Archief - kan er iemand eens naar dit kijken

jakke25 · 25 apr 2007

yo, ik zit met een probleem, als ik een spel aan het spelen ben heb ik vaak last van fps drops, en ik heb al gemerkt omdat dit komt dat men cpu gebruik boven de 70% gaat, ik heb alles eens afgesloten zoals firewall, msn,... en alleen proberen te spelen, en ik had het nog, vroeger had ik er totaal geen last van

system specs:
intel pentium 3.2 ghz
1 gig ram
200 gig HDD
nvidia fx5700 256mb

hijackthis logje:

Logfile of HijackThis v1.99.1
Scan saved at 22:34:21, on 25/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Hijack This\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.Begin2Search.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {0DCB5330-646A-4D44-9938-FC72068960B6} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {60C152C2-F58E-EFF5-E463-E057D2404CA7} - (no file)
O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Systeemvak van ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {556EEC63-31E2-47C3-BF29-DFF799D2FE04} (Remote Access ActiveX Client) - https://secure.logmein.com/activex/RACtrl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mijnalbum.nl/skin/system/upload/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: ddabx - C:\WINDOWS\system32\ddabx.dll (file missing)
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

dit is gewoon als ik niet aan het spelen ben ofzo

Jurgenv1 · 26 apr 2007

Download VundoFix.exe naar je bureaublad.

Dubbelklik VundoFix.exe om het te starten.
Klik de Scan for Vundo knop.
Eenmaal gedaan met scannen, klik de Remove Vundo knop.
Je zal een melding krijgen of je de bestanden wilt laten verwijderen, klik YES
Nadat je Yes hebt geklikt, zullen de icoontjes op je bureaublad verdwijnen tijdens het verwijderen van Vundo.
Wanneer voltooid zal je de melding krijgen dat het je PC zal afsluiten, klik OK.
Start je pc terug opnieuw op.
Post de inhoud van C:\vundofix.txt en een nieuwe hijackthislog in je volgende post.

Note: Het is mogelijk dat vundofix een bestand gevonden heeft dat niet kon verwijderd worden.
In dit geval zal VundoFix na het heropstarten van je pc nog eens opstarten. Dan moet je de instructies van hierboven nog eens uitvoeren vanaf: "Click the Scan for Vundo."

jakke25 · 26 apr 2007

hij zegt dat hij geen infected files gevonden heeft

Jurgenv1 · 26 apr 2007

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

jakke25 · 26 apr 2007

ok, hier zijn de logs waar je voor gevraagd hebt

hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 21:14, on 07-04-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Hijack This\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.Begin2Search.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {0DCB5330-646A-4D44-9938-FC72068960B6} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {60C152C2-F58E-EFF5-E463-E057D2404CA7} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Systeemvak van ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {556EEC63-31E2-47C3-BF29-DFF799D2FE04} (Remote Access ActiveX Client) - https://secure.logmein.com/activex/RACtrl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mijnalbum.nl/skin/system/upload/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: ddabx - C:\WINDOWS\system32\ddabx.dll (file missing)
O20 - Winlogon Notify: LMIinit - LMIinit.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

en dit is de combofix log:

06-03-30 20:13 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\keyboard61.dat.vir
06-03-30 20:14 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\emdat.tm.vir
06-03-30 20:14 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\emdat.tmp.vir
06-08-02 20:14 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx0.dll.vir
06-08-02 20:17 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx1.dll.vir
06-08-02 20:21 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx2.dll.vir
06-08-02 20:49 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx3.dll.vir
06-08-02 20:52 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx4.dll.vir
06-08-02 20:56 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx5.dll.vir
06-08-02 21:24 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx6.dll.vir
06-08-02 21:27 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx7.dll.vir
06-08-02 21:31 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx8.dll.vir
06-08-02 21:59 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx9.dll.vir
06-08-02 22:02 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx10.dll.vir
06-08-02 22:06 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx11.dll.vir
06-08-02 22:34 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx12.dll.vir
06-08-02 22:38 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx13.dll.vir
06-08-02 22:41 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx14.dll.vir
06-08-02 23:09 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx15.dll.vir
06-08-02 23:13 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx16.dll.vir
06-08-02 23:16 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx17.dll.vir
06-08-02 23:44 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx18.dll.vir
06-08-02 23:48 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx19.dll.vir
06-08-02 23:51 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx20.dll.vir
06-08-03 00:19 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx21.dll.vir
06-08-03 00:23 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx22.dll.vir
06-08-03 00:26 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx23.dll.vir
06-08-03 00:54 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx24.dll.vir
06-08-03 00:58 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx25.dll.vir
06-08-03 01:01 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx26.dll.vir
06-08-03 01:29 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx27.dll.vir
06-08-03 01:33 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx28.dll.vir
06-08-03 01:36 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx29.dll.vir
06-08-03 02:04 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx30.dll.vir
06-08-03 02:08 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx31.dll.vir
06-08-03 02:11 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx32.dll.vir
06-08-03 02:40 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx33.dll.vir
06-08-03 02:43 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx34.dll.vir
06-08-03 02:46 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx35.dll.vir
06-08-03 03:15 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx36.dll.vir
06-08-03 03:18 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx37.dll.vir
06-08-03 03:21 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx38.dll.vir
06-08-03 03:50 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx39.dll.vir
06-08-03 03:53 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx40.dll.vir
06-08-03 03:56 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx41.dll.vir
06-08-03 04:25 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx42.dll.vir
06-08-03 04:28 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx43.dll.vir
06-08-03 04:31 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx44.dll.vir
06-08-03 05:00 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx45.dll.vir
06-08-03 05:03 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx46.dll.vir
06-08-03 05:06 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx47.dll.vir
06-08-03 05:35 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx48.dll.vir
06-08-03 05:38 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx49.dll.vir
06-08-03 05:42 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx50.dll.vir
06-08-03 06:10 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx51.dll.vir
06-08-03 06:13 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx52.dll.vir
06-08-03 06:17 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx53.dll.vir
06-08-03 06:45 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx54.dll.vir
06-08-03 06:48 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx55.dll.vir
06-08-03 06:52 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx56.dll.vir
06-08-03 07:20 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx57.dll.vir
06-08-03 07:23 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx58.dll.vir
06-08-03 07:27 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx59.dll.vir
06-08-03 07:55 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx60.dll.vir
06-08-03 07:58 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx61.dll.vir
06-08-03 08:02 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx62.dll.vir
06-08-03 08:30 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx63.dll.vir
06-08-03 08:33 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx64.dll.vir
06-08-03 08:37 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx65.dll.vir
06-08-03 09:05 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx66.dll.vir
06-08-03 09:09 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx67.dll.vir
06-08-03 09:12 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx68.dll.vir
06-08-03 09:40 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx69.dll.vir
06-08-03 09:44 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx70.dll.vir
06-08-03 09:47 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx71.dll.vir
06-08-03 10:15 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx72.dll.vir
06-08-03 10:19 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx73.dll.vir
06-08-03 10:22 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx74.dll.vir
06-08-03 10:50 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx75.dll.vir
06-08-03 10:54 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx76.dll.vir
06-08-03 10:57 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx77.dll.vir
06-08-03 11:25 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx78.dll.vir
06-08-03 11:29 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx79.dll.vir
06-08-03 11:32 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx80.dll.vir
06-08-03 12:00 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx81.dll.vir
06-08-03 12:04 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx82.dll.vir
06-08-03 12:07 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx83.dll.vir
06-08-03 12:35 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx84.dll.vir
06-08-03 12:39 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx85.dll.vir
06-08-03 12:42 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx86.dll.vir
06-08-03 13:11 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx87.dll.vir
06-08-03 13:14 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx88.dll.vir
06-08-03 13:17 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx89.dll.vir
06-08-03 13:46 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx90.dll.vir
06-08-03 13:49 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx91.dll.vir
06-08-03 13:52 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx92.dll.vir
06-08-03 14:21 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx93.dll.vir
06-08-03 14:24 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx94.dll.vir
06-08-03 14:27 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx95.dll.vir
06-08-03 14:56 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx96.dll.vir
06-08-03 14:59 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx97.dll.vir
06-08-03 15:02 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx98.dll.vir
06-08-03 15:31 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx99.dll.vir
06-08-03 15:34 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx100.dll.vir
06-08-03 15:37 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx101.dll.vir
06-08-03 16:06 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx102.dll.vir
06-08-03 16:09 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx103.dll.vir
06-08-03 16:12 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx104.dll.vir
06-08-03 16:41 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx105.dll.vir
06-08-03 16:44 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx106.dll.vir
06-08-03 16:48 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx107.dll.vir
06-08-03 17:16 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx108.dll.vir
06-08-03 17:19 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx109.dll.vir
06-08-03 17:23 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx110.dll.vir
06-08-03 17:51 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx111.dll.vir
06-08-03 17:54 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx112.dll.vir
06-08-03 17:58 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx113.dll.vir
06-08-03 18:26 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx114.dll.vir
06-08-03 18:29 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx115.dll.vir
06-08-03 18:33 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx116.dll.vir
06-08-03 19:01 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx117.dll.vir
06-08-03 19:04 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx118.dll.vir
06-08-03 19:08 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx119.dll.vir
06-08-03 19:36 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx120.dll.vir
06-08-03 19:39 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx121.dll.vir
06-08-03 19:43 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx122.dll.vir
06-08-03 20:11 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx123.dll.vir
06-08-03 20:14 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx124.dll.vir
06-08-03 20:18 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx125.dll.vir
06-08-03 20:46 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx126.dll.vir
06-08-03 20:50 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx127.dll.vir
06-08-03 20:53 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx128.dll.vir
06-08-03 21:21 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx129.dll.vir
06-08-03 21:25 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx130.dll.vir
06-08-03 21:28 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx131.dll.vir
06-08-03 21:56 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx132.dll.vir
06-08-03 22:00 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx133.dll.vir
06-08-03 22:03 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx134.dll.vir
06-08-03 22:31 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx135.dll.vir
06-08-03 22:35 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx136.dll.vir
06-08-03 22:38 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx137.dll.vir
06-08-03 23:06 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx138.dll.vir
06-08-03 23:10 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx139.dll.vir
06-08-03 23:13 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx140.dll.vir
06-08-03 23:41 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx141.dll.vir
06-08-03 23:45 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx142.dll.vir
06-08-03 23:48 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx143.dll.vir
06-08-04 00:16 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx144.dll.vir
06-08-04 00:20 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx145.dll.vir
06-08-04 00:23 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx146.dll.vir

Map PATH-lijst
Het volumenummer is 5052-6033
C:\QOOBOX
\---Quarantine
+---C
| \---WINDOWS
| | emdat.tm.vir
| | emdat.tmp.vir
| | keyboard61.dat.vir
| |
| \---system32
| \---components
| flx0.dll.vir
| flx1.dll.vir
| flx10.dll.vir
| flx100.dll.vir
| flx101.dll.vir
| flx102.dll.vir
| flx103.dll.vir
| flx104.dll.vir
| flx105.dll.vir
| flx106.dll.vir
| flx107.dll.vir
| flx108.dll.vir
| flx109.dll.vir
| flx11.dll.vir
| flx110.dll.vir
| flx111.dll.vir
| flx112.dll.vir
| flx113.dll.vir
| flx114.dll.vir
| flx115.dll.vir
| flx116.dll.vir
| flx117.dll.vir
| flx118.dll.vir
| flx119.dll.vir
| flx12.dll.vir
| flx120.dll.vir
| flx121.dll.vir
| flx122.dll.vir
| flx123.dll.vir
| flx124.dll.vir
| flx125.dll.vir
| flx126.dll.vir
| flx127.dll.vir
| flx128.dll.vir
| flx129.dll.vir
| flx13.dll.vir
| flx130.dll.vir
| flx131.dll.vir
| flx132.dll.vir
| flx133.dll.vir
| flx134.dll.vir
| flx135.dll.vir
| flx136.dll.vir
| flx137.dll.vir
| flx138.dll.vir
| flx139.dll.vir
| flx14.dll.vir
| flx140.dll.vir
| flx141.dll.vir
| flx142.dll.vir
| flx143.dll.vir
| flx144.dll.vir
| flx145.dll.vir
| flx146.dll.vir
| flx15.dll.vir
| flx16.dll.vir
| flx17.dll.vir
| flx18.dll.vir
| flx19.dll.vir
| flx2.dll.vir
| flx20.dll.vir
| flx21.dll.vir
| flx22.dll.vir
| flx23.dll.vir
| flx24.dll.vir
| flx25.dll.vir
| flx26.dll.vir
| flx27.dll.vir
| flx28.dll.vir
| flx29.dll.vir
| flx3.dll.vir
| flx30.dll.vir
| flx31.dll.vir
| flx32.dll.vir
| flx33.dll.vir
| flx34.dll.vir
| flx35.dll.vir
| flx36.dll.vir
| flx37.dll.vir
| flx38.dll.vir
| flx39.dll.vir
| flx4.dll.vir
| flx40.dll.vir
| flx41.dll.vir
| flx42.dll.vir
| flx43.dll.vir
| flx44.dll.vir
| flx45.dll.vir
| flx46.dll.vir
| flx47.dll.vir
| flx48.dll.vir
| flx49.dll.vir
| flx5.dll.vir
| flx50.dll.vir
| flx51.dll.vir
| flx52.dll.vir
| flx53.dll.vir
| flx54.dll.vir
| flx55.dll.vir
| flx56.dll.vir
| flx57.dll.vir
| flx58.dll.vir
| flx59.dll.vir
| flx6.dll.vir
| flx60.dll.vir
| flx61.dll.vir
| flx62.dll.vir
| flx63.dll.vir
| flx64.dll.vir
| flx65.dll.vir
| flx66.dll.vir
| flx67.dll.vir
| flx68.dll.vir
| flx69.dll.vir
| flx7.dll.vir
| flx70.dll.vir
| flx71.dll.vir
| flx72.dll.vir
| flx73.dll.vir
| flx74.dll.vir
| flx75.dll.vir
| flx76.dll.vir
| flx77.dll.vir
| flx78.dll.vir
| flx79.dll.vir
| flx8.dll.vir
| flx80.dll.vir
| flx81.dll.vir
| flx82.dll.vir
| flx83.dll.vir
| flx84.dll.vir
| flx85.dll.vir
| flx86.dll.vir
| flx87.dll.vir
| flx88.dll.vir
| flx89.dll.vir
| flx9.dll.vir
| flx90.dll.vir
| flx91.dll.vir
| flx92.dll.vir
| flx93.dll.vir
| flx94.dll.vir
| flx95.dll.vir
| flx96.dll.vir
| flx97.dll.vir
| flx98.dll.vir
| flx99.dll.vir
|
\---Registry_backups

Jurgenv1 · 26 apr 2007

Er is iets vreemd aan het logje van combofix, kan je nog eens combofix uitvoeren via de stappen die ik heb gepost?

jakke25 · 26 apr 2007

ik heb wel iets raar, ik moest niet op y duwen, maar op 1 om verder te gaan, en nu scant hij automatisch

jakke25 · 26 apr 2007

hier is een andere log, hij ziet er wel anders uit:

"jens mondelaers" - 07-04-26 23:53:15 Service Pack 2
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\jens mondelaers\Bureaublad\"

((((((((((((((((((((((((((((((( Files Created from 2007-03-26 to 2007-04-26 ))))))))))))))))))))))))))))))))))

2007-04-26 21:19 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-04-26 18:04 <DIR> d-------- C:\VundoFix Backups
2007-04-25 22:24 <DIR> d-------- C:\Program Files\Hijack This
2007-04-25 17:03 51,072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-04-25 17:03 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys
2007-04-25 17:03 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-04-25 17:03 <DIR> d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\PC Tools
2007-04-25 17:01 78,336 --a------ C:\WINDOWS\system32\drivers\ssi.sys
2007-04-25 17:01 102,912 --a------ C:\WINDOWS\system32\islzma.dll
2007-04-25 17:01 <DIR> d-------- C:\Program Files\Webroot
2007-04-25 17:01 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-04-25 17:01 <DIR> d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\Webroot
2007-04-25 17:00 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-04-25 17:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-04-25 06:13 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2007-04-21 13:44 <DIR> d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\My Battle for Middle-earth(tm) II Files
2007-04-20 20:05 <DIR> d-------- C:\Program Files\SiSoftware
2007-04-16 00:12 <DIR> d-------- C:\shr
2007-04-15 23:40 <DIR> d-------- C:\Program Files\RegCleaner
2007-04-15 22:12 <DIR> d-------- C:\Program Files\Hitman Pro
2007-04-14 21:06 <DIR> d-------- C:\WINDOWS\.mpr_file_store_32
2007-04-14 21:04 <DIR> d-------- C:\Program Files\MoparScape
2007-04-13 16:31 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-13 00:19 <DIR> d-------- C:\Alien Arena 2007
2007-04-11 00:11 620,544 --a------ C:\WINDOWS\system32\stlpmt45.dll
2007-04-11 00:11 1,497,088 --a------ C:\WINDOWS\system32\cc3260mt.dll
2007-04-11 00:11 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2007-04-11 00:11 <DIR> d-------- C:\Program Files\AVSMedia
2007-04-11 00:08 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-04-11 00:03 <DIR> d-------- C:\Program Files\MP3 WAV Converter
2007-04-10 22:30 <DIR> d-------- C:\dolwin9
2007-04-09 15:10 <DIR> d-------- C:\Program Files\Dolphin
2007-04-09 14:56 <DIR> d-------- C:\roms
2007-04-09 14:35 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-04-09 14:35 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-04-09 14:35 <DIR> d-------- C:\Program Files\OpenAL
2007-04-09 14:32 <DIR> d-------- C:\Program Files\Bohemia Interactive
2007-04-09 02:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-04-09 02:29 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-04-09 02:29 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-04-09 02:29 <DIR> d-------- C:\WINDOWS\nview
2007-04-08 02:06 <DIR> d-------- C:\Program Files\NVTray
2007-04-03 22:33 <DIR> d-------- C:\Program Files\Audacity 1.3 Beta (Unicode)
2007-04-03 22:33 <DIR> d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\Audacity
2007-04-03 22:30 <DIR> d-------- C:\Program Files\1stbenison
2007-04-01 22:31 <DIR> d-------- C:\Program Files\DMW Scanner 3
2007-03-29 22:14 <DIR> d-------- C:\Program Files\AV Vcs 4.0 DIAMOND
2007-03-28 13:56 <DIR> d-------- C:\Program Files\Common Files\EasyInfo

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-26 03:53 -------- d-------- C:\Program Files\logmein
2007-04-26 03:53 -------- d-------- C:\Program Files\daemon tools
2007-04-25 16:29 -------- d-------- C:\Program Files\mirc
2007-04-24 18:37 -------- d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\teamspeak2
2007-04-18 20:21 -------- d-------- C:\Program Files\electronic arts
2007-04-15 20:06 37608 --a------ C:\WINDOWS\system32\gdipfontcachev1.dat
2007-04-14 21:11 -------- d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\hamachi
2007-04-13 00:19 -------- d--h----- C:\Program Files\installshield installation information
2007-04-11 22:30 527 --a------ C:\DOCUME~1\JENSMO~1\APPLIC~1\gangsters2setup.lnk
2007-04-09 17:55 40 --a------ C:\WINDOWS\rsoftinfo.dat
2007-04-09 17:34 -------- d-------- C:\Program Files\monopoly here & now edition
2007-04-09 14:41 108144 --a------ C:\WINDOWS\system32\cmdlineext.dll
2007-04-08 21:30 -------- d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\xfire
2007-04-08 20:13 -------- d---s---- C:\Program Files\xfire
2007-04-08 18:55 -------- d-------- C:\Program Files\trackmania nations eswc
2007-04-08 18:47 -------- d-------- C:\Program Files\world of warcraft
2007-04-06 01:18 -------- d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\limewire
2007-04-05 12:31 -------- d-------- C:\Program Files\teamspeak2server
2007-04-03 10:03 -------- d-------- C:\Program Files\the all-seeing eye
2007-03-28 20:43 515984 --a------ C:\WINDOWS\system32\perfh013.dat
2007-03-28 20:43 103698 --a------ C:\WINDOWS\system32\perfc013.dat
2007-03-24 22:52 -------- d-------- C:\Program Files\teamspeak2_rc2
2007-03-17 22:20 -------- d-------- C:\Program Files\n-ball
2007-03-11 20:46 -------- d-------- C:\Program Files\tvtool
2007-03-11 15:31 -------- d-------- C:\Program Files\iulab
2007-03-11 15:12 -------- d-------- C:\Program Files\ea sports
2007-03-11 04:45 -------- d-------- C:\Program Files\alienguise
2007-03-10 23:19 -------- d-------- C:\Program Files\dmw client 3
2007-03-10 18:20 -------- d-------- C:\Program Files\limewire
2007-03-10 16:19 -------- d-------- C:\Program Files\togo game
2007-03-10 15:18 -------- d-------- C:\Program Files\xplosiv
2007-03-10 12:52 -------- d-------- C:\Program Files\hothouse creations
2007-03-10 03:20 -------- d-------- C:\Program Files\atari
2007-03-10 03:11 -------- d-------- C:\Program Files\gameshadow
2007-03-10 02:40 -------- d-------- C:\Program Files\evrsoft first page 2006
2007-03-08 17:39 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:39 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:39 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37 1843712 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-08 00:57 -------- d-------- C:\Program Files\wolfenstein - enemy territory
2007-03-07 15:23 -------- d-------- C:\Program Files\silkroad
2007-03-05 21:37 -------- d-------- C:\Program Files\Common Files\thraex software
2007-03-04 01:28 13566 --ahs---- C:\WINDOWS\system32\kgygaavl.sys
2007-03-04 01:25 56 -r-hs---- C:\WINDOWS\system32\7cfbf60cb6.sys
2007-03-04 01:25 -------- d-------- C:\Program Files\Common Files\enterbrain
2007-03-04 01:01 -------- d-------- C:\Program Files\ea games
2007-02-28 20:44 -------- d-------- C:\Program Files\Common Files\directx
2007-02-26 20:59 -------- d-------- C:\Program Files\sierra
2007-02-26 00:03 -------- d-------- C:\Program Files\pando networks
2007-02-25 13:05 294912 --a------ C:\WINDOWS\katerine.scr
2007-02-20 17:11 583 --a------ C:\WINDOWS\ereg.dat

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar4.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"SmcService"="C:\\PROGRA~1\\Sygate\\SPF\\smc.exe -startgui"
"PrinTray"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\printray.exe"
"SoundMan"="SOUNDMAN.EXE"
"MMTray"="MMTray.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Spyware Doctor"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
"{50526033-0CC0-2067-0722-050828030020}"="\"c:\\program files\\hitman pro\\update.exe\" mc-110-12-0000272"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ http://beautifulstacyferguson.atspa...gusonWallpapers/StacyFergusonWallpaper006.jpg

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddabx
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="MsgPlusLoader.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Adobe Reader Snelle start.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Snelle start.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Snelle start"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^F-Secure Anti-Virus 2006.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\F-Secure Anti-Virus 2006.lnk"
"backup"="C:\\WINDOWS\\pss\\F-Secure Anti-Virus 2006.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\F-SECU~1\\backweb\\4476822\\Program\\fspex.exe -startup"
"item"="F-Secure Anti-Virus 2006"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^InterVideo WinCinema Manager.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\InterVideo WinCinema Manager.lnk"
"backup"="C:\\WINDOWS\\pss\\InterVideo WinCinema Manager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\INTERV~1\\Common\\Bin\\WINCIN~1.EXE "
"item"="InterVideo WinCinema Manager"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^PCzapper Media Manager.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\PCzapper Media Manager.lnk"
"backup"="C:\\WINDOWS\\pss\\PCzapper Media Manager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\Program Files\\PCzapper\\MediaManager\\pbMediaCenter.exe "
"item"="PCzapper Media Manager"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^SnagIt 8.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\SnagIt 8.lnk"
"backup"="C:\\WINDOWS\\pss\\SnagIt 8.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\TECHSM~1\\SNAGIT~1\\SnagIt32.exe "
"item"="SnagIt 8"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^jens mondelaers^Menu Start^Programma's^Opstarten^Adobe Gamma.lnk]
"path"="C:\\Documents and Settings\\jens mondelaers\\Menu Start\\Programma's\\Opstarten\\Adobe Gamma.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^jens mondelaers^Menu Start^Programma's^Opstarten^Gangsters2Setup.lnk]
"path"="C:\\Documents and Settings\\jens mondelaers\\Menu Start\\Programma's\\Opstarten\\Gangsters2Setup.lnk"
"backup"="C:\\WINDOWS\\pss\\Gangsters2Setup.lnkStartup"
"location"="Startup"
"command"="C:\\Documents and Settings\\jens mondelaers\\Local Settings\\Application Data\\Microsoft\\CD Burning\\Applet.exe "
"item"="Gangsters2Setup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^jens mondelaers^Menu Start^Programma's^Opstarten^Xfire.lnk]
"path"="C:\\Documents and Settings\\jens mondelaers\\Menu Start\\Programma's\\Opstarten\\Xfire.lnk"
"backup"="C:\\WINDOWS\\pss\\Xfire.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\Xfire\\Xfire.exe "
"item"="Xfire"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="apdproxy"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cli"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="atiptaxx"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ashDisp"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="FSM32"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\F-Secure Internet Security\\Common\\FSM32.EXE\" /splash"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Startup Wizard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="FSSW"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\F-Secure Internet Security\\FSGUI\\FSSW.EXE\" /reboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TNBUtil"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\F-Secure Internet Security\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f2cd62f9.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="f2cd62f9"
"hkey"="HKCU"
"command"="C:\\Documents and Settings\\jens mondelaers\\Local Settings\\Application Data\\f2cd62f9.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="point32"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X84-X85 Button Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AcBtnMgr_X84-X85"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\LEXMAR~1\\AcBtnMgr_X84-X85.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X84-X85 Button Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ACMonitor_X84-X85"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\LEXMAR~1\\ACMonitor_X84-X85.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\liesenc]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PLUSGREAT"
"hkey"="HKCU"
"command"="C:\\DOCUME~1\\JENSMO~1\\APPLIC~1\\DENTRD~1\\PLUSGREAT.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Live Inside Dog Proc]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NewLies"
"hkey"="HKLM"
"command"="C:\\Documents and Settings\\All Users\\Application Data\\Grim Ping Live Inside\\NewLies.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Logi_MwX"
"hkey"="HKLM"
"command"="Logi_MwX.Exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LogMeInSystray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\LogMeIn\\LogMeInSystray.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsgPlus"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NVTray"
"hkey"="HKCU"
"command"="C:\\Program Files\\NVTray\\NVTray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Pando"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Pando Networks\\Pando\\Pando.exe\" /Minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DeviceManager"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Philips\\Philips Device Manager\\Bin\\DeviceManager.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PSDrvCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\PSDrvCheck.exe -CheckReg"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCRemote]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Remoterm"
"hkey"="HKLM"
"command"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\Remote\\Remoterm.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PMC"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe\" -host -clearDebug"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PDVDServ"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleToolbarNotifier"
"hkey"="HKCU"
"command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TRIXX]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TRIXX"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\TRIXX\\TRIXX.exe\" -s"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="uvPL"
"hkey"="HKLM"
"command"="C:\\Program Files\\Ulead Systems\\Ulead VideoStudio 10\\uvPL.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="C:\\Program Files\\Winamp\\winampa.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinDVR SchSvr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SchSvr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\InterVideo\\SchSvr\\SchSvr.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E]
Shell\AutoRun\command E:\setup\rsrc\Autorun.exe
Shell\dinstall\command E:\Directx\dxsetup.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2e02403f-f6ff-11da-95d7-00508d7e8936}]
Shell\AutoRun\command H:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{743fe0b9-b90e-11da-9325-806d6172696f}]
Shell\AutoRun\command E:\setup\rsrc\Autorun.exe
Shell\dinstall\command E:\Directx\dxsetup.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5579e28-ce8f-11db-a78b-806d6172696f}]
Shell\AutoRun\command E:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4d222be-b9ad-11da-9570-00508d7e8936}]
Shell\AutoRun\command F:\OblivionLauncher.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fbdaaa4a-06a5-11db-95e7-00508d7e8936}]
Shell\AutoRun\command I:\AutoRun.exe

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\A2F7AD75919425A5.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-26 23:57:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-26 23:57:53
C:\ComboFix-quarantined-files.txt ... 07-04-26 23:57
C:\ComboFix2.txt ... 07-04-26 21:19

Jurgenv1 · 27 apr 2007

* Download dit bestand: Deljob.exe (mirror)
Plaats het op je bureaublad.
Indien je virusscanner de download van deljob.exe blokkeert,
schakel dan tijdelijk je virusscanner uit of download de zip-versie
deljob.zip en pak deze uit naar je Bureaublad.
Dubbelklik Deljob.exe.
Een logje(logit.txt) zal openen, het bestandje kan je ook terugvinden op je bureaublad.
Post de inhoud van logit.txt in je volgende bericht.

jakke25 · 27 apr 2007

ACKUPS CREATED in C:\DELJOB

A2F7AD75919425A5.job
--------------------------------------------------------
FILES IN TASKS FOLDER

--------------------------------------------------------
EXPORT APP DATA FOLDERS

Het volume in station C heeft geen naam.
Het volumenummer is 5052-6033

Map van C:\Documents and Settings\jens mondelaers\Application Data

25/04/2007 17:03 <DIR> .
25/04/2007 17:03 <DIR> ..
28/08/2006 19:50 <DIR> Adobe
31/03/2006 18:26 <DIR> AdobeUM
28/10/2006 18:25 <DIR> Ahead
25/01/2007 14:47 <DIR> APPLEC~1 Apple Computer
17/05/2006 17:54 <DIR> ATI
03/04/2007 22:42 <DIR> Audacity
04/08/2006 18:48 <DIR> AVG7
05/04/2006 10:51 <DIR> CYBERL~1 CyberLink
26/05/2006 01:37 <DIR> DEEPBU~1 DeepBurner
05/04/2007 09:51 <DIR> DENTRD~1 Dent Rdr Dead
08/05/2006 18:13 <DIR> F-Secure
25/01/2007 13:46 <DIR> GLOBAL~1 GlobalSCAPE
04/08/2006 12:30 <DIR> Google
14/04/2007 21:11 <DIR> Hamachi
06/04/2006 14:07 <DIR> Help
21/03/2006 21:11 <DIR> IDENTI~1 Identities
19/10/2006 23:06 <DIR> INSTAL~1 InstallShield
17/05/2006 17:19 <DIR> INTERT~1 InterTrust
17/05/2006 17:17 <DIR> INTERV~1 InterVideo
25/01/2007 00:57 <DIR> Ipswitch
06/04/2006 00:05 <DIR> Jasc
01/04/2006 22:21 <DIR> JASCSO~1 Jasc Software Inc
28/07/2006 08:10 <DIR> Lavasoft
06/04/2007 01:18 <DIR> LimeWire
11/10/2006 22:27 <DIR> MACROM~1 Macromedia
13/05/2006 09:18 <DIR> MATCHW~1 MatchWare
12/10/2006 22:44 <DIR> MEDIAP~1 Media Player Classic
24/02/2007 23:27 <DIR> MICROS~1 Microsoft
13/04/2007 16:31 <DIR> Mozilla
21/04/2007 14:14 <DIR> MYBATT~1 My Battle for Middle-earth(tm) II Files
11/05/2006 19:59 <DIR> NETMED~1 NetMedia Providers
12/10/2006 18:36 <DIR> OPENOF~1.ORG OpenOffice.org2
25/04/2007 17:03 <DIR> PCTOOL~1 PC Tools
07/05/2006 18:40 <DIR> PEX
11/05/2006 16:05 <DIR> PINNAC~1 Pinnacle Systems
11/05/2006 19:59 <DIR> PUBLIS~1 Publish Providers
09/04/2006 17:10 <DIR> SEVENZ~1 Seven Zip
25/01/2007 01:07 <DIR> SmartFTP
11/05/2006 19:59 <DIR> SONICF~1 Sonic Foundry
27/12/2006 00:23 <DIR> Sony
29/03/2006 23:07 <DIR> Sun
24/04/2007 18:37 <DIR> TEAMSP~1 teamspeak2
23/07/2006 12:03 <DIR> ULEADS~1 Ulead Systems
21/05/2006 15:10 <DIR> vlc
25/04/2007 17:01 <DIR> Webroot
08/06/2006 16:46 <DIR> WHOLES~1 WholeSecurity
08/04/2007 21:30 <DIR> Xfire
0 bestand(en) 0 bytes
49 map(pen) 8.981.123.072 bytes beschikbaar
Het volume in station C heeft geen naam.
Het volumenummer is 5052-6033

Map van C:\Documents and Settings\All Users\Application Data

25/04/2007 17:00 <DIR> .
25/04/2007 17:00 <DIR> ..
17/03/2007 22:27 <DIR> 55-55-~1 55-55-n6-26-23-56
31/03/2006 18:25 <DIR> Adobe
27/03/2006 22:53 <DIR> ADOBES~1 Adobe Systems
07/04/2006 18:57 <DIR> Ahead
23/07/2006 10:07 <DIR> APPLEC~1 Apple Computer
13/04/2007 09:59 <DIR> avg7
05/04/2006 10:49 <DIR> CYBERL~1 CyberLink
04/08/2006 12:28 <DIR> Google
05/04/2007 09:51 <DIR> GRIMPI~1 Grim Ping Live Inside
04/08/2006 18:48 <DIR> Grisoft
01/04/2006 22:22 <DIR> INSTAL~1 InstallShield
17/05/2006 17:17 <DIR> INTERV~1 InterVideo
25/01/2007 00:57 <DIR> Ipswitch
25/03/2006 01:36 <DIR> MACROM~1 Macromedia
26/06/2006 01:02 <DIR> MESSEN~1 Messenger Plus!
04/08/2006 12:32 <DIR> MICROS~1 Microsoft
04/03/2007 01:23 <DIR> NFSUND~1 NFS Underground
19/11/2006 13:32 <DIR> NVIDIA
09/04/2007 02:32 <DIR> NVIEW_~1 nView_Profiles
11/05/2006 14:50 <DIR> Pinnacle
18/03/2007 03:54 <DIR> RS-95-~1 rs-95-46-2p-55-55
23/07/2006 10:09 <DIR> SMARTS~1 SmartSound Software Inc
25/02/2007 13:05 <DIR> SOFTDI~1 Softdisk LLC
27/07/2006 21:38 <DIR> Sony
27/04/2007 01:17 <DIR> SPYBOT~1 Spybot - Search & Destroy
25/03/2006 00:13 <DIR> TECHSM~1 TechSmith
27/04/2007 05:37 <DIR> TEMP
10/03/2007 03:23 <DIR> Trymedia
13/08/2006 19:15 <DIR> ULEADS~1 Ulead Systems
22/07/2006 11:23 <DIR> WINDOW~1 Windows Genuine Advantage
09/04/2006 17:11 <DIR> {FBDA5~1 {FBDA53F5-763E-4114-A576-612E9769C133}
0 bestand(en) 0 bytes
33 map(pen) 8.981.118.976 bytes beschikbaar
--------------------------------------------------------

Jurgenv1 · 27 apr 2007

Ziet er goed uit, hoe werkt alles verder?

jakke25 · 27 apr 2007

voor de rest werkt alles prima, alleen als ik aan het gamen ben heb ik fps drops, en ik heb gemerkt dat ik het alleen maar heb, als men cpu gebruik boven de 70% komt, maar ik heb hier vroeger nooit last van gehad, en soms detecteerd hij men dvd writer ook niet

Jurgenv1 · 27 apr 2007

* Open Kladblok.
Kopieer de onderstaande vetgedrukte tekst en plak deze in een nieuw document.

Code:

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f2cd62f9.exe]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Live Inside Dog Proc]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\liesenc]

Kies Bestand -> Opslaan
Selecteer bij "Opslaan in": Bureaublad
Vul bij "Bestandsnaam" in: fix.reg
Selecteer bij "Opslaan als type": Alle bestanden
Klik op "Opslaan".

Dubbelklik op fix.reg, dat nu op je bureaublad staat.
Ga ermee akkoord dat deze gegevens aan het register worden toegevoegd.

* Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

C:\Documents and Settings\jens mondelaers\Local Settings\Application Data\f2cd62f9.exe
C:\Documents and Settings\All Users\Application Data\Grim Ping Live Inside
C:\Documents and Settings\jens mondelaers\Application Data\Dent Rdr Dead

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje.

jakke25 · 28 apr 2007

movitlogje:

File/Folder C:\Documents and Settings\jens mondelaers\Local Settings\Application Data\f2cd62f9.exe not found.
C:\Documents and Settings\All Users\Application Data\Grim Ping Live Inside moved successfully.
C:\Documents and Settings\jens mondelaers\Application Data\Dent Rdr Dead moved successfully.

Created on 04/28/2007 11:14:18

nieuw hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:15:46, on 28/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijack This\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.Begin2Search.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {0DCB5330-646A-4D44-9938-FC72068960B6} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {60C152C2-F58E-EFF5-E463-E057D2404CA7} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Systeemvak van ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {556EEC63-31E2-47C3-BF29-DFF799D2FE04} (Remote Access ActiveX Client) - https://secure.logmein.com/activex/RACtrl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mijnalbum.nl/skin/system/upload/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: ddabx - C:\WINDOWS\system32\ddabx.dll (file missing)
O20 - Winlogon Notify: LMIinit - LMIinit.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Jurgenv1 · 28 apr 2007

* Open hijackthis en vink volgende regels aan:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.Begin2Search.com/search.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {0DCB5330-646A-4D44-9938-FC72068960B6} - (no file)
O2 - BHO: (no name) - {60C152C2-F58E-EFF5-E463-E057D2404CA7} - (no file)
O20 - Winlogon Notify: ddabx - C:\WINDOWS\system32\ddabx.dll (file missing)
O20 - Winlogon Notify: LMIinit - LMIinit.dll (file missing)

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Herstart dan je pc en vertel hoe alles verder werkt.

jakke25 · 28 apr 2007

ok, heb het gedaan, hij detecteerd men dvd drive nimeer, nu eens proberen of ik nog fps drops heb, voor de rest werkt alles prima

jakke25 · 28 apr 2007

heb net proberen te gamen, maar heb nog steeds fps drops

Jurgenv1 · 28 apr 2007

Kan je anders nog eens een nieuw logje van combofix posten?

jakke25 · 28 apr 2007

ok, moet ik mss ook eens een logje posten, van als ik aan het gamen ben ofzo, dan kan je mss zien of er iets bijstaat dat veel cpu gebruikt?

hier is een nieuw combofix logje:

"jens mondelaers" - 07-04-28 13:15:46 Service Pack 2
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\jens mondelaers\Bureaublad\"

((((((((((((((((((((((((((((((( Files Created from 2007-03-28 to 2007-04-28 ))))))))))))))))))))))))))))))))))

2007-04-27 18:45 <DIR> d-------- C:\deljob
2007-04-26 21:19 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-04-26 18:04 <DIR> d-------- C:\VundoFix Backups
2007-04-25 22:24 <DIR> d-------- C:\Program Files\Hijack This
2007-04-25 17:03 51,072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-04-25 17:03 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys
2007-04-25 17:03 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-04-25 17:03 <DIR> d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\PC Tools
2007-04-25 17:01 78,336 --a------ C:\WINDOWS\system32\drivers\ssi.sys
2007-04-25 17:01 102,912 --a------ C:\WINDOWS\system32\islzma.dll
2007-04-25 17:01 <DIR> d-------- C:\Program Files\Webroot
2007-04-25 17:01 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-04-25 17:01 <DIR> d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\Webroot
2007-04-25 17:00 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-04-25 17:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-04-25 06:13 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2007-04-21 13:44 <DIR> d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\My Battle for Middle-earth(tm) II Files
2007-04-20 20:05 <DIR> d-------- C:\Program Files\SiSoftware
2007-04-16 00:12 <DIR> d-------- C:\shr
2007-04-15 23:40 <DIR> d-------- C:\Program Files\RegCleaner
2007-04-15 22:12 <DIR> d-------- C:\Program Files\Hitman Pro
2007-04-14 21:06 <DIR> d-------- C:\WINDOWS\.mpr_file_store_32
2007-04-14 21:04 <DIR> d-------- C:\Program Files\MoparScape
2007-04-13 16:31 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-13 00:19 <DIR> d-------- C:\Alien Arena 2007
2007-04-11 00:11 620,544 --a------ C:\WINDOWS\system32\stlpmt45.dll
2007-04-11 00:11 1,497,088 --a------ C:\WINDOWS\system32\cc3260mt.dll
2007-04-11 00:11 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2007-04-11 00:11 <DIR> d-------- C:\Program Files\AVSMedia
2007-04-11 00:08 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-04-11 00:03 <DIR> d-------- C:\Program Files\MP3 WAV Converter
2007-04-10 22:30 <DIR> d-------- C:\dolwin9
2007-04-09 15:10 <DIR> d-------- C:\Program Files\Dolphin
2007-04-09 14:56 <DIR> d-------- C:\roms
2007-04-09 14:35 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-04-09 14:35 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll
2007-04-09 14:35 <DIR> d-------- C:\Program Files\OpenAL
2007-04-09 14:32 <DIR> d-------- C:\Program Files\Bohemia Interactive
2007-04-09 02:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-04-09 02:29 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-04-09 02:29 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-04-09 02:29 <DIR> d-------- C:\WINDOWS\nview
2007-04-08 02:06 <DIR> d-------- C:\Program Files\NVTray
2007-04-03 22:33 <DIR> d-------- C:\Program Files\Audacity 1.3 Beta (Unicode)
2007-04-03 22:33 <DIR> d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\Audacity
2007-04-03 22:30 <DIR> d-------- C:\Program Files\1stbenison
2007-04-01 22:31 <DIR> d-------- C:\Program Files\DMW Scanner 3
2007-03-29 22:14 <DIR> d-------- C:\Program Files\AV Vcs 4.0 DIAMOND
2007-03-28 13:56 <DIR> d-------- C:\Program Files\Common Files\EasyInfo

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-26 03:53 -------- d-------- C:\Program Files\logmein
2007-04-26 03:53 -------- d-------- C:\Program Files\daemon tools
2007-04-25 16:29 -------- d-------- C:\Program Files\mirc
2007-04-24 18:37 -------- d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\teamspeak2
2007-04-18 20:21 -------- d-------- C:\Program Files\electronic arts
2007-04-15 20:06 37608 --a------ C:\WINDOWS\system32\gdipfontcachev1.dat
2007-04-13 00:19 -------- d--h----- C:\Program Files\installshield installation information
2007-04-11 22:30 527 --a------ C:\DOCUME~1\JENSMO~1\APPLIC~1\gangsters2setup.lnk
2007-04-09 17:55 40 --a------ C:\WINDOWS\rsoftinfo.dat
2007-04-09 17:34 -------- d-------- C:\Program Files\monopoly here & now edition
2007-04-09 14:41 108144 --a------ C:\WINDOWS\system32\cmdlineext.dll
2007-04-08 21:30 -------- d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\xfire
2007-04-08 20:13 -------- d---s---- C:\Program Files\xfire
2007-04-08 18:55 -------- d-------- C:\Program Files\trackmania nations eswc
2007-04-08 18:47 -------- d-------- C:\Program Files\world of warcraft
2007-04-06 01:18 -------- d-------- C:\DOCUME~1\JENSMO~1\APPLIC~1\limewire
2007-04-05 12:31 -------- d-------- C:\Program Files\teamspeak2server
2007-04-03 10:03 -------- d-------- C:\Program Files\the all-seeing eye
2007-03-28 20:43 515984 --a------ C:\WINDOWS\system32\perfh013.dat
2007-03-28 20:43 103698 --a------ C:\WINDOWS\system32\perfc013.dat
2007-03-24 22:52 -------- d-------- C:\Program Files\teamspeak2_rc2
2007-03-17 22:20 -------- d-------- C:\Program Files\n-ball
2007-03-11 20:46 -------- d-------- C:\Program Files\tvtool
2007-03-11 15:31 -------- d-------- C:\Program Files\iulab
2007-03-11 15:12 -------- d-------- C:\Program Files\ea sports
2007-03-11 04:45 -------- d-------- C:\Program Files\alienguise
2007-03-10 23:19 -------- d-------- C:\Program Files\dmw client 3
2007-03-10 18:20 -------- d-------- C:\Program Files\limewire
2007-03-10 16:19 -------- d-------- C:\Program Files\togo game
2007-03-10 15:18 -------- d-------- C:\Program Files\xplosiv
2007-03-10 12:52 -------- d-------- C:\Program Files\hothouse creations
2007-03-10 03:20 -------- d-------- C:\Program Files\atari
2007-03-10 03:11 -------- d-------- C:\Program Files\gameshadow
2007-03-10 02:40 -------- d-------- C:\Program Files\evrsoft first page 2006
2007-03-08 17:39 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:39 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:39 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37 1843712 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-08 00:57 -------- d-------- C:\Program Files\wolfenstein - enemy territory
2007-03-07 15:23 -------- d-------- C:\Program Files\silkroad
2007-03-05 21:37 -------- d-------- C:\Program Files\Common Files\thraex software
2007-03-04 01:28 13566 --ahs---- C:\WINDOWS\system32\kgygaavl.sys
2007-03-04 01:25 56 -r-hs---- C:\WINDOWS\system32\7cfbf60cb6.sys
2007-03-04 01:25 -------- d-------- C:\Program Files\Common Files\enterbrain
2007-03-04 01:01 -------- d-------- C:\Program Files\ea games
2007-02-28 20:44 -------- d-------- C:\Program Files\Common Files\directx
2007-02-25 13:05 294912 --a------ C:\WINDOWS\katerine.scr
2007-02-20 17:11 583 --a------ C:\WINDOWS\ereg.dat

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar4.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"SmcService"="C:\\PROGRA~1\\Sygate\\SPF\\smc.exe -startgui"
"PrinTray"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\printray.exe"
"SoundMan"="SOUNDMAN.EXE"
"MMTray"="MMTray.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Spyware Doctor"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
"{50526033-0CC0-2067-0722-050828030020}"="\"c:\\program files\\hitman pro\\update.exe\" mc-110-12-0000272"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ http://beautifulstacyferguson.atspa...gusonWallpapers/StacyFergusonWallpaper006.jpg

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="MsgPlusLoader.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Adobe Reader Snelle start.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Snelle start.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Snelle start"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^F-Secure Anti-Virus 2006.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\F-Secure Anti-Virus 2006.lnk"
"backup"="C:\\WINDOWS\\pss\\F-Secure Anti-Virus 2006.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\F-SECU~1\\backweb\\4476822\\Program\\fspex.exe -startup"
"item"="F-Secure Anti-Virus 2006"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^InterVideo WinCinema Manager.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\InterVideo WinCinema Manager.lnk"
"backup"="C:\\WINDOWS\\pss\\InterVideo WinCinema Manager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\INTERV~1\\Common\\Bin\\WINCIN~1.EXE "
"item"="InterVideo WinCinema Manager"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^PCzapper Media Manager.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\PCzapper Media Manager.lnk"
"backup"="C:\\WINDOWS\\pss\\PCzapper Media Manager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\Program Files\\PCzapper\\MediaManager\\pbMediaCenter.exe "
"item"="PCzapper Media Manager"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^SnagIt 8.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\SnagIt 8.lnk"
"backup"="C:\\WINDOWS\\pss\\SnagIt 8.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\TECHSM~1\\SNAGIT~1\\SnagIt32.exe "
"item"="SnagIt 8"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^jens mondelaers^Menu Start^Programma's^Opstarten^Adobe Gamma.lnk]
"path"="C:\\Documents and Settings\\jens mondelaers\\Menu Start\\Programma's\\Opstarten\\Adobe Gamma.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^jens mondelaers^Menu Start^Programma's^Opstarten^Gangsters2Setup.lnk]
"path"="C:\\Documents and Settings\\jens mondelaers\\Menu Start\\Programma's\\Opstarten\\Gangsters2Setup.lnk"
"backup"="C:\\WINDOWS\\pss\\Gangsters2Setup.lnkStartup"
"location"="Startup"
"command"="C:\\Documents and Settings\\jens mondelaers\\Local Settings\\Application Data\\Microsoft\\CD Burning\\Applet.exe "
"item"="Gangsters2Setup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^jens mondelaers^Menu Start^Programma's^Opstarten^Xfire.lnk]
"path"="C:\\Documents and Settings\\jens mondelaers\\Menu Start\\Programma's\\Opstarten\\Xfire.lnk"
"backup"="C:\\WINDOWS\\pss\\Xfire.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\Xfire\\Xfire.exe "
"item"="Xfire"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="apdproxy"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="cli"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="atiptaxx"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ashDisp"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="FSM32"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\F-Secure Internet Security\\Common\\FSM32.EXE\" /splash"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Startup Wizard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="FSSW"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\F-Secure Internet Security\\FSGUI\\FSSW.EXE\" /reboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TNBUtil"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\F-Secure Internet Security\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="point32"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Microsoft IntelliPoint\\point32.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X84-X85 Button Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AcBtnMgr_X84-X85"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\LEXMAR~1\\AcBtnMgr_X84-X85.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X84-X85 Button Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ACMonitor_X84-X85"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\LEXMAR~1\\ACMonitor_X84-X85.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Logi_MwX"
"hkey"="HKLM"
"command"="Logi_MwX.Exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="LogMeInSystray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\LogMeIn\\LogMeInSystray.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsgPlus"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NVTray"
"hkey"="HKCU"
"command"="C:\\Program Files\\NVTray\\NVTray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Pando"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Pando Networks\\Pando\\Pando.exe\" /Minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhilipsDM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DeviceManager"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Philips\\Philips Device Manager\\Bin\\DeviceManager.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PSDrvCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\PSDrvCheck.exe -CheckReg"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCRemote]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Remoterm"
"hkey"="HKLM"
"command"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\Remote\\Remoterm.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PMC"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe\" -host -clearDebug"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PDVDServ"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleToolbarNotifier"
"hkey"="HKCU"
"command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TRIXX]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TRIXX"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\TRIXX\\TRIXX.exe\" -s"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="uvPL"
"hkey"="HKLM"
"command"="C:\\Program Files\\Ulead Systems\\Ulead VideoStudio 10\\uvPL.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="C:\\Program Files\\Winamp\\winampa.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinDVR SchSvr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SchSvr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\InterVideo\\SchSvr\\SchSvr.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E]
Shell\AutoRun\command E:\setup\rsrc\Autorun.exe
Shell\dinstall\command E:\Directx\dxsetup.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2e02403f-f6ff-11da-95d7-00508d7e8936}]
Shell\AutoRun\command H:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{743fe0b9-b90e-11da-9325-806d6172696f}]
Shell\AutoRun\command E:\setup\rsrc\Autorun.exe
Shell\dinstall\command E:\Directx\dxsetup.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5579e28-ce8f-11db-a78b-806d6172696f}]
Shell\AutoRun\command E:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4d222be-b9ad-11da-9570-00508d7e8936}]
Shell\AutoRun\command F:\OblivionLauncher.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fbdaaa4a-06a5-11db-95e7-00508d7e8936}]
Shell\AutoRun\command I:\AutoRun.exe

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-28 13:20:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-28 13:20:28
C:\ComboFix-quarantined-files.txt ... 07-04-28 13:20
C:\ComboFix2.txt ... 07-04-26 23:57
C:\ComboFix3.txt ... 07-04-26 21:19

Jurgenv1 · 28 apr 2007

Ziet er goed uit, ik stel voor dat je een topic start in het software forum.

Archief - kan er iemand eens naar dit kijken

jakke25

Legacy Member

Jurgenv1

Legacy Member

jakke25

Legacy Member

Jurgenv1

Legacy Member

jakke25

Legacy Member

Jurgenv1

Legacy Member

jakke25

Legacy Member

jakke25

Legacy Member

Jurgenv1

Legacy Member

jakke25

Legacy Member

Jurgenv1

Legacy Member

jakke25

Legacy Member

Jurgenv1

Legacy Member

jakke25

Legacy Member

Jurgenv1

Legacy Member

jakke25

Legacy Member

jakke25

Legacy Member

Jurgenv1

Legacy Member

jakke25

Legacy Member

Jurgenv1

Legacy Member