Archief - Antivirus XP 2008 spyware

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:55:19, on 30/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar8.dll (file missing)
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar8.dll (file missing)
O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InstantOn] "C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe /c "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Nvidia] C:\Documents and Settings\Becht Bossuyt\wekpvz.exe
O4 - HKLM\..\Run: [ProgramChecker] C:\Program Files\Zenturi\ProgramChecker\pcheckp.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Openen in een nieuwe achtergrondtab - res://C:\Program Files\Windows Live Toolbar\Components\nl-be\msntabres.dll.mui/229?0e39e63456da4bb1b315579fcccb1082
O8 - Extra context menu item: Openen in een nieuwe voorgrondtab - res://C:\Program Files\Windows Live Toolbar\Components\nl-be\msntabres.dll.mui/230?0e39e63456da4bb1b315579fcccb1082
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://brechtbossuyt001.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130364442791
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131365030359
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\Zenturi\ProgramChecker\sassvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 13447 bytes

ComboFix 08-07-29.1 - Becht Bossuyt 2008-07-30 19:40:10.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1043.18.435 [GMT 2:00]
Gestart vanuit: C:\Documents and Settings\Becht Bossuyt\Bureaublad\ComboFix.exe
 * Nieuw herstelpunt werd aangemaakt

[color=red][b]WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !![/b][/color]
.

((((((((((((((((((((((((((((((((((   Andere Verwijderingen   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\BECHTB~1\LOCALS~1\Temp\services.exe
C:\Documents and Settings\Becht Bossuyt\Application Data\macromedia\Flash Player\#SharedObjects\STA7D2N8\iforex.com
C:\Documents and Settings\Becht Bossuyt\Application Data\macromedia\Flash Player\#SharedObjects\STA7D2N8\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Becht Bossuyt\Application Data\macromedia\Flash Player\#SharedObjects\STA7D2N8\www.broadcaster.com
C:\Documents and Settings\Becht Bossuyt\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Becht Bossuyt\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\Becht Bossuyt\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Becht Bossuyt\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Becht Bossuyt\Application Data\rhc16rj0et51
C:\Documents and Settings\Becht Bossuyt\real.txt
C:\WINDOWS\inf\wseqnx.inf
C:\WINDOWS\nwan.dat
C:\WINDOWS\system\userinfo32.ggt
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\blphc56rj0et51.scr
C:\WINDOWS\system32\lphc56rj0et51.exe
C:\WINDOWS\system32\phc56rj0et51.bmp
C:\WINDOWS\system32\pphc56rj0et51.exe
C:\WINDOWS\system32\real.txt
C:\WINDOWS\system32\UpMedia
D:\Autorun.inf

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SYMAVC32
-------\Service_infoxmid
-------\Service_symavc32
-------\Service_userinfo32


((((((((((((((((((((   Bestanden Gemaakt van 2008-06-28 to 2008-07-30  ))))))))))))))))))))))))))))))
.

2008-07-30 19:18 . 2008-07-30 19:19	664	--a------	C:\WINDOWS\system32\d3d9caps.dat
2008-07-30 18:11 . 2008-07-30 18:11	<DIR>	d--------	C:\Program Files\Trend Micro
2008-07-30 16:41 . 2008-07-30 16:41	4,920	--a------	C:\WINDOWS\system32\tmp.reg
2008-07-30 16:38 . 2008-07-02 13:33	82,432	--a------	C:\WINDOWS\system32\IEDFix.C.exe
2008-07-30 16:37 . 2007-09-06 00:22	289,144	--a------	C:\WINDOWS\system32\VCCLSID.exe
2008-07-30 16:37 . 2006-04-27 17:49	288,417	--a------	C:\WINDOWS\system32\SrchSTS.exe
2008-07-30 16:37 . 2008-05-29 09:35	86,528	--a------	C:\WINDOWS\system32\VACFix.exe
2008-07-30 16:37 . 2008-05-18 21:40	82,944	--a------	C:\WINDOWS\system32\IEDFix.exe
2008-07-30 16:37 . 2008-05-23 18:21	81,920	--a------	C:\WINDOWS\system32\404Fix.exe
2008-07-30 16:37 . 2003-06-05 21:13	53,248	--a------	C:\WINDOWS\system32\Process.exe
2008-07-30 16:37 . 2004-07-31 18:50	51,200	--a------	C:\WINDOWS\system32\dumphive.exe
2008-07-30 16:37 . 2007-10-04 00:36	25,600	--a------	C:\WINDOWS\system32\WS2Fix.exe
2008-07-30 16:26 . 2005-10-27 00:07	<DIR>	d---s----	C:\Documents and Settings\Administrator\UserData
2008-07-30 16:26 . 2005-10-26 23:24	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Sjablonen
2008-07-30 16:26 . 2006-03-07 13:09	<DIR>	dr-h-----	C:\Documents and Settings\Administrator\Onlangs geopend
2008-07-30 16:26 . 2005-10-27 01:21	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Netwerkprinteromgeving
2008-07-30 16:26 . 2006-03-07 12:45	<DIR>	dr-------	C:\Documents and Settings\Administrator\Mijn documenten
2008-07-30 16:26 . 2005-10-27 01:21	<DIR>	dr-------	C:\Documents and Settings\Administrator\Menu Start
2008-07-30 16:26 . 2006-03-06 17:30	<DIR>	dr-------	C:\Documents and Settings\Administrator\Favorieten
2008-07-30 16:26 . 2006-03-07 12:59	<DIR>	d--------	C:\Documents and Settings\Administrator\Bureaublad
2008-07-30 16:26 . 2006-03-07 12:13	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\CyberLink
2008-07-30 16:26 . 2006-02-16 12:57	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-07-30 16:26 . 2006-02-16 12:21	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Ahead
2008-07-30 16:26 . 2008-07-30 16:26	<DIR>	d--------	C:\Documents and Settings\Administrator
2008-07-30 15:07 . 2008-07-30 16:15	12,871	--a------	C:\qq.bin
2008-07-30 14:19 . 2008-07-30 14:19	131	--a------	C:\WINDOWS\wininit.ini
2008-07-30 13:21 . 2008-07-30 13:34	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-30 13:11 . 2008-07-30 13:11	<DIR>	d--------	C:\Program Files\Spybot - Search & Destroy
2008-07-30 13:11 . 2008-07-30 14:20	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-30 13:07 . 2008-07-30 13:07	<DIR>	d--------	C:\Program Files\Zenturi
2008-07-30 13:07 . 2008-07-30 13:07	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Zenturi
2008-07-30 13:07 . 2008-07-30 13:07	26,000	--a------	C:\WINDOWS\system32\E3TL.DLL
2008-07-30 13:06 . 2008-07-30 13:21	<DIR>	d--------	C:\Program Files\Common Files\Wise Installation Wizard
2008-07-26 20:45 . 2008-07-26 20:45	0	--a------	C:\WINDOWS\nsreg.dat
2008-07-19 12:20 . 2008-07-20 23:17	<DIR>	d--------	C:\Program Files\Game Cam V2
2008-07-16 01:09 . 2008-07-16 01:09	42,320	--a------	C:\WINDOWS\system32\xfcodec.dll
2008-07-15 11:18 . 2008-07-15 11:18	54,939	--a------	C:\Documents and Settings\Becht Bossuyt\dymscp.exe
2008-07-15 10:57 . 2008-07-15 10:57	54,939	--a------	C:\Documents and Settings\Becht Bossuyt\wekpvz.exe
2008-06-24 09:57 . 2008-06-30 08:03	54,156	--ah-----	C:\WINDOWS\QTFont.qfn
2008-06-24 09:57 . 2008-06-24 09:57	1,409	--a------	C:\WINDOWS\QTFont.for
2008-06-15 21:15 . 2008-06-15 21:15	<DIR>	d--------	C:\Documents and Settings\Becht Bossuyt\Application Data\vlc
2008-06-15 19:17 . 2008-06-15 19:17	<DIR>	d--------	C:\Program Files\VideoLAN
2008-06-10 21:38 . 2008-06-14 20:00	272,640	---------	C:\WINDOWS\system32\drivers\bthport.sys
2008-06-10 21:38 . 2008-06-14 20:00	272,640	-----c---	C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((   Find3M Rapport   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-30 17:22	---------	d-----w	C:\Program Files\Steam
2008-07-30 13:17	---------	d-----w	C:\Program Files\Common Files\Symantec Shared
2008-07-30 11:23	---------	d-----w	C:\Program Files\Lavasoft
2008-07-30 11:23	---------	d-----w	C:\Documents and Settings\Becht Bossuyt\Application Data\Lavasoft
2008-07-30 10:07	---------	d-----w	C:\Documents and Settings\Becht Bossuyt\Application Data\Xfire
2008-07-23 23:01	---------	d-s---w	C:\Program Files\Xfire
2008-07-19 10:17	---------	d-----w	C:\Program Files\Incomplete
2008-07-19 10:16	---------	d-----w	C:\Program Files\LimeWire
2008-07-11 20:34	12,292	----a-w	C:\Documents and Settings\Becht Bossuyt\Application Data\wklnhst.dat
2008-07-11 20:14	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-07-11 20:14	---------	d-----w	C:\Program Files\Ubisoft
2008-07-11 19:40	---------	d-----w	C:\Program Files\Yahoo!
2008-07-11 19:34	---------	d-----w	C:\Documents and Settings\Becht Bossuyt\Application Data\Yahoo!
2008-07-11 19:34	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-11 19:33	---------	d-----w	C:\Program Files\THQ
2008-06-20 10:45	360,320	----a-w	C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44	138,368	----a-w	C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52	225,920	----a-w	C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-02 20:19	73,456	----a-w	C:\Documents and Settings\Becht Bossuyt\Application Data\GDIPFONTCACHEV1.DAT
2008-05-04 11:07	89,243	----a-w	C:\Documents and Settings\Becht Bossuyt\isyftc.exe
2008-05-04 10:54	89,243	----a-w	C:\Documents and Settings\Becht Bossuyt\bfxirr.exe
2008-05-04 10:49	89,243	----a-w	C:\Documents and Settings\Becht Bossuyt\jfstlq.exe
2008-03-31 10:12	80,539	----a-w	C:\Documents and Settings\Becht Bossuyt\pkpkuz.exe
2008-03-24 22:19	16,384	----a-w	C:\Documents and Settings\Becht Bossuyt\dysnfy.exe
2008-02-29 18:19	7,168	----a-w	C:\Documents and Settings\Becht Bossuyt\llwkov.exe
2008-02-28 21:01	7,168	----a-w	C:\Documents and Settings\Becht Bossuyt\crgssb.exe
2008-02-28 17:40	7,168	----a-w	C:\Documents and Settings\Becht Bossuyt\dbnfoy.exe
2005-10-27 00:05	8	-csh--r	C:\WINDOWS\system32\7767FFB962.sys
2005-11-07 11:28	56	-csh--r	C:\WINDOWS\system32\EA74F080C2.sys
2005-11-07 11:28	5,746	-csha-w	C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-13 13:24	89,243	--sh--r	C:\WINDOWS\system32\vsqxuqcf.exe
2007-06-13 13:24	89,243	--sh--r	C:\WINDOWS\system32\vwbkxnah.exe
2007-06-13 13:24	89,243	--sh--r	C:\WINDOWS\system32\yjgctsav.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Opstartpunten   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-04-07 20:24 1271032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-26 17:47 171448]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CmUCRRun"="C:\WINDOWS\system32\CmUCReye.exe" [2005-10-12 15:44 241664]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 14:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 14:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 14:00 455168]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-10-10 21:49 7286784]
"PCMService"="C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" [2006-02-09 20:02 143360]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"InstantOn"="C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe" [2005-09-22 13:19 93640]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-07 12:31 155648]
"Lexmark 3100 Series"="C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe" [2003-07-28 18:50 106496]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 03:41 49152]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-09-05 19:22 26248]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22 517768]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-11-09 19:09 1838592]
"Nvidia"="C:\Documents and Settings\Becht Bossuyt\wekpvz.exe" [2008-07-15 10:57 54939]
"ProgramChecker"="C:\Program Files\Zenturi\ProgramChecker\pcheckp.exe" [2006-02-15 16:17 503808]
"CHotkey"="mHotkey.exe" [2004-12-08 18:57 550912 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2005-11-10 15:41 5585408 C:\WINDOWS\CNYHKey.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-11 18:23 15961088 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2005-10-10 21:49 1519616 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

C:\Documents and Settings\Becht Bossuyt\Menu Start\Programma's\Opstarten\
Xfire.lnk - C:\Program Files\Xfire\Xfire.exe [2008-07-16 01:09:02 3050832]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472]
Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-07-12 19:13:29 1073152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.mkdmp3enc"= C:\PROGRA~1\HOMECI~1\POWERC~1\Kernel\Burner\MKDMP3Enc.ACM
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nbn63.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\Xfire\\Xfire.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Steam\\SteamApps\\belgianreaver\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\w4rm0nk3y\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\w4rm0nk3y\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\Program Files\\Steam\\SteamApps\\w4rm0nk3y\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\The Battle for Middle-earth II\\game.dat"=
"C:\\Program Files\\Steam\\SteamApps\\w4rm0nk3y\\counter-strike\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\w4rm0nk3y\\deathmatch classic\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\w4rm0nk3y\\ricochet\\hl.exe"=
"C:\\Program Files\\MAIET\\Gunz\\GunzLauncher.exe"=
"C:\\Program Files\\MAIET\\Gunz\\Gunz.exe"=
"C:\\Program Files\\Steam\\SteamApps\\w4rm0nk3y\\day of defeat\\hl.exe"=
"C:\\Program Files\\Steam\\SteamApps\\belgianreaver\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Steam\\SteamApps\\belgianreaver\\half-life 2\\hl2.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Steam\\SteamApps\\w4rm0nk3y\\dark messiah might and magic multi-player\\mm.exe"=
"C:\\Program Files\\Steam\\SteamApps\\belgianreaver\\source sdk base\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\The Battle for Middle-earth II\\patchget.dat"=
"C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\Becht Bossuyt\\pkpkuz.exe"=
"C:\\Documents and Settings\\Becht Bossuyt\\wekpvz.exe"=

R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-12-06 12:16]
R3 CMISTOR;CMIUCR.SYS CM220 Card Reader Driver;C:\WINDOWS\system32\DRIVERS\cmiucr.SYS [2005-10-04 19:37]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-10-19 12:20]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e76281e-ffe4-11db-9528-0012bf644e92}]
\Shell\AutoRun\command - K:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{829b61a4-ad24-11da-9635-806d6172696f}]
\Shell\AutoRun\command - G:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e551563c-06f2-11dc-9534-0012bf644e92}]
\Shell\AutoRun\command - K:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Inhoud van de 'Gedeelde Taken' map

2008-07-30 C:\WINDOWS\Tasks\Controleren op updates voor Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

2008-07-25 C:\WINDOWS\Tasks\Norton Internet Security - Volledige systeemscan - Becht Bossuyt.job
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-06 23:38]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Error Safe - C:\Program Files\Error Safe\ERS.exe
HKCU-Run-Netlog Music Tool - C:\Program Files\Netlog Music Tool\NetlogMusicTool.exe
HKLM-Run-lphc56rj0et51 - C:\WINDOWS\system32\lphc56rj0et51.exe
HKLM-Run-SMrhc16rj0et51 - C:\Program Files\rhc16rj0et51\rhc16rj0et51.exe


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.be/
R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.com/
R0 -: HKLM-Main,Search Bar = hxxp://internetsearchservice.com/ie6.html
R0 -: HKLM-Main,SearchMigratedDefaultURL = hxxp://internetsearchservice.com/search?q={searchTerms}
R1 -: HKLM-Internet Explorer,SearchURL = hxxp://internetsearchservice.com
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 -: Openen in een nieuwe achtergrondtab - C:\Program Files\Windows Live Toolbar\Components\nl-be\msntabres.dll.mui/229?0e39e63456da4bb1b315579fcccb1082
O8 -: Openen in een nieuwe voorgrondtab - C:\Program Files\Windows Live Toolbar\Components\nl-be\msntabres.dll.mui/230?0e39e63456da4bb1b315579fcccb1082


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-30 19:46:25
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PSSdk23]
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\PsSdk23.drv"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Voltooingstijd: 2008-07-30 19:53:47 - machine was rebooted
ComboFix-quarantined-files.txt  2008-07-30 17:53:00

Pre-Run: 36,548,636,672 bytes beschikbaar
Post-Run: 36,575,698,944 bytes beschikbaar

283	--- E O F ---	2008-07-10 09:51:57