godzilla*Akira

Legacy Member

Jurgenv1

Legacy Member