2 trojaans infecties PSW agent.AFFO & Downloader agent2.SWO

CBtje · 21 april 2010

Hallo,

ik heb sind een paar dagen last van een melding dat ik trojaans infecties heb. deze melding krijg ik wanneer ik mijn internet opstart. ik heb wat andere forums door gelezen hier. dus ik heb alvast een hijackthis log gemaakt.

hier is hij dan:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:47:18, on 21-4-2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

D:\AVG 2010\avgwdsvc.exe

D:\Spyware Doctor\BDT\BDTUpdateService.exe

D:\AVG 2010\avgam.exe

D:\AVG 2010\avgrsx.exe

D:\AVG 2010\avgnsx.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

D:\NOD32\nod32krn.exe

D:\Spyware Doctor\pctsAuxs.exe

D:\Spyware Doctor\pctsSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

C:\WINDOWS\System32\alg.exe

D:\Spyware Doctor\pctsTray.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\ALCWZRD.EXE

C:\WINDOWS\ALCMTR.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

D:\AVG 2010\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe

C:\Documents and Settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Internet Explorer\iexplore.exe

D:\AVG 2010\avgcsrvx.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - D:\AVG 2010\Toolbar\IEToolbar.dll

O2 - BHO: (no name) - {18A97EB6-8DD7-4885-8160-72861C3BD900} - C:\WINDOWS\system32\xuhdzdds.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - D:\Spyware Doctor\BDT\PCTBrowserDefender.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\AVG 2010\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: (no name) - {5EEF998D-2BEE-45B8-AA90-BF5A53C95148} - c:\windows\system32\huxvgdn.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - D:\AVG 2010\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - D:\Spyware Doctor\BDT\PCTBrowserDefender.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - D:\AVG 2010\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [iSTray] "D:\Spyware Doctor\pctsTray.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [AVG9_TRAY] D:\AVG 2010\avgtray.exe

O4 - HKLM\..\Run: [AVG8_TRAY] D:\AVG 2010\avgtray.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: RAID Manager.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://twp01.saxion.nl/qp2.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\AVG 2010\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O20 - Winlogon Notify: cbssreg - C:\Documents and Settings\All Users\Documenten\Settings\cbss.dll (file missing)

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\AVG 2010\avgwdsvc.exe

O23 - Service: Browser Defender Update Service - Unknown owner - D:\Spyware Doctor\BDT\BDTUpdateService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\NOD32\nod32krn.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Spyware Doctor\pctsSvc.exe

--

End of file - 9217 bytes

Hopelijk kunnen jullie mij helpen

groetjes

CBtje

kape · 22 april 2010

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: (no name) - {18A97EB6-8DD7-4885-8160-72861C3BD900} - C:\WINDOWS\system32\xuhdzdds.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: (no name) - {5EEF998D-2BEE-45B8-AA90-BF5A53C95148} - c:\windows\system32\huxvgdn.dll

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O20 - Winlogon Notify: cbssreg - C:\Documents and Settings\All Users\Documenten\Settings\cbss.dll (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Download MBAM (Malwarebytes Anti-Malware)

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder).

Indien er de rootkit (TDSS) aanwezig is, zal MBAM vragen te herstarten. Doe dit dan ook.

MBAM zal na de herstart opnieuw scannen en de rootkit verwijderen.

Het log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in het programma.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

CBtje · 22 april 2010

Ey,

ik heb je instructies opgevolgd. de volgende logjes zijn er uit gekomen:

van HijackThis:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:33:45, on 22-4-2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

D:\AVG 2010\avgwdsvc.exe

D:\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

D:\NOD32\nod32krn.exe

D:\AVG 2010\avgam.exe

D:\AVG 2010\avgrsx.exe

D:\AVG 2010\avgnsx.exe

D:\Spyware Doctor\pctsAuxs.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\ALCWZRD.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

D:\Spyware Doctor\pctsTray.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

D:\AVG 2010\avgtray.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe

C:\Documents and Settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

D:\Spyware Doctor\pctsSvc.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - D:\AVG 2010\Toolbar\IEToolbar.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - D:\Spyware Doctor\BDT\PCTBrowserDefender.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\AVG 2010\avgssie.dll

O2 - BHO: (no name) - {5EEF998D-2BEE-45B8-AA90-BF5A53C95148} - c:\windows\system32\huxvgdn.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - D:\AVG 2010\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - D:\Spyware Doctor\BDT\PCTBrowserDefender.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - D:\AVG 2010\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [iSTray] "D:\Spyware Doctor\pctsTray.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [AVG9_TRAY] D:\AVG 2010\avgtray.exe

O4 - HKLM\..\Run: [AVG8_TRAY] D:\AVG 2010\avgtray.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: RAID Manager.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://twp01.saxion.nl/qp2.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\AVG 2010\avgpp.dll

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\AVG 2010\avgwdsvc.exe

O23 - Service: Browser Defender Update Service - Unknown owner - D:\Spyware Doctor\BDT\BDTUpdateService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\NOD32\nod32krn.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Spyware Doctor\pctsSvc.exe

--

End of file - 8692 bytes

en van MBAM het volgende jogje:

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Databaseversie: 4020

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

22-4-2010 10:26:39

mbam-log-2010-04-22 (10-26-39).txt

Scantype: Snelle scan

Objecten gescand: 108079

Verstreken tijd: 10 minuut/minuten, 34 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 1

Registerwaarden geïnfecteerd: 0

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

kape · 22 april 2010

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: (no name) - {5EEF998D-2BEE-45B8-AA90-BF5A53C95148} - c:\windows\system32\huxvgdn.dll

Klik op 'Fix checked' om de items te verwijderen.

Download Combofix naar je Bureaublad.

Lees hier meer over correct gebruik van Combofix.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.

Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Dubbelklik op Combofix.exe om het te starten.
Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.
Volg de instructies, aanvaard de disclaimer door op Ja te klikken.
Indien de Recovery Console niet geïnstalleerd is, wordt je gevraagd om dit alsnog te doen door op JA te klikken in het "Query - Recovery Console" venster (enkel voor XP, niet voor VISTA).
Klik op OK en Ja om automatisch de Recovery Console te laten installeren.
Klik na afloop terug op Ja om het scannen op malware te starten.
Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

CBtje · 23 april 2010

hallo..

hier is de Hijackthislog:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:20:54, on 23-4-2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

D:\AVG 2010\avgwdsvc.exe

D:\Spyware Doctor\BDT\BDTUpdateService.exe

D:\AVG 2010\avgam.exe

D:\AVG 2010\avgrsx.exe

D:\AVG 2010\avgnsx.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

D:\NOD32\nod32krn.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\ALCWZRD.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

D:\AVG 2010\avgtray.exe

C:\Documents and Settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - D:\AVG 2010\Toolbar\IEToolbar.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - D:\Spyware Doctor\BDT\PCTBrowserDefender.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\AVG 2010\avgssie.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - D:\AVG 2010\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - D:\Spyware Doctor\BDT\PCTBrowserDefender.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - D:\AVG 2010\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] D:\AVG 2010\avgtray.exe

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: RAID Manager.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://twp01.saxion.nl/qp2.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\AVG 2010\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\AVG 2010\avgwdsvc.exe

O23 - Service: Browser Defender Update Service - Unknown owner - D:\Spyware Doctor\BDT\BDTUpdateService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\NOD32\nod32krn.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Spyware Doctor\pctsSvc.exe

--

End of file - 7789 bytes

en de Combofix logjes

ComboFix 10-04-21.01 - Collin B 23-04-2010 17:47:58.1.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.1023.621 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Collin B\Bureaublad\ComboFix.exe

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: ESET NOD32 antivirus system 2.70 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Documenten\Settings

c:\documents and settings\Collin B\Application Data\inst.exe

c:\windows\install.exe

c:\windows\system32\drivers\txsnirhl.sys

c:\windows\system32\drivers\tyquedgf.sys

c:\windows\system32\huxvgdn.dll

c:\windows\system32\xuhdzdds.dll

c:\windows\system32\yhhecke.dll

Besmet exemplaar van c:\windows\system32\drivers\atapi.sys werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - Kitty had a snack

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_HXZTZYPO

-------\Legacy_SSHNAS

-------\Legacy_TYQUEDGF

-------\Service_hxztzypo

-------\Service_tyquedgf

(((((((((((((((((((( Bestanden Gemaakt van 2010-03-23 to 2010-04-23 ))))))))))))))))))))))))))))))

.

2010-04-22 08:13 . 2010-04-22 08:13 -------- d-----w- c:\documents and settings\Collin B\Application Data\Malwarebytes

2010-04-22 08:13 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-22 08:13 . 2010-04-22 08:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-22 08:13 . 2010-04-22 08:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-22 08:13 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-21 14:46 . 2010-04-21 14:46 388096 ----a-r- c:\documents and settings\Collin B\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-04-21 14:46 . 2010-04-21 14:46 -------- d-----w- c:\program files\Trend Micro

2010-04-19 18:05 . 2010-04-19 18:05 -------- d-----w- c:\program files\Enigma Software Group

2010-04-19 18:04 . 2010-04-19 18:04 -------- d-----w- c:\windows\61D3AAE1D5214CD7939B37813DE8F955.TMP

2010-04-19 18:04 . 2010-04-19 18:04 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-04-19 17:45 . 2010-04-19 17:45 -------- d-----w- C:\!KillBox

2010-04-19 15:34 . 2010-04-19 13:14 98440 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgldx86.sys

2010-04-19 15:34 . 2010-04-19 13:14 90632 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtdix.sys

2010-04-19 15:34 . 2010-04-19 13:14 12936 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrkx86.sys

2010-04-19 12:52 . 2010-04-19 12:52 -------- d-----w- c:\windows\system32\drivers\Avg

2010-04-19 12:52 . 2010-04-19 12:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2010-04-19 12:51 . 2010-04-19 12:51 25608 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys

2010-04-19 12:51 . 2010-04-19 15:34 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-04-19 12:51 . 2010-04-19 15:34 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-04-19 12:51 . 2010-04-19 12:51 -------- d-----w- c:\program files\AVG

2010-04-19 12:51 . 2010-04-19 12:51 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-04-19 12:38 . 2010-04-19 12:38 -------- d-----w- c:\windows\system32\wbem\Repository

2010-04-15 10:34 . 2010-04-15 10:34 -------- d-----w- c:\documents and settings\Collin B\Application Data\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1

2010-04-15 10:34 . 2010-04-15 10:33 38784 ----a-w- c:\documents and settings\Collin B\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-04-15 10:34 . 2010-04-15 10:33 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-04-15 10:34 . 2010-04-15 10:34 -------- d-----w- c:\program files\Common Files\Adobe AIR

2010-04-10 12:23 . 2009-09-04 15:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2010-04-10 12:23 . 2006-09-28 14:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll

2010-04-10 12:23 . 2010-04-10 12:23 -------- d-----w- c:\windows\Logs

2010-04-09 12:10 . 2010-04-09 12:10 -------- d-----w- c:\documents and settings\Collin B\Local Settings\Application Data\Identities

2010-04-07 15:03 . 2010-04-07 15:03 -------- d-----w- c:\program files\Java

2010-04-06 18:50 . 2010-04-06 18:50 -------- d-----w- c:\program files\DVDVideoSoft

2010-04-06 18:49 . 2010-04-06 18:49 -------- d-----w- c:\program files\Common Files\DVDVideoSoft

2010-04-05 11:22 . 2010-04-05 11:22 -------- d-----w- c:\documents and settings\Collin B\Local Settings\Application Data\Google

2010-04-05 10:10 . 2010-04-05 10:10 -------- d-----w- c:\documents and settings\Collin B\Local Settings\Application Data\Deployment

2010-04-02 10:02 . 2010-04-02 10:02 -------- d-----w- c:\windows\system32\NtmsData

2010-04-01 18:30 . 2010-04-01 18:30 -------- d-----w- C:\vcs5BGEffects

2010-04-01 17:44 . 2010-04-01 17:44 -------- d-----w- C:\AV_LOGS

2010-04-01 17:43 . 2010-04-01 17:43 -------- d-----w- c:\documents and settings\Collin B\Application Data\Avnex

2010-04-01 17:42 . 2008-12-26 10:56 17792 ----a-w- c:\windows\system32\drivers\vcsvad.sys

2010-04-01 16:23 . 2010-04-01 16:23 -------- d-----w- c:\program files\Microsoft Silverlight

2010-04-01 15:37 . 2010-04-01 15:37 -------- d-----w- c:\program files\Norton AntiVirus

2010-03-24 17:36 . 2010-03-24 17:36 -------- d-----w- c:\documents and settings\Collin B\Local Settings\Application Data\ATI

2010-03-24 17:36 . 2010-03-24 17:36 -------- d-----w- c:\documents and settings\Collin B\Application Data\ATI

2010-03-24 17:36 . 2010-03-24 17:36 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI

2010-03-24 17:36 . 2010-03-24 17:36 0 ----a-w- c:\windows\ativpsrm.bin

2010-03-24 17:32 . 2010-02-10 19:20 593920 ------w- c:\windows\system32\ati2sgag.exe

2010-03-24 17:31 . 2010-03-24 17:31 -------- d-----w- c:\program files\ATI Technologies

2010-03-24 17:30 . 2010-03-24 17:30 -------- d-----w- C:\ATI

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-23 15:58 . 2010-02-23 22:16 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs

2010-04-23 15:58 . 2010-02-23 22:15 0 ----a-w- c:\windows\system32\drivers\logiflt.iad

2010-04-19 15:34 . 2010-04-19 12:52 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2010-04-19 15:34 . 2010-04-19 12:52 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-04-19 15:34 . 2010-04-19 12:52 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-04-19 13:14 . 2010-04-19 15:34 10520 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsstx.dll

2010-04-19 13:14 . 2010-04-19 15:34 26824 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmfx86.sys

2010-04-19 13:14 . 2010-04-19 15:34 287000 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe

2010-04-19 13:13 . 2010-04-19 13:41 652056 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe

2010-04-19 13:13 . 2010-04-19 13:41 1123072 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll

2010-04-19 13:13 . 2010-04-19 13:41 443672 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgiproxy.exe

2010-04-19 13:13 . 2010-04-19 13:41 584472 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll

2010-04-19 13:13 . 2010-04-19 13:13 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2010-04-19 12:25 . 2010-03-19 18:16 883208 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2010-04-10 12:22 . 2010-04-10 12:22 -------- d-----w- c:\documents and settings\Collin B\Application Data\Winamp

2010-04-07 15:03 . 2010-03-08 18:19 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-03-20 16:46 . 2010-03-20 16:46 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-03-20 15:59 . 2010-03-20 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverScanner

2010-03-20 15:58 . 2010-03-20 15:58 -------- d--h--w- c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}

2010-03-20 15:18 . 2010-03-20 15:18 -------- d--h--w- c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}

2010-03-20 15:00 . 2010-03-20 15:00 -------- d-----w- c:\documents and settings\Collin B\Application Data\uniblue

2010-03-20 14:59 . 2010-03-20 14:59 -------- d-----w- c:\program files\Uniblue

2010-03-20 14:54 . 2001-09-07 10:00 91688 ----a-w- c:\windows\system32\perfc013.dat

2010-03-20 14:54 . 2001-09-07 10:00 511526 ----a-w- c:\windows\system32\perfh013.dat

2010-03-20 14:21 . 2010-03-20 14:21 -------- d--h--w- c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}

2010-03-20 13:32 . 2004-12-04 11:54 69232 ----a-w- c:\documents and settings\Collin B\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-03-19 18:15 . 2010-03-19 18:15 -------- d-----w- c:\program files\Reference Assemblies

2010-03-19 17:02 . 2010-03-19 17:02 -------- d-----w- c:\program files\MSXML 6.0

2010-03-14 16:33 . 2010-03-14 16:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Vso

2010-03-14 09:39 . 2010-03-14 09:39 0 ----a-w- c:\windows\nsreg.dat

2010-03-08 18:26 . 2010-03-08 18:25 -------- d-----w- c:\documents and settings\Collin B\Application Data\FrostWire

2010-03-08 18:20 . 2010-03-08 18:20 503808 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7dbc3903-n\msvcp71.dll

2010-03-08 18:20 . 2010-03-08 18:20 499712 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7dbc3903-n\jmc.dll

2010-03-08 18:20 . 2010-03-08 18:20 348160 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7dbc3903-n\msvcr71.dll

2010-03-08 18:20 . 2010-03-08 18:20 61440 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4804ef7c-n\decora-sse.dll

2010-03-08 18:20 . 2010-03-08 18:20 12800 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4804ef7c-n\decora-d3d.dll

2010-03-08 18:20 . 2010-03-08 18:20 -------- d-----w- c:\program files\Common Files\Java

2010-03-05 11:54 . 2010-03-05 11:54 -------- d-----w- c:\program files\Common Files\PC Tools

2010-03-05 11:54 . 2010-03-05 11:54 -------- d-----w- c:\documents and settings\Collin B\Application Data\PC Tools

2010-03-05 11:54 . 2010-03-05 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2010-03-05 11:54 . 2010-03-05 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP

2010-03-02 20:20 . 2010-03-02 20:20 -------- d-----w- c:\documents and settings\Collin B\Application Data\MSN6

2010-03-02 20:20 . 2010-03-02 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\MSN6

2010-03-02 12:32 . 2010-03-02 12:32 -------- d-----w- c:\documents and settings\Collin B\Application Data\ROUTE 66 Sync

2010-03-02 12:32 . 2010-03-02 12:32 -------- d-----w- c:\program files\Common Files\ROUTE 66

2010-02-28 15:01 . 2010-02-28 15:01 -------- d-----w- c:\program files\Common Files\DivX Shared

2010-02-28 14:02 . 2010-02-28 14:02 -------- d-----w- c:\documents and settings\All Users\Application Data\vsosdk

2010-02-28 12:45 . 2010-02-28 12:45 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys

2010-02-28 12:45 . 2010-02-28 12:45 47360 ----a-w- c:\documents and settings\Collin B\Application Data\pcouffin.sys

2010-02-28 12:45 . 2010-02-28 12:45 47360 ----a-w- c:\documents and settings\Collin B\Application Data\pcouffin.sys

2010-02-28 12:45 . 2010-02-28 12:45 -------- d-----w- c:\documents and settings\Collin B\Application Data\Vso

2010-02-28 12:45 . 2010-02-28 12:45 -------- d-----w- c:\program files\VSO

2010-02-27 18:05 . 2010-02-27 18:05 -------- d-----w- c:\documents and settings\Collin B\Application Data\CyberLink

2010-02-24 14:40 . 2010-02-24 14:39 -------- d-----w- c:\documents and settings\Collin B\Application Data\WebcamMax

2010-02-23 22:14 . 2010-02-23 22:14 -------- d-----w- c:\documents and settings\Collin B\Application Data\Leadertech

2010-02-23 22:11 . 2010-02-23 22:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd

2010-02-23 22:10 . 2010-02-23 22:10 -------- d-----w- c:\program files\Common Files\LogiShrd

2010-02-23 22:10 . 2010-02-23 22:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech

2010-02-23 22:10 . 2010-02-23 22:10 -------- d-----w- c:\program files\Logitech

2010-02-23 18:27 . 2010-02-23 18:26 -------- d-----w- c:\program files\Digital Camera Plus Manager

2010-02-23 18:20 . 2010-02-23 18:20 -------- d-----w- c:\program files\AIPTEK

2010-02-21 18:09 . 2010-02-21 18:09 56608 ----a-w- c:\windows\BricoPackUninst.cmd

2010-02-21 18:09 . 2010-02-21 18:07 4590 ----a-w- c:\windows\BricoPackFoldersDelete.cmd

2010-02-21 18:09 . 2002-09-09 10:08 219136 ----a-w- c:\windows\system32\uxtheme.dll

2010-02-11 06:38 . 2004-05-15 13:41 3565056 ----a-w- c:\windows\system32\drivers\ati2mtag.sys

2010-02-11 04:17 . 2010-02-11 04:17 11845632 ----a-w- c:\windows\system32\atioglxx.dll

2010-02-11 04:07 . 2010-02-11 04:07 307200 ----a-w- c:\windows\system32\atiiiexx.dll

2010-02-11 03:46 . 2010-02-11 03:46 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll

2010-02-11 03:45 . 2004-05-15 13:42 325120 ----a-w- c:\windows\system32\ati2dvag.dll

2010-02-11 03:37 . 2010-02-11 03:37 290816 ----a-w- c:\windows\system32\atiok3x2.dll

2010-02-11 03:36 . 2010-02-11 03:36 204800 ----a-w- c:\windows\system32\atipdlxx.dll

2010-02-11 03:35 . 2010-02-11 03:35 155648 ----a-w- c:\windows\system32\Oemdspif.dll

2010-02-11 03:35 . 2010-02-11 03:35 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe

2010-02-11 03:35 . 2010-02-11 03:35 43520 ----a-w- c:\windows\system32\ati2edxx.dll

2010-02-11 03:35 . 2010-02-11 03:35 155648 ----a-w- c:\windows\system32\ati2evxx.dll

2010-02-11 03:33 . 2010-02-11 03:33 602112 ----a-w- c:\windows\system32\ati2evxx.exe

2010-02-11 03:32 . 2010-02-11 03:32 53248 ----a-w- c:\windows\system32\ATIDDC.DLL

2010-02-11 03:25 . 2004-05-15 13:17 3818144 ----a-w- c:\windows\system32\ati3duag.dll

2010-02-11 03:23 . 2010-02-11 03:23 45056 ----a-w- c:\windows\system32\aticalrt.dll

2010-02-11 03:22 . 2010-02-11 03:22 45056 ----a-w- c:\windows\system32\aticalcl.dll

2010-02-11 03:21 . 2010-02-11 03:21 3227648 ----a-w- c:\windows\system32\aticaldd.dll

2010-02-11 03:19 . 2010-02-11 03:19 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

2010-02-11 03:12 . 2004-05-15 12:42 2670592 ----a-w- c:\windows\system32\ativvaxx.dll

2010-02-11 03:12 . 2010-02-11 03:12 887724 ----a-w- c:\windows\system32\ativva6x.dat

2010-02-11 03:12 . 2010-02-11 03:12 3107788 ----a-w- c:\windows\system32\ativva5x.dat

2010-02-11 02:59 . 2010-02-11 02:59 49664 ----a-w- c:\windows\system32\amdpcom32.dll

2010-02-11 02:55 . 2010-02-11 02:55 475136 ----a-w- c:\windows\system32\atikvmag.dll

2010-02-11 02:54 . 2010-02-11 02:54 126976 ----a-w- c:\windows\system32\atiadlxx.dll

2010-02-11 02:53 . 2010-02-11 02:53 17408 ----a-w- c:\windows\system32\atitvo32.dll

2010-02-11 02:47 . 2004-05-15 12:20 626688 ----a-w- c:\windows\system32\ati2cqag.dll

2010-02-05 07:25 . 2010-03-05 11:55 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-02-05 07:17 . 2010-03-05 11:55 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2004-03-11 11:27 . 2004-12-04 10:27 40960 ----a-w- c:\program files\Uninstall_CDS.exe

.

------- Sigcheck -------

[-] 2004-08-03 . B2D1C626BBD3D9CFF0663691227413D4 . 978432 . . [6.00.2900.2180] . . c:\windows\explorer.exe

[-] 2004-08-03 . B2D1C626BBD3D9CFF0663691227413D4 . 978432 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2002-09-09 . 040CC36796BBA354B678BCE9DCB25A3A . 1007616 . . [6.00.2800.1106] . . c:\windows\$NtServicePackUninstall$\explorer.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "d:\avg 2010\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-10-16 10:13 1115392 ----a-w- d:\avg 2010\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "d:\avg 2010\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [2008-08-26 2019624]

"Google Update"="c:\documents and settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-16 136176]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 61952]

"SoundMan"="SOUNDMAN.EXE" [2004-06-15 68096]

"AlcWzrd"="ALCWZRD.EXE" [2004-06-15 2550272]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"AVG8_TRAY"="d:\avg 2010\avgtray.exe" [2010-04-19 2046816]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

RAID Manager.lnk - c:\program files\ITE\ITE IT8212 ATA RAID Controller\RaidMgr.exe [2004-12-4 724992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-04-19 15:34 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2009-12-11 13:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-12-22 00:57 35760 ----a-w- d:\adobe reader 2010\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2010-04-16 15:45 136176 ----a-w- c:\documents and settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]

2008-02-13 11:06 2196240 ----a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui]

2002-01-01 05:37 949376 ----a-w- d:\nod32\nod32kui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

2003-10-31 17:42 32768 ----a-w- c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Documents and Settings\\Collin B\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"d:\\frost wire2010\\FrostWire\\FrostWire.exe"=

"i:\\BitTorrent\\bittorrent.exe"=

"d:\\BitTorrent\\BitTorrent.exe"=

"d:\\AVG 2010\\avgam.exe"=

"d:\\AVG 2010\\avgupd.exe"=

"d:\\AVG 2010\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [19-4-2010 14:51 12552]

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [4-12-2004 12:09 24971]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [5-3-2010 13:55 207280]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [19-4-2010 14:52 335240]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [19-4-2010 14:51 108552]

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [1-1-2002 6:39 15424]

R2 avg8wd;AVG8 WatchDog;d:\avg 2010\avgwdsvc.exe [19-4-2010 17:34 297752]

R2 Browser Defender Update Service;Browser Defender Update Service;d:\spyware doctor\BDT\BDTUpdateService.exe [5-3-2010 14:56 112592]

R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [1-4-2010 19:42 17792]

S3 MR97310_VGA_DUAL_CAMERA;Dual-Mode Digital Camera;c:\windows\system32\DRIVERS\mr97310v.sys --> c:\windows\system32\DRIVERS\mr97310v.sys [?]

S3 sdAuxService;PC Tools Auxiliary Service;d:\spyware doctor\pctsAuxs.exe [17-7-2009 18:08 365280]

S4 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [5-3-2010 13:55 233136]

S4 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [5-3-2010 13:55 70408]

.

Inhoud van de 'Gedeelde Taken' map

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-602162358-682003330-1003Core.job

- c:\documents and settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-16 15:45]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://google.nl/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\windows\system32\imon.dll

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\Collin B\Application Data\Mozilla\Firefox\Profiles\c50bg05h.default\

FF - component: d:\avg 2010\Firefox\components\avgssff.dll

FF - plugin: c:\documents and settings\Collin B\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: d:\adobe reader 2010\Reader\browser\nppdf32.dll

FF - plugin: d:\divx\DivX Plus Web Player\npdivx32.dll

FF - plugin: d:\firefox2010\plugins\npwachk.dll

---- FIREFOX POLICIES ----

d:\firefox2010\greprefs\all.js - pref("ui.use_native_colors", true);

d:\firefox2010\greprefs\all.js - pref("ui.use_native_popup_windows", false);

d:\firefox2010\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

d:\firefox2010\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

d:\firefox2010\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

d:\firefox2010\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

d:\firefox2010\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

d:\firefox2010\greprefs\all.js - pref("svg.smil.enabled", false);

d:\firefox2010\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.debug", false);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

d:\firefox2010\greprefs\all.js - pref("html5.enable", false);

d:\firefox2010\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

d:\firefox2010\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

d:\firefox2010\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

d:\firefox2010\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

d:\firefox2010\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

d:\firefox2010\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "Firefox web browser | Faster, more secure, & customizable");

d:\firefox2010\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

d:\firefox2010\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

d:\firefox2010\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

d:\firefox2010\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

d:\firefox2010\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

d:\firefox2010\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

d:\firefox2010\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

d:\firefox2010\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

d:\firefox2010\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

d:\firefox2010\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

d:\firefox2010\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

d:\firefox2010\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

d:\firefox2010\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - - ORPHANS VERWIJDERD - - - -

ShellIconOverlayIdentifiers-{5EEF998D-2BEE-45B8-AA90-BF5A53C95148} - (no file)

HKCU-Run-Power2GoExpress - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-04-23 18:16

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*Š¼oc0u]

"DisplayName"="?\11?\1c?\1c???"

"DeviceDesc"="?\11?\1c?\1c???"

"ProviderName"="?\11???\11\08"

"MFG"="??\09"

"ReinstallString"="8.593.100.0000"

"DeviceInstanceIds"=multi:"c:\\ati\\support\\10-02_legacy_xp32-64_dd_ccc\\driver\\xp_inf\\cx_95952.inf\00"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(728)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(7244)

c:\windows\TEMP\logishrd\LVPrcInj01.dll

c:\progra~1\WINDOW~2\wmpband.dll

c:\windows\system32\ntshrui.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\msi.dll

c:\windows\system32\NETSHELL.dll

c:\windows\system32\credui.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

d:\avg 2010\avgam.exe

d:\avg 2010\avgrsx.exe

d:\avg 2010\avgnsx.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

d:\nod32\nod32krn.exe

c:\windows\SOUNDMAN.EXE

c:\windows\ALCWZRD.EXE

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

.

**************************************************************************

.

Voltooingstijd: 2010-04-23 18:19:35 - machine werd herstart

ComboFix-quarantined-files.txt 2010-04-23 16:19

Pre-Run: 76.201.984 bytes beschikbaar

Post-Run: 213.131.264 bytes beschikbaar

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4

- - End Of File - - 5DF776D99E6E71B556E947F4C6848600

thunderlight · 23 april 2010

Je zou eens moeten proberen (als je virus het toelaat) met avast (downloadbaar via deze link) , na de voltooide installatie moet je de computer terug herstarten. Normaal zal bij het opstarten van jouw computer een blauw scherm moeten verschijnen met ergens in een hoekje AVAST. Avast zal je computer nu grondig scannen en alle virussen meteen verwijderen. LET wel op: dit kan soms lang duren.

Veel geluk

jv9090 · 23 april 2010

Als zowel Malwarebytes als Combofix reeds een scan hebben gedaan zullen de grootste problemen reeds verwijderd zijn.

Voor de rest laten we het over aan de kenners om malware problemen te behandelen.

kape · 24 april 2010

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\program files\Uninstall_CDS.exe

c:\windows\system32\drivers\lvuvc.hs

c:\windows\system32\drivers\logiflt.iad

Driver::

lvuvc.hs

logiflt.iad

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

CBtje · 26 april 2010

Hoi Hoi..

Hier het logje van HijackThis:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:18:53, on 26-4-2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

D:\AVG 2010\avgwdsvc.exe

D:\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

D:\NOD32\nod32krn.exe

C:\WINDOWS\System32\svchost.exe

D:\AVG 2010\avgam.exe

D:\AVG 2010\avgrsx.exe

D:\AVG 2010\avgnsx.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\ALCWZRD.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

D:\AVG 2010\avgtray.exe

C:\Documents and Settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - D:\AVG 2010\Toolbar\IEToolbar.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - D:\Spyware Doctor\BDT\PCTBrowserDefender.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\AVG 2010\avgssie.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - D:\AVG 2010\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - D:\Spyware Doctor\BDT\PCTBrowserDefender.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - D:\AVG 2010\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] D:\AVG 2010\avgtray.exe

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: RAID Manager.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://twp01.saxion.nl/qp2.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\AVG 2010\avgpp.dll

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\AVG 2010\avgwdsvc.exe

O23 - Service: Browser Defender Update Service - Unknown owner - D:\Spyware Doctor\BDT\BDTUpdateService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\NOD32\nod32krn.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Spyware Doctor\pctsSvc.exe

--

End of file - 7782 bytes

en het logje van Combofix

ComboFix 10-04-21.01 - Collin B 26-04-2010 19:59:00.2.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.1023.453 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Collin B\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Collin B\Bureaublad\CFScript.txt

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: ESET NOD32 antivirus system 2.70 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::

"c:\program files\Uninstall_CDS.exe"

"c:\windows\system32\drivers\logiflt.iad"

"c:\windows\system32\drivers\lvuvc.hs"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Uninstall_CDS.exe

c:\windows\system32\drivers\logiflt.iad

c:\windows\system32\drivers\lvuvc.hs

c:\windows\TEMP\logishrd\LVPrcInj01.dll

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-03-26 to 2010-04-26 ))))))))))))))))))))))))))))))

.

2010-04-22 08:13 . 2010-04-22 08:13 -------- d-----w- c:\documents and settings\Collin B\Application Data\Malwarebytes

2010-04-22 08:13 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-22 08:13 . 2010-04-22 08:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-22 08:13 . 2010-04-22 08:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-22 08:13 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-21 14:46 . 2010-04-21 14:46 388096 ----a-r- c:\documents and settings\Collin B\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-04-21 14:46 . 2010-04-21 14:46 -------- d-----w- c:\program files\Trend Micro

2010-04-19 18:05 . 2010-04-19 18:05 -------- d-----w- c:\program files\Enigma Software Group

2010-04-19 18:04 . 2010-04-19 18:04 -------- d-----w- c:\windows\61D3AAE1D5214CD7939B37813DE8F955.TMP

2010-04-19 18:04 . 2010-04-19 18:04 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-04-19 17:45 . 2010-04-19 17:45 -------- d-----w- C:\!KillBox

2010-04-19 15:34 . 2010-04-19 13:14 98440 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgldx86.sys

2010-04-19 15:34 . 2010-04-19 13:14 90632 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtdix.sys

2010-04-19 15:34 . 2010-04-19 13:14 12936 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrkx86.sys

2010-04-19 12:52 . 2010-04-19 12:52 -------- d-----w- c:\windows\system32\drivers\Avg

2010-04-19 12:52 . 2010-04-19 12:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2010-04-19 12:51 . 2010-04-19 12:51 25608 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys

2010-04-19 12:51 . 2010-04-19 15:34 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-04-19 12:51 . 2010-04-19 15:34 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-04-19 12:51 . 2010-04-19 12:51 -------- d-----w- c:\program files\AVG

2010-04-19 12:51 . 2010-04-19 12:51 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-04-19 12:38 . 2010-04-19 12:38 -------- d-----w- c:\windows\system32\wbem\Repository

2010-04-15 10:34 . 2010-04-15 10:34 -------- d-----w- c:\documents and settings\Collin B\Application Data\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1

2010-04-15 10:34 . 2010-04-15 10:33 38784 ----a-w- c:\documents and settings\Collin B\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-04-15 10:34 . 2010-04-15 10:33 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-04-15 10:34 . 2010-04-15 10:34 -------- d-----w- c:\program files\Common Files\Adobe AIR

2010-04-10 12:23 . 2009-09-04 15:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2010-04-10 12:23 . 2006-09-28 14:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll

2010-04-10 12:23 . 2010-04-10 12:23 -------- d-----w- c:\windows\Logs

2010-04-09 12:10 . 2010-04-09 12:10 -------- d-----w- c:\documents and settings\Collin B\Local Settings\Application Data\Identities

2010-04-07 15:03 . 2010-04-07 15:03 -------- d-----w- c:\program files\Java

2010-04-06 18:50 . 2010-04-06 18:50 -------- d-----w- c:\program files\DVDVideoSoft

2010-04-06 18:49 . 2010-04-06 18:49 -------- d-----w- c:\program files\Common Files\DVDVideoSoft

2010-04-05 11:22 . 2010-04-05 11:22 -------- d-----w- c:\documents and settings\Collin B\Local Settings\Application Data\Google

2010-04-05 10:10 . 2010-04-05 10:10 -------- d-----w- c:\documents and settings\Collin B\Local Settings\Application Data\Deployment

2010-04-02 10:02 . 2010-04-02 10:02 -------- d-----w- c:\windows\system32\NtmsData

2010-04-01 18:30 . 2010-04-01 18:30 -------- d-----w- C:\vcs5BGEffects

2010-04-01 17:44 . 2010-04-01 17:44 -------- d-----w- C:\AV_LOGS

2010-04-01 17:43 . 2010-04-01 17:43 -------- d-----w- c:\documents and settings\Collin B\Application Data\Avnex

2010-04-01 17:42 . 2008-12-26 10:56 17792 ----a-w- c:\windows\system32\drivers\vcsvad.sys

2010-04-01 16:23 . 2010-04-01 16:23 -------- d-----w- c:\program files\Microsoft Silverlight

2010-04-01 15:37 . 2010-04-01 15:37 -------- d-----w- c:\program files\Norton AntiVirus

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-23 21:40 . 2010-03-19 18:16 883208 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2010-04-19 15:34 . 2010-04-19 12:52 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2010-04-19 15:34 . 2010-04-19 12:52 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-04-19 15:34 . 2010-04-19 12:52 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-04-19 13:14 . 2010-04-19 15:34 10520 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsstx.dll

2010-04-19 13:14 . 2010-04-19 15:34 26824 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmfx86.sys

2010-04-19 13:14 . 2010-04-19 15:34 287000 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe

2010-04-19 13:13 . 2010-04-19 13:41 652056 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe

2010-04-19 13:13 . 2010-04-19 13:41 1123072 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll

2010-04-19 13:13 . 2010-04-19 13:41 443672 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgiproxy.exe

2010-04-19 13:13 . 2010-04-19 13:41 584472 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll

2010-04-19 13:13 . 2010-04-19 13:13 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2010-04-10 12:22 . 2010-04-10 12:22 -------- d-----w- c:\documents and settings\Collin B\Application Data\Winamp

2010-04-07 15:03 . 2010-03-08 18:19 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-03-24 18:17 . 2010-03-24 08:04 952768 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\12462\AdobeARM.exe

2010-03-24 18:17 . 2010-03-24 08:04 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\12462\AdobeExtractFiles.dll

2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\12462\ReaderUpdater.exe

2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\12462\AcrobatUpdater.exe

2010-03-24 17:36 . 2010-03-24 17:36 -------- d-----w- c:\documents and settings\Collin B\Application Data\ATI

2010-03-24 17:36 . 2010-03-24 17:36 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI

2010-03-24 17:36 . 2010-03-24 17:36 0 ----a-w- c:\windows\ativpsrm.bin

2010-03-24 17:31 . 2010-03-24 17:31 -------- d-----w- c:\program files\ATI Technologies

2010-03-20 16:46 . 2010-03-20 16:46 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-03-20 15:59 . 2010-03-20 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\DriverScanner

2010-03-20 15:58 . 2010-03-20 15:58 -------- d--h--w- c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}

2010-03-20 15:18 . 2010-03-20 15:18 -------- d--h--w- c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}

2010-03-20 15:00 . 2010-03-20 15:00 -------- d-----w- c:\documents and settings\Collin B\Application Data\uniblue

2010-03-20 14:59 . 2010-03-20 14:59 -------- d-----w- c:\program files\Uniblue

2010-03-20 14:54 . 2001-09-07 10:00 91688 ----a-w- c:\windows\system32\perfc013.dat

2010-03-20 14:54 . 2001-09-07 10:00 511526 ----a-w- c:\windows\system32\perfh013.dat

2010-03-20 14:21 . 2010-03-20 14:21 -------- d--h--w- c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}

2010-03-20 13:32 . 2004-12-04 11:54 69232 ----a-w- c:\documents and settings\Collin B\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-03-19 18:15 . 2010-03-19 18:15 -------- d-----w- c:\program files\Reference Assemblies

2010-03-19 17:02 . 2010-03-19 17:02 -------- d-----w- c:\program files\MSXML 6.0

2010-03-14 16:33 . 2010-03-14 16:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Vso

2010-03-14 09:39 . 2010-03-14 09:39 0 ----a-w- c:\windows\nsreg.dat

2010-03-08 18:26 . 2010-03-08 18:25 -------- d-----w- c:\documents and settings\Collin B\Application Data\FrostWire

2010-03-08 18:20 . 2010-03-08 18:20 503808 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7dbc3903-n\msvcp71.dll

2010-03-08 18:20 . 2010-03-08 18:20 499712 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7dbc3903-n\jmc.dll

2010-03-08 18:20 . 2010-03-08 18:20 348160 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-7dbc3903-n\msvcr71.dll

2010-03-08 18:20 . 2010-03-08 18:20 61440 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4804ef7c-n\decora-sse.dll

2010-03-08 18:20 . 2010-03-08 18:20 12800 ----a-w- c:\documents and settings\Collin B\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-4804ef7c-n\decora-d3d.dll

2010-03-08 18:20 . 2010-03-08 18:20 -------- d-----w- c:\program files\Common Files\Java

2010-03-05 11:54 . 2010-03-05 11:54 -------- d-----w- c:\program files\Common Files\PC Tools

2010-03-05 11:54 . 2010-03-05 11:54 -------- d-----w- c:\documents and settings\Collin B\Application Data\PC Tools

2010-03-05 11:54 . 2010-03-05 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2010-03-05 11:54 . 2010-03-05 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP

2010-03-02 20:20 . 2010-03-02 20:20 -------- d-----w- c:\documents and settings\Collin B\Application Data\MSN6

2010-03-02 20:20 . 2010-03-02 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\MSN6

2010-03-02 12:32 . 2010-03-02 12:32 -------- d-----w- c:\documents and settings\Collin B\Application Data\ROUTE 66 Sync

2010-03-02 12:32 . 2010-03-02 12:32 -------- d-----w- c:\program files\Common Files\ROUTE 66

2010-02-28 15:01 . 2010-02-28 15:01 -------- d-----w- c:\program files\Common Files\DivX Shared

2010-02-28 14:02 . 2010-02-28 14:02 -------- d-----w- c:\documents and settings\All Users\Application Data\vsosdk

2010-02-28 12:45 . 2010-02-28 12:45 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys

2010-02-28 12:45 . 2010-02-28 12:45 47360 ----a-w- c:\documents and settings\Collin B\Application Data\pcouffin.sys

2010-02-28 12:45 . 2010-02-28 12:45 47360 ----a-w- c:\documents and settings\Collin B\Application Data\pcouffin.sys

2010-02-28 12:45 . 2010-02-28 12:45 -------- d-----w- c:\documents and settings\Collin B\Application Data\Vso

2010-02-28 12:45 . 2010-02-28 12:45 -------- d-----w- c:\program files\VSO

2010-02-27 18:05 . 2010-02-27 18:05 -------- d-----w- c:\documents and settings\Collin B\Application Data\CyberLink

2010-02-21 18:09 . 2010-02-21 18:09 56608 ----a-w- c:\windows\BricoPackUninst.cmd

2010-02-21 18:09 . 2010-02-21 18:07 4590 ----a-w- c:\windows\BricoPackFoldersDelete.cmd

2010-02-21 18:09 . 2002-09-09 10:08 219136 ----a-w- c:\windows\system32\uxtheme.dll

2010-02-11 06:38 . 2004-05-15 13:41 3565056 ----a-w- c:\windows\system32\drivers\ati2mtag.sys

2010-02-11 04:17 . 2010-02-11 04:17 11845632 ----a-w- c:\windows\system32\atioglxx.dll

2010-02-11 04:07 . 2010-02-11 04:07 307200 ----a-w- c:\windows\system32\atiiiexx.dll

2010-02-11 03:46 . 2010-02-11 03:46 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll

2010-02-11 03:45 . 2004-05-15 13:42 325120 ----a-w- c:\windows\system32\ati2dvag.dll

2010-02-11 03:37 . 2010-02-11 03:37 290816 ----a-w- c:\windows\system32\atiok3x2.dll

2010-02-11 03:36 . 2010-02-11 03:36 204800 ----a-w- c:\windows\system32\atipdlxx.dll

2010-02-11 03:35 . 2010-02-11 03:35 155648 ----a-w- c:\windows\system32\Oemdspif.dll

2010-02-11 03:35 . 2010-02-11 03:35 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe

2010-02-11 03:35 . 2010-02-11 03:35 43520 ----a-w- c:\windows\system32\ati2edxx.dll

2010-02-11 03:35 . 2010-02-11 03:35 155648 ----a-w- c:\windows\system32\ati2evxx.dll

2010-02-11 03:33 . 2010-02-11 03:33 602112 ----a-w- c:\windows\system32\ati2evxx.exe

2010-02-11 03:32 . 2010-02-11 03:32 53248 ----a-w- c:\windows\system32\ATIDDC.DLL

2010-02-11 03:25 . 2004-05-15 13:17 3818144 ----a-w- c:\windows\system32\ati3duag.dll

2010-02-11 03:23 . 2010-02-11 03:23 45056 ----a-w- c:\windows\system32\aticalrt.dll

2010-02-11 03:22 . 2010-02-11 03:22 45056 ----a-w- c:\windows\system32\aticalcl.dll

2010-02-11 03:21 . 2010-02-11 03:21 3227648 ----a-w- c:\windows\system32\aticaldd.dll

2010-02-11 03:19 . 2010-02-11 03:19 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

2010-02-11 03:12 . 2004-05-15 12:42 2670592 ----a-w- c:\windows\system32\ativvaxx.dll

2010-02-11 03:12 . 2010-02-11 03:12 887724 ----a-w- c:\windows\system32\ativva6x.dat

2010-02-11 03:12 . 2010-02-11 03:12 3107788 ----a-w- c:\windows\system32\ativva5x.dat

2010-02-11 02:59 . 2010-02-11 02:59 49664 ----a-w- c:\windows\system32\amdpcom32.dll

2010-02-11 02:55 . 2010-02-11 02:55 475136 ----a-w- c:\windows\system32\atikvmag.dll

2010-02-11 02:54 . 2010-02-11 02:54 126976 ----a-w- c:\windows\system32\atiadlxx.dll

2010-02-11 02:53 . 2010-02-11 02:53 17408 ----a-w- c:\windows\system32\atitvo32.dll

2010-02-11 02:47 . 2004-05-15 12:20 626688 ----a-w- c:\windows\system32\ati2cqag.dll

2010-02-10 19:20 . 2010-03-24 17:32 593920 ------w- c:\windows\system32\ati2sgag.exe

2010-02-05 07:25 . 2010-03-05 11:55 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-02-05 07:17 . 2010-03-05 11:55 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

.

------- Sigcheck -------

[-] 2004-08-03 . B2D1C626BBD3D9CFF0663691227413D4 . 978432 . . [6.00.2900.2180] . . c:\windows\explorer.exe

[-] 2004-08-03 . B2D1C626BBD3D9CFF0663691227413D4 . 978432 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2002-09-09 . 040CC36796BBA354B678BCE9DCB25A3A . 1007616 . . [6.00.2800.1106] . . c:\windows\$NtServicePackUninstall$\explorer.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "d:\avg 2010\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-10-16 10:13 1115392 ----a-w- d:\avg 2010\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "d:\avg 2010\Toolbar\IEToolbar.dll" [2009-10-16 1115392]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [2008-08-26 2019624]

"Google Update"="c:\documents and settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-16 136176]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 61952]

"SoundMan"="SOUNDMAN.EXE" [2004-06-15 68096]

"AlcWzrd"="ALCWZRD.EXE" [2004-06-15 2550272]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"AVG8_TRAY"="d:\avg 2010\avgtray.exe" [2010-04-19 2046816]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

RAID Manager.lnk - c:\program files\ITE\ITE IT8212 ATA RAID Controller\RaidMgr.exe [2004-12-4 724992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-12-22 00:57 35760 ----a-w- d:\adobe reader 2010\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2010-04-16 15:45 136176 ----a-w- c:\documents and settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]

2008-02-13 11:06 2196240 ----a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui]

2002-01-01 05:37 949376 ----a-w- d:\nod32\nod32kui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

2003-10-31 17:42 32768 ----a-w- c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Documents and Settings\\Collin B\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"d:\\frost wire2010\\FrostWire\\FrostWire.exe"=

"i:\\BitTorrent\\bittorrent.exe"=

"d:\\BitTorrent\\BitTorrent.exe"=

"d:\\AVG 2010\\avgam.exe"=

"d:\\AVG 2010\\avgupd.exe"=

"d:\\AVG 2010\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [19-4-2010 14:51 12552]

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [4-12-2004 12:09 24971]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [5-3-2010 13:55 207280]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [19-4-2010 14:52 335240]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [19-4-2010 14:51 108552]

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [1-1-2002 6:39 15424]

R2 avg8wd;AVG8 WatchDog;d:\avg 2010\avgwdsvc.exe [19-4-2010 17:34 297752]

R2 Browser Defender Update Service;Browser Defender Update Service;d:\spyware doctor\BDT\BDTUpdateService.exe [5-3-2010 14:56 112592]

R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [1-4-2010 19:42 17792]

S3 MR97310_VGA_DUAL_CAMERA;Dual-Mode Digital Camera;c:\windows\system32\DRIVERS\mr97310v.sys --> c:\windows\system32\DRIVERS\mr97310v.sys [?]

S3 sdAuxService;PC Tools Auxiliary Service;d:\spyware doctor\pctsAuxs.exe [17-7-2009 18:08 365280]

S4 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [5-3-2010 13:55 233136]

S4 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [5-3-2010 13:55 70408]

.

Inhoud van de 'Gedeelde Taken' map

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-602162358-682003330-1003Core.job

- c:\documents and settings\Collin B\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-16 15:45]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://google.nl/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\windows\system32\imon.dll

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\Collin B\Application Data\Mozilla\Firefox\Profiles\c50bg05h.default\

FF - component: d:\avg 2010\Firefox\components\avgssff.dll

FF - plugin: c:\documents and settings\Collin B\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: d:\adobe reader 2010\Reader\browser\nppdf32.dll

FF - plugin: d:\divx\DivX Plus Web Player\npdivx32.dll

FF - plugin: d:\firefox2010\plugins\npwachk.dll

---- FIREFOX POLICIES ----

d:\firefox2010\greprefs\all.js - pref("ui.use_native_colors", true);

d:\firefox2010\greprefs\all.js - pref("ui.use_native_popup_windows", false);

d:\firefox2010\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

d:\firefox2010\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

d:\firefox2010\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

d:\firefox2010\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

d:\firefox2010\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

d:\firefox2010\greprefs\all.js - pref("svg.smil.enabled", false);

d:\firefox2010\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.debug", false);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

d:\firefox2010\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

d:\firefox2010\greprefs\all.js - pref("html5.enable", false);

d:\firefox2010\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

d:\firefox2010\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

d:\firefox2010\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

d:\firefox2010\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

d:\firefox2010\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

d:\firefox2010\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "Firefox web browser | Faster, more secure, & customizable");

d:\firefox2010\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

d:\firefox2010\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

d:\firefox2010\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

d:\firefox2010\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

d:\firefox2010\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

d:\firefox2010\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

d:\firefox2010\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

d:\firefox2010\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

d:\firefox2010\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

d:\firefox2010\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

d:\firefox2010\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

d:\firefox2010\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

d:\firefox2010\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - - ORPHANS VERWIJDERD - - - -

AddRemove-{B97CF5C3-0487-11D8-A36E-0050BAE317E1} - c:\program files\Uninstall_CDS.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-04-26 20:09

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\*Š¼oc0u]

"DisplayName"="?\11?\1c?\1c???"

"DeviceDesc"="?\11?\1c?\1c???"

"ProviderName"="?\11???\11\08"

"MFG"="??\09"

"ReinstallString"="8.593.100.0000"

"DeviceInstanceIds"=multi:"c:\\ati\\support\\10-02_legacy_xp32-64_dd_ccc\\driver\\xp_inf\\cx_95952.inf\00"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(724)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(8144)

c:\windows\TEMP\logishrd\LVPrcInj01.dll

c:\progra~1\WINDOW~2\wmpband.dll

c:\windows\system32\ntshrui.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\msi.dll

c:\windows\system32\NETSHELL.dll

c:\windows\system32\credui.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

d:\nod32\nod32krn.exe

d:\avg 2010\avgam.exe

d:\avg 2010\avgrsx.exe

d:\avg 2010\avgnsx.exe

c:\windows\SOUNDMAN.EXE

c:\windows\ALCWZRD.EXE

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

.

**************************************************************************

.

Voltooingstijd: 2010-04-26 20:13:11 - machine werd herstart

ComboFix-quarantined-files.txt 2010-04-26 18:13

ComboFix2.txt 2010-04-23 16:19

Pre-Run: 144.392.192 bytes beschikbaar

Post-Run: 181.493.760 bytes beschikbaar

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4

- - End Of File - - D9BAC97DF174D9C6D4E951D950BEAFAE

kape · 26 april 2010

Krijg je nu nog meldingen van Trojanen ?

Inloggen

2 trojaans infecties PSW agent.AFFO & Downloader agent2.SWO

Aanbevolen berichten

CBtje

kape

CBtje

kape

CBtje

thunderlight

jv9090

kape

CBtje

kape

Welkom op PC Helpforum

Leden statistieken

OVER ONS

SITEMAP

Home

Info

Handleidingen & Tips

Activiteit

Belangrijke informatie