[OPGELOST] virus

basserd · 11 maart 2008

hey ik heb ook een virus ik denk hetzelfde maar ik weet niet wat ik moet verwijderen(durf het zelf ook niet te doen wie weet iets van windows) dus hier heb je mijn hijackthis lijst:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:56:57, on 11/03/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Telemeter 3.0\telemeter3.exe

C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe

C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe

C:\Program Files\GameFace Messenger\GameFace.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\TrojanHunter 5.0\THGuard.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Xfire\xfire.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\MSN Messenger\usnsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\iTunes\iTunes.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe

C:\PROGRA~1\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Eigenaar\LOCALS~1\Temp\services.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE

O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [GameFace Messenger] C:\Program Files\GameFace Messenger\GameFace.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\Eigenaar\LOCALS~1\Temp\services.exe

O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DeskSpace] C:\Program Files\DeskSpace\deskspace.exe

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')

O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe

O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe

O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://basserdbastheeuwes.spaces.live.com/PhotoUpload/MsnPUpld.cab

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--

End of file - 9809 bytes

kape · 11 maart 2008

Download Combofix.exe en zet het op je Bureaublad.

Uninstall alle Messengers (MSN, e.a.). Als je PC clean is kan je deze pas terug downloaden.

Start Hijackthis op en kies voor 'Do a system scan only'. Selecteer alleen de items hieronder genoemd:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\Eigenaar\LOCALS~1\Temp\services.exe

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger .exe

Klik op 'Fix checked' om de items te verwijderen.

Dubbelklik op Combofix.exe en volg de instructies, aanvaard de disclaimer door y te typen. Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.

NOTA: Indien je virusscanner reageert met een melding van een scriptuitvoering, moet je dit toestaan.

Post in een volgend bericht een nieuw log van HJT en het log van Combofix … en laat meteen eens weten of er al verandering te merken is.

basserd · 11 maart 2008

hier heb je het van combofix:

ComboFix 08-03-10.1 - Eigenaar 2008-03-11 21:26:46.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.2325 [GMT 1:00]

Gestart vanuit: C:\Documents and Settings\Eigenaar\Bureaublad\ComboFix.exe

* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\Eigenaar\Application Data\inst.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2008-02-11 to 2008-03-11 ))))))))))))))))))))))))))))))

.

2008-03-11 19:56 . 2008-03-11 19:56 <DIR> d-------- C:\Program Files\Trend Micro

2008-03-11 19:10 . 2008-03-11 19:10 9,296 --a------ C:\Documents and Settings\Eigenaar\mnezvc.exe

2008-03-11 18:52 . 2008-03-11 18:52 244 --ah----- C:\sqmnoopt18.sqm

2008-03-11 18:52 . 2008-03-11 18:52 232 --ah----- C:\sqmdata18.sqm

2008-03-07 13:48 . 2008-03-07 13:48 244 --ah----- C:\sqmnoopt17.sqm

2008-03-07 13:48 . 2008-03-07 13:48 232 --ah----- C:\sqmdata17.sqm

2008-03-07 13:34 . 2008-03-07 13:34 244 --ah----- C:\sqmnoopt16.sqm

2008-03-07 13:34 . 2008-03-07 13:34 244 --ah----- C:\sqmnoopt15.sqm

2008-03-07 13:34 . 2008-03-07 13:34 232 --ah----- C:\sqmdata16.sqm

2008-03-07 13:34 . 2008-03-07 13:34 232 --ah----- C:\sqmdata15.sqm

2008-03-07 12:42 . 2008-03-07 12:42 <DIR> d-------- C:\Documents and Settings\Eigenaar\Application Data\TrojanHunter

2008-03-07 12:40 . 2008-03-11 20:04 <DIR> d-------- C:\Program Files\TrojanHunter 5.0

2008-03-07 12:34 . 2008-03-07 14:45 <DIR> d-------- C:\Program Files\Spyware Doctor

2008-03-05 17:11 . 2008-03-05 17:13 <DIR> d-------- C:\WARCRAFT

2008-03-01 00:29 . 2008-03-02 15:33 <DIR> d-------- C:\DUKE3D

2008-02-27 15:26 . 2008-02-27 15:26 <DIR> d-------- C:\Program Files\iPod

2008-02-21 21:23 . 2008-02-21 21:23 <DIR> d-------- C:\Program Files\PremiumSoft

2008-02-21 21:23 . 2006-04-13 11:30 1,073,152 --a------ C:\WINDOWS\system32\libmysql_c.dll

2008-02-21 18:46 . 2008-02-23 02:15 <DIR> d-------- C:\Documents and Settings\Eigenaar\Application Data\Hamachi

2008-02-21 18:45 . 2008-02-21 18:46 <DIR> d-------- C:\Program Files\Hamachi

2008-02-21 18:45 . 2008-02-21 18:45 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys

2008-02-21 02:57 . 2008-02-21 02:57 54,608 --a------ C:\WINDOWS\system32\xfcodec.dll

2008-02-20 15:03 . 2008-02-20 15:03 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE

2008-02-15 22:08 . 2008-02-15 22:25 139,264 --a------ C:\WINDOWS\War3Unin.exe

2008-02-15 22:08 . 2008-02-16 01:36 76,096 --a------ C:\WINDOWS\War3Unin.dat

2008-02-15 22:08 . 2008-02-15 22:25 2,829 --a------ C:\WINDOWS\War3Unin.pif

2008-02-15 22:04 . 2008-02-27 20:33 <DIR> d-------- C:\Program Files\Warcraft III

2008-02-14 19:24 . 2008-02-14 19:24 <DIR> d-------- C:\WINDOWS\INDSOFT

2008-02-14 19:24 . 2008-02-14 19:24 278,016 --a------ C:\WINDOWS\FASTEROVA1.SCR

2008-02-14 18:50 . 2008-02-14 18:50 <DIR> d-------- C:\Documents and Settings\Eigenaar\Application Data\OtakuSoftware

2008-02-14 18:49 . 2008-02-22 14:08 <DIR> d-------- C:\Program Files\DeskSpace

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-11 20:23 --------- d-----w C:\Program Files\MSN Messenger

2008-03-11 20:22 --------- d-----w C:\Program Files\SubSync

2008-03-11 19:15 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\uTorrent

2008-03-11 19:05 --------- d-----w C:\Program Files\World of Warcraft

2008-03-11 18:40 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\LimeWire

2008-03-11 17:36 --------- d-----w C:\Program Files\Steam

2008-03-11 17:34 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\AVG7

2008-03-10 21:42 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\Xfire

2008-03-10 21:38 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\U3

2008-03-07 13:45 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP

2008-03-07 12:57 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys

2008-03-07 12:57 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe

2008-03-07 12:03 --------- d-----w C:\Program Files\DAEMON Tools

2008-03-07 11:29 --------- d-----w C:\Program Files\Xfire

2008-02-27 14:26 --------- d-----w C:\Program Files\iTunes

2008-02-27 14:25 --------- d-----w C:\Program Files\QuickTime

2008-02-20 14:04 --------- d-----w C:\Program Files\AlienGUIse

2008-02-19 19:54 --------- d-----w C:\Program Files\LimeWire

2008-02-12 21:30 --------- d-----w C:\Program Files\Guild Wars

2008-02-03 23:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd

2008-02-03 23:04 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2008-02-03 23:04 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf

2008-02-03 23:03 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-02-03 23:03 --------- d-----w C:\Program Files\Common Files\Logishrd

2008-02-03 23:03 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\InstallShield

2008-02-02 23:10 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe

2008-02-02 20:42 22,328 ----a-w C:\Documents and Settings\Eigenaar\Application Data\PnkBstrK.sys

2008-02-02 20:20 --------- d-----w C:\Program Files\Activision

2008-02-02 19:49 --------- d--h--w C:\Documents and Settings\Eigenaar\Application Data\ijjigame

2008-02-02 19:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\IJJIGame

2008-02-01 22:02 --------- d-----w C:\Program Files\DivX

2008-02-01 21:54 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\GetRightToGo

2008-01-27 15:03 53,248 ----a-w C:\WINDOWS\system32\apache.dll

2008-01-23 20:20 --------- d-----w C:\Program Files\Xicat

2008-01-22 17:01 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE

2008-01-22 17:01 249,856 ------w C:\WINDOWS\Setup1.exe

2008-01-21 16:10 --------- d-----w C:\Program Files\Windows Live

2008-01-20 21:16 --------- d-----w C:\Program Files\OneStepSearch

2008-01-19 02:30 --------- d-----w C:\Program Files\Carmageddon II Carpocalypse Now

2008-01-17 20:58 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\mIRC

2008-01-17 20:52 --------- d-----w C:\Program Files\mIRC

2008-01-11 21:53 --------- d-----w C:\Documents and Settings\Eigenaar\Application Data\Skype

2008-01-09 11:28 76,304 ----a-w C:\WINDOWS\system32\KemXML.dll

2008-01-09 11:28 141,840 ----a-w C:\WINDOWS\system32\KemUtil.dll

2008-01-09 11:28 117,264 ----a-w C:\WINDOWS\system32\KemWnd.dll

2008-01-09 11:27 170,512 ----a-w C:\WINDOWS\system32\kemutb.dll

2008-01-09 11:26 301,656 ----a-w C:\WINDOWS\system32\BtCoreIf.dll

2008-01-09 11:18 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe

2008-01-09 11:18 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

2008-01-09 11:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll

2008-01-09 11:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll

2008-01-09 11:16 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll

2008-01-09 11:16 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll

2008-01-09 11:16 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll

2008-01-09 11:16 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll

2008-01-09 11:16 682,496 ----a-w C:\WINDOWS\system32\DivX.dll

2008-01-09 11:16 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll

2007-12-24 12:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll

2007-12-11 19:44 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll

2007-12-11 19:44 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll

2007-12-11 19:44 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll

2007-12-11 19:44 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll

2007-12-11 19:44 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll

2007-12-11 19:44 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll

2007-12-11 19:44 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe

2007-12-11 19:43 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll

2007-11-10 16:26 47,360 ----a-w C:\Documents and Settings\Eigenaar\Application Data\pcouffin.sys

2007-11-17 01:01 56 --sh--r C:\WINDOWS\system32\D9C5265583.sys

2007-11-17 01:01 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

REGEDIT4

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]

"Steam"="C:\Program Files\Steam\Steam.exe" [2007-11-30 17:10 1266936]

"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784]

"ASUS SmartDoctor"="C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe" [2007-10-01 21:58 1126400]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:03 15360]

"DeskSpace"="C:\Program Files\DeskSpace\deskspace.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-01 07:48 16208384 C:\WINDOWS\RTHDCPL.exe]

"SkyTel"="SkyTel.EXE" [2006-05-16 09:04 2879488 C:\WINDOWS\SkyTel.exe]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-08-24 19:05 39424]

"Telemeter 3.0"="C:\Program Files\Telemeter 3.0\telemeter3.exe" [2007-04-15 23:38 1441792]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 02:17 55824 C:\WINDOWS\KHALMNPR.Exe]

"Launch LGDCore"="C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" [2006-07-23 02:22 1126400]

"Launch LCDMon"="C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe" [ ]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 20:21 57344]

"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 12:09 579072]

"GameFace Messenger"="C:\Program Files\GameFace Messenger\GameFace.exe" [2006-11-01 14:50 2154496]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008]

"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe]

"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 02:17 55824 C:\WINDOWS\KHALMNPR.Exe]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-05 17:11 219136]

"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ]

C:\Documents and Settings\Eigenaar\Menu Start\Programma's\Opstarten\

Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-02-21 02:57:28 2945872]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\

Acer WLAN 11g USB Dongle.lnk - C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 19:25:14 745472]

Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 16:05:38 553021]

Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-13 17:19:43 67128]

Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-02-04 00:03:46 789008]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Xfire\\xfire.exe"=

"C:\\Program Files\\Steam\\Steam.exe"=

"C:\\Program Files\\Steam\\steamapps\\bas777\\counter-strike source\\hl2.exe"=

"C:\\WINDOWS\\system32\\PnkBstrA.exe"=

"C:\\WINDOWS\\system32\\PnkBstrB.exe"=

"C:\\Program Files\\uTorrent\\uTorrent.exe"=

"C:\\Program Files\\mIRC\\mirc.exe"=

"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=

"C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enGB-downloader.exe"=

"C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enGB-patch-downloader.exe"=

"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

"C:\\Program Files\\Steam\\steamapps\\bas777\\day of defeat source\\hl2.exe"=

"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

"C:\\WINDOWS\\system32\\dpnsvr.exe"=

"C:\\Documents and Settings\\Eigenaar\\Bureaublad\\quake 3\\quake3.exe"=

"C:\\Sierra\\Empire Earth\\Empire Earth.exe"=

"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=

"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\LimeWire\\LimeWire.exe"=

"C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=

"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

"C:\\Program Files\\Steam\\steamapps\\bas777\\counter-strike\\hl.exe"=

"C:\\Program Files\\Steam\\steamapps\\bas777\\half-life 2 deathmatch\\hl2.exe"=

"C:\\Program Files\\EA GAMES\\Command & Conquer The First Decade\\Command & Conquer Renegade\\Renegade\\Game.exe"=

"C:\\ijji\\ENGLISH\\u_sf\\soldierfront.exe"=

"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=

"C:\\AC Web Ultimate Repack\\Server\\mysql\\bin\\mysqld.exe"=

"C:\\AC Web Ultimate Repack\\Server\\apache\\bin\\apache.exe"=

"C:\\AC Web Ultimate Repack\\Ascent\\ascent-world.exe"=

"C:\\Program Files\\iTunes\\iTunes.exe"=

"C:\\Program Files\\Steam\\steamapps\\bas777\\source sdk base\\hl2.exe"=

"C:\\DOCUME~1\\Eigenaar\\LOCALS~1\\Temp\\services.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [2005-12-06 16:11]

S3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-07-12 10:03]

S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2005-10-28 10:38]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88aa16cd-7f2e-11dc-b7f5-001921e7c76f}]

\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8e8b506-9da9-11dc-b839-001921e7c76f}]

\Shell\AutoRun\command - J:\LaunchU3.exe -a

.

Inhoud van de 'Gedeelde Taken' map

"2007-09-06 15:42:18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

"2008-03-11 17:02:56 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Program Files\Windows Defender\MpCmdRun.exe

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-11 21:31:24

Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

? [2604]

? [1480]

? [1744]

? [3484]

? [3448]

? [3892]

? [1488]

? [1028]

? [1724]

? [3256]

? [1344]

? [3564]

? [3472]

? [2788]

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

Voltooingstijd: 2008-03-11 21:31:50

ComboFix-quarantined-files.txt 2008-03-11 20:31:48

.

2008-03-07 11:32:06 --- E O F ---

en hier van hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:33:01, on 11/03/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Telemeter 3.0\telemeter3.exe

C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe

C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe

C:\Program Files\GameFace Messenger\GameFace.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Xfire\xfire.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\System32\msiexec.exe