Archief - Logje

Logfile of HijackThis v1.99.1
Scan saved at 22:29:24, on 21-9-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Sm9uYXM\command.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\Winamp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Grisoft\AVG7\avgvv.exe
C:\Documents and Settings\Jonas\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [explorer] C:\Program Files\MSN Messenger\Xinstall.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\gpr0l39m1.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Sm9uYXM\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

alvast bedankt (kut msn trojan)

Msn zelf is besmet met een worm, dus we zullen msn moeten de-installeren tijdens het cleanen, anders zal hij gewoon de infectie terugzetten, dus eerste stap:
MSN de-installeren! Als je dit niet doet kunnen we niet verder...

Daarna herstart je je pc en doe je het volgende:

1. Download dit bestand: - combofix.exe
2. Dubbelklik op combofix.exe en volg de instructies die je krijgt.
3. Wanneer het tooltje klaar is zal het een rapport maken voor je, post die log hier met een nieuw hijackthis logje.

Note:
Niet klikken terwijl combofix bezig is, dat zou het tooltje doen vastlopen!

http://users.pandora.be/-Shifty/ComboFix.txt

het logje bevatte teveel characters ^^

HJT:

Logfile of HijackThis v1.99.1
Scan saved at 17:30:09, on 22-9-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\SmartFTP Client 2.0\SmartFTP.exe
C:\WINDOWS\system32\NOTEPAD.EXE
G:\Applications\Anti Spyware tools\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

* Download en installeer Ewido Anti-Spyware 4.0.

• 
  Na de installatie, open Ewido Anti-Spyware 4.0:
  * onder "Status", klik op Change state naast "Resident shield".
  * onder "Update", klik op de Start update knop.
  * onder "Scanner", tab "Settings":
  • - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine.
    - onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
  Sluit Ewido. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm

* Start je computer op in VEILIGE MODUS

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

• open ewido en klik op de Scanner tab bovenaan en klik dan op Complete System Scan. Deze scan zal heel je systeem afcannen dus dit kan een tijdje duren
• Ewido zal alle geïnfecteerde objecten aan de linkerkant tonen. Waneer de scan gedaan is, zal het alles naar de 'Quarantine' optie zetten. klik dan op de Apply all actions knop. Ewido zal dan het volgend bericht tonen aan de rechterkant: "All actions have been applied"
• Klik dan op "Save Report", en dan op "Save Report As". dit zal een rapport maken Wees zeker dat je het rapport makkelijk kunt terugvinden (ijvoorbeeld op je bureaublad).

* Herstart je computer in normale modus.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Post dan een nieuw hijackthis logje hier met het rapport van ewido.

Srry voor de late reply nogal druk met school

Logfile of HijackThis v1.99.1
Scan saved at 14:33:54, on 24-9-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
G:\Applications\Anti Spyware tools\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

en hier het ewido logje

* fix de volgende regels in hijackthis:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

Er staat telkens 'no action taken' Ben je zeker dat je alles verwijderd hebt met ewido?

Ik was ze vergeten deleten in de quarantine, nu is het wel gebeurd.
Dikke merci voor de hulp

Mag ik dan een nieuw hijackthis logje zien met een nieuw rapport van combofix?

Logfile of HijackThis v1.99.1
Scan saved at 16:39:03, on 25-9-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Jonas\Bureaublad\HijackThis.exe

O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


en combofix:

Jonas - 06-09-25 16:40:05,73 Service Pack 2
ComboFix 06.09.21 - Running from: "G:\Applications\Anti Spyware tools"

((((((((((((((((((((((((((((((( Files Created from 2006-08-25 to 2006-09-25 ))))))))))))))))))))))))))))))))))


2006-09-24 16:21 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-09-23 18:36 54,272 --a------ C:\WINDOWS\system32\DrvTrNTm.dll
2006-09-23 18:36 106,496 --a------ C:\WINDOWS\system32\DrvTrNTl.dll
2006-09-21 22:40 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-21 22:40 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe
2006-09-21 22:40 175,616 --a------ C:\WINDOWS\system32\strings.exe
2006-09-21 22:40 16,384 --a------ C:\WINDOWS\system32\restart.exe
2006-09-21 22:40 126,976 --a------ C:\WINDOWS\system32\zip.exe
2006-09-21 22:40 11,254 --a------ C:\WINDOWS\system32\locate.com
2006-09-21 19:13 138,862 --a------ C:\WINDOWS\system32\alfa.exe
2006-09-21 19:09 138,862 --a------ C:\WINDOWS\alfa.exe
2006-09-17 18:21 86,016 --a------ C:\WINDOWS\system32\dpl100.dll
2006-09-17 18:21 761,856 --a------ C:\WINDOWS\system32\xvidcore.dll
2006-09-17 18:21 630,784 --a------ C:\WINDOWS\system32\vp7vfw.dll
2006-09-17 18:21 6,144 --a------ C:\WINDOWS\system32\ff_vfw.dll
2006-09-17 18:21 593,920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2006-09-17 18:21 574,976 --a------ C:\WINDOWS\system32\divx.dll
2006-09-17 18:21 57,344 --a------ C:\WINDOWS\system32\dpv11.dll
2006-09-17 18:21 457,234 --a------ C:\WINDOWS\system32\x264vfw.dll
2006-09-17 18:21 446,464 --a------ C:\WINDOWS\system32\vp31vfw.dll
2006-09-17 18:21 438,272 --a------ C:\WINDOWS\system32\vp6vfw.dll
2006-09-17 18:21 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2006-09-17 18:21 339,968 --a------ C:\WINDOWS\system32\dpus11.dll
2006-09-17 18:21 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2006-09-17 18:21 294,912 --a------ C:\WINDOWS\system32\dpu11.dll
2006-09-17 18:21 286,720 --a------ C:\WINDOWS\system32\3ivxVfWCodec.dll
2006-09-17 18:21 245,408 --a------ C:\WINDOWS\system32\unicows.dll
2006-09-17 18:21 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2006-09-17 18:21 200,704 --a------ C:\WINDOWS\system32\dtu100.dll
2006-09-17 18:21 19,968 --a------ C:\WINDOWS\system32\cpuinf32.dll
2006-09-17 18:21 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2006-09-17 18:21 157,696 --a------ C:\WINDOWS\system32\unrar.dll
2006-09-17 18:21 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2006-09-17 18:21 1,024,000 --a------ C:\WINDOWS\system32\3ivx.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-25 16:35 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-25 16:12 -------- d-------- C:\Documents and Settings\Jonas\Application Data\AVG7
2006-09-24 22:23 -------- d-------- C:\Program Files\Mozilla Thunderbird
2006-09-24 12:28 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-23 20:28 -------- d-------- C:\Program Files\Guild Wars
2006-09-23 20:18 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Adobe
2006-09-23 20:12 -------- d-------- C:\Program Files\Adobe
2006-09-23 18:38 -------- d-------- C:\Program Files\HighCriteria
2006-09-23 14:51 -------- d-------- C:\Program Files\mIRC
2006-09-23 13:21 -------- d-------- C:\Program Files\Guitar Pro 5
2006-09-22 17:37 -------- d-------- C:\Program Files\MSN Messenger
2006-09-22 17:30 -------- d-------- C:\Program Files\SmartFTP Client 2.0
2006-09-22 17:23 -------- d-------- C:\Program Files\Common Files
2006-09-21 21:15 778656 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-09-21 21:13 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2006-09-21 21:13 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-09-21 21:13 28416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-09-21 21:13 23296 --a------ C:\WINDOWS\system32\drivers\avgmfrs.sys
2006-09-21 21:13 -------- d-------- C:\Program Files\Grisoft
2006-09-21 21:12 -------- d---s---- C:\Documents and Settings\Jonas\Application Data\Microsoft
2006-09-21 20:49 -------- d-------- C:\Program Files\BHODemon 2
2006-09-21 20:29 -------- d-------- C:\Program Files\Motherboard Monitor 5
2006-09-21 20:29 -------- d-------- C:\Program Files\Messenger
2006-09-21 20:29 -------- d-------- C:\Program Files\Internet Explorer
2006-09-21 20:00 554139 --a------ C:\Documents and Settings\Jonas\Application Data\Dxcknwrd.dll
2006-09-21 19:56 -------- d-------- C:\Program Files\PrintView
2006-09-20 21:15 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-20 21:15 -------- d-------- C:\Program Files\Google
2006-09-20 21:14 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-09-20 15:48 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Real
2006-09-17 18:22 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Media Player Classic
2006-09-17 18:21 -------- d-------- C:\Program Files\K-Lite Codec Pack
2006-09-17 18:21 -------- d-------- C:\Documents and Settings\Jonas\Application Data\bsplayer
2006-09-16 13:11 -------- d-------- C:\Program Files\Java
2006-09-16 13:10 -------- d-------- C:\Program Files\Common Files\Java
2006-09-14 19:38 -------- d-------- C:\Program Files\WinRAR
2006-09-14 19:17 -------- d-------- C:\Program Files\ATI Technologies
2006-09-10 19:43 -------- d-------- C:\Documents and Settings\Jonas\Application Data\AdobeUM
2006-09-10 16:34 -------- d-------- C:\Documents and Settings\Jonas\Application Data\dvdcss
2006-09-07 20:16 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-06 21:31 -------- d-------- C:\Program Files\Windows Journal Viewer
2006-09-06 21:31 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-09-01 13:59 -------- d-------- C:\Program Files\LimeWire
2006-08-30 22:02 -------- d-------- C:\Program Files\Call of Duty
2006-08-21 14:28 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 11:14 128896 --------- C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-16 18:59 -------- d-------- C:\Program Files\DC++
2006-08-15 20:10 -------- d-------- C:\Program Files\Activision
2006-08-13 19:16 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-08-12 14:31 -------- d-------- C:\Program Files\GIMP-2.0
2006-08-12 14:30 -------- d-------- C:\Program Files\Common Files\GTK
2006-08-10 21:02 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Sun
2006-08-10 18:20 -------- d-------- C:\Documents and Settings\Jonas\Application Data\teamspeak2
2006-08-08 20:30 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Ventrilo
2006-08-08 20:28 -------- d-------- C:\Program Files\VentriloMIX
2006-08-05 21:21 -------- d-------- C:\Program Files\FLVPlayer
2006-08-05 20:25 -------- d-------- C:\Documents and Settings\Jonas\Application Data\IrfanView
2006-08-05 18:36 -------- d-------- C:\Program Files\IrfanView
2006-08-03 00:12 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-08-03 00:08 258048 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-08-03 00:07 1681920 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys
2006-08-03 00:02 86016 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-08-03 00:02 77824 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-08-03 00:02 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-08-03 00:02 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-08-03 00:02 114688 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-08-03 00:01 401408 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-08-03 00:00 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-08-02 23:55 2373088 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-08-02 23:51 2354720 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-08-02 23:49 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-08-02 23:45 5136384 --a------ C:\WINDOWS\system32\atioglxx.dll
2006-08-02 23:41 208896 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-08-02 23:40 303104 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-08-02 23:40 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-08-02 23:35 286720 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-08-02 20:20 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2006-08-02 17:46 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Macromedia
2006-08-02 17:27 520192 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-08-01 19:34 -------- d-------- C:\Documents and Settings\Jonas\Application Data\SmartFTP
2006-08-01 19:33 -------- d-------- C:\Program Files\SmartFTP Client 2.0 Setup Files
2006-08-01 18:26 -------- d-------- C:\Program Files\Windows Media Player
2006-07-31 20:11 -------- d-------- C:\Program Files\QuickTime
2006-07-31 20:10 -------- d-------- C:\Program Files\iTunes
2006-07-31 20:04 -------- d-------- C:\Program Files\iPod
2006-07-31 19:49 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-07-31 19:49 -------- d-------- C:\Program Files\Common Files\System
2006-07-31 19:49 -------- d-------- C:\Program Files\Common Files\Designer
2006-07-30 19:04 -------- d-------- C:\Program Files\PCFriendly
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-29 14:44 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Apple Computer
2006-07-27 15:26 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-26 16:10 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Lavasoft
2006-07-26 12:52 -------- d-------- C:\Program Files\Logitech
2006-07-26 12:52 -------- d-------- C:\Program Files\Common Files\Logitech
2006-07-26 12:49 -------- d-------- C:\Program Files\The All-Seeing Eye
2006-07-26 11:34 -------- d-------- C:\Program Files\Kaspersky Lab
2006-07-25 14:08 -------- d-------- C:\Program Files\Microsoft Office
2006-07-23 19:37 62 --ahs---- C:\Documents and Settings\Jonas\Application Data\desktop.ini
2006-07-23 17:47 0 -rahs---- C:\MSDOS.SYS
2006-07-23 17:47 0 -rahs---- C:\IO.SYS
2006-07-23 17:47 0 --a------ C:\CONFIG.SYS
2006-07-23 17:47 0 --a------ C:\AUTOEXEC.BAT
2006-07-21 10:29 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MBM 5"="\"C:\\Program Files\\Motherboard Monitor 5\\MBM5.EXE\""
"EM_EXEC"="C:\\PROGRA~1\\Logitech\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Gamma Loader.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Adobe Gamma Loader.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma Loader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^HP Digital Imaging Monitor.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\HP Digital Imaging Monitor.lnk"
"backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe "
"item"="HP Digital Imaging Monitor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^MediaKey.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\MediaKey.lnk"
"backup"="C:\\WINDOWS\\pss\\MediaKey.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\Program Files\\MediaKey\\Versato.exe "
"item"="MediaKey"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Microsoft Office.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Microsoft Office.lnk"
"backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l"
"item"="Microsoft Office"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Jonas^Menu Start^Programma's^Opstarten^Adobe Gamma.lnk]
"path"="C:\\Documents and Settings\\Jonas\\Menu Start\\Programma's\\Opstarten\\Adobe Gamma.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Jonas^Menu Start^Programma's^Opstarten^BHODemon 2.0.lnk]
"path"="C:\\Documents and Settings\\Jonas\\Menu Start\\Programma's\\Opstarten\\BHODemon 2.0.lnk"
"backup"="C:\\WINDOWS\\pss\\BHODemon 2.0.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\BHODEM~1\\BHODemon.exe "
"item"="BHODemon 2.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Adobe Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="apdproxy"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATICCC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CLIStart"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATIPTA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="atiptaxx"
"hkey"="HKLM"
"command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\CTFMON.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\defender]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dfndrff_e10"
"hkey"="HKLM"
"command"="c:\\\\dfndrff_e10.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\DeluxeCommunications]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Dxc"
"hkey"="HKLM"
"command"="C:\\Program Files\\DeluxeCommunications\\Dxc.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\keyboard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="kybrdff_e10"
"hkey"="HKLM"
"command"="c:\\\\kybrdff_e10.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\msnmsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\newname]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwnmff_e10"
"hkey"="HKLM"
"command"="c:\\\\nwnmff_e10.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\TotalRecorderScheduler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TotRecSched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HighCriteria\\TotalRecorder\\TotRecSched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Windows Defender]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MSASCui"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\zango]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zango"
"hkey"="HKLM"
"command"="\"c:\\program files\\zango\\zango.exe\""
"inimapping"="0"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: Mon 25-09-2006 16:41:35.15
ComboFix.txt

Kan je ewido nog eens runnen in veilige modus en eerst alles in quarantaine plaatsen en dan pas een log bewaren en die hier posten met een nieuw logje van combofix?

Dat zal dan voor morgen zijn, of laat deze avond. Schoolwerk

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 22:24:40 25-9-2006

+ Scan result:



:mozilla.49:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.50:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.56:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.57:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.59:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
:mozilla.160:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.161:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.183:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.184:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.185:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.186:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.187:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.180:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.6:C:\Documents and Settings\Jelle1\Application Data\Mozilla\Firefox\Profiles\8j4vfh1y.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\Jonas\Cookies\jonas@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.156:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
C:\Documents and Settings\Jonas\Cookies\jonas@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
:mozilla.104:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
:mozilla.16:C:\Documents and Settings\Linda1\Application Data\Mozilla\Firefox\Profiles\27d6b2os.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
:mozilla.208:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.209:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.210:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.211:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.152:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.153:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.154:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.172:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.173:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.174:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.175:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.176:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.82:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.83:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.84:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.13:C:\Documents and Settings\Linda1\Application Data\Mozilla\Firefox\Profiles\27d6b2os.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.14:C:\Documents and Settings\Linda1\Application Data\Mozilla\Firefox\Profiles\27d6b2os.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.15:C:\Documents and Settings\Linda1\Application Data\Mozilla\Firefox\Profiles\27d6b2os.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.194:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.65:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.66:C:\Documents and Settings\Jonas\Application Data\Mozilla\Firefox\Profiles\g06dr549.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).


::Report end


--------------------------------------------------------------------------
Jonas - 06-09-25 20:49:18,50 Service Pack 2
ComboFix 06.09.21 - Running from: "G:\Applications\Anti Spyware tools"

((((((((((((((((((((((((((((((( Files Created from 2006-08-25 to 2006-09-25 ))))))))))))))))))))))))))))))))))


2006-09-24 16:21 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2006-09-23 18:36 54,272 --a------ C:\WINDOWS\system32\DrvTrNTm.dll
2006-09-23 18:36 106,496 --a------ C:\WINDOWS\system32\DrvTrNTl.dll
2006-09-21 22:40 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-09-21 22:40 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe
2006-09-21 22:40 175,616 --a------ C:\WINDOWS\system32\strings.exe
2006-09-21 22:40 16,384 --a------ C:\WINDOWS\system32\restart.exe
2006-09-21 22:40 126,976 --a------ C:\WINDOWS\system32\zip.exe
2006-09-21 22:40 11,254 --a------ C:\WINDOWS\system32\locate.com
2006-09-21 19:13 138,862 --a------ C:\WINDOWS\system32\alfa.exe
2006-09-21 19:09 138,862 --a------ C:\WINDOWS\alfa.exe
2006-09-17 18:21 86,016 --a------ C:\WINDOWS\system32\dpl100.dll
2006-09-17 18:21 761,856 --a------ C:\WINDOWS\system32\xvidcore.dll
2006-09-17 18:21 630,784 --a------ C:\WINDOWS\system32\vp7vfw.dll
2006-09-17 18:21 6,144 --a------ C:\WINDOWS\system32\ff_vfw.dll
2006-09-17 18:21 593,920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2006-09-17 18:21 574,976 --a------ C:\WINDOWS\system32\divx.dll
2006-09-17 18:21 57,344 --a------ C:\WINDOWS\system32\dpv11.dll
2006-09-17 18:21 457,234 --a------ C:\WINDOWS\system32\x264vfw.dll
2006-09-17 18:21 446,464 --a------ C:\WINDOWS\system32\vp31vfw.dll
2006-09-17 18:21 438,272 --a------ C:\WINDOWS\system32\vp6vfw.dll
2006-09-17 18:21 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2006-09-17 18:21 339,968 --a------ C:\WINDOWS\system32\dpus11.dll
2006-09-17 18:21 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2006-09-17 18:21 294,912 --a------ C:\WINDOWS\system32\dpu11.dll
2006-09-17 18:21 286,720 --a------ C:\WINDOWS\system32\3ivxVfWCodec.dll
2006-09-17 18:21 245,408 --a------ C:\WINDOWS\system32\unicows.dll
2006-09-17 18:21 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2006-09-17 18:21 200,704 --a------ C:\WINDOWS\system32\dtu100.dll
2006-09-17 18:21 19,968 --a------ C:\WINDOWS\system32\cpuinf32.dll
2006-09-17 18:21 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2006-09-17 18:21 157,696 --a------ C:\WINDOWS\system32\unrar.dll
2006-09-17 18:21 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2006-09-17 18:21 1,024,000 --a------ C:\WINDOWS\system32\3ivx.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-25 20:14 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Adobe
2006-09-25 20:00 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-25 19:42 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-25 19:42 -------- d-------- C:\Program Files\Adobe
2006-09-25 19:16 -------- d-------- C:\Program Files\Mozilla Thunderbird
2006-09-25 16:12 -------- d-------- C:\Documents and Settings\Jonas\Application Data\AVG7
2006-09-24 12:28 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-09-23 20:28 -------- d-------- C:\Program Files\Guild Wars
2006-09-23 18:38 -------- d-------- C:\Program Files\HighCriteria
2006-09-23 14:51 -------- d-------- C:\Program Files\mIRC
2006-09-23 13:21 -------- d-------- C:\Program Files\Guitar Pro 5
2006-09-22 17:37 -------- d-------- C:\Program Files\MSN Messenger
2006-09-22 17:30 -------- d-------- C:\Program Files\SmartFTP Client 2.0
2006-09-22 17:23 -------- d-------- C:\Program Files\Common Files
2006-09-21 21:15 778656 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-09-21 21:13 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2006-09-21 21:13 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-09-21 21:13 28416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-09-21 21:13 23296 --a------ C:\WINDOWS\system32\drivers\avgmfrs.sys
2006-09-21 21:13 -------- d-------- C:\Program Files\Grisoft
2006-09-21 21:12 -------- d---s---- C:\Documents and Settings\Jonas\Application Data\Microsoft
2006-09-21 20:49 -------- d-------- C:\Program Files\BHODemon 2
2006-09-21 20:29 -------- d-------- C:\Program Files\Motherboard Monitor 5
2006-09-21 20:29 -------- d-------- C:\Program Files\Messenger
2006-09-21 20:29 -------- d-------- C:\Program Files\Internet Explorer
2006-09-21 20:00 554139 --a------ C:\Documents and Settings\Jonas\Application Data\Dxcknwrd.dll
2006-09-21 19:56 -------- d-------- C:\Program Files\PrintView
2006-09-20 21:15 -------- d-------- C:\Program Files\Google
2006-09-20 21:14 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-09-20 15:48 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Real
2006-09-17 18:22 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Media Player Classic
2006-09-17 18:21 -------- d-------- C:\Program Files\K-Lite Codec Pack
2006-09-17 18:21 -------- d-------- C:\Documents and Settings\Jonas\Application Data\bsplayer
2006-09-16 13:11 -------- d-------- C:\Program Files\Java
2006-09-16 13:10 -------- d-------- C:\Program Files\Common Files\Java
2006-09-14 19:38 -------- d-------- C:\Program Files\WinRAR
2006-09-14 19:17 -------- d-------- C:\Program Files\ATI Technologies
2006-09-10 19:43 -------- d-------- C:\Documents and Settings\Jonas\Application Data\AdobeUM
2006-09-10 16:34 -------- d-------- C:\Documents and Settings\Jonas\Application Data\dvdcss
2006-09-07 20:16 -------- d-------- C:\Program Files\Common Files\Adobe
2006-09-06 21:31 -------- d-------- C:\Program Files\Windows Journal Viewer
2006-09-06 21:31 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-09-01 13:59 -------- d-------- C:\Program Files\LimeWire
2006-08-30 22:02 -------- d-------- C:\Program Files\Call of Duty
2006-08-21 14:28 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 11:14 128896 --------- C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-16 18:59 -------- d-------- C:\Program Files\DC++
2006-08-15 20:10 -------- d-------- C:\Program Files\Activision
2006-08-13 19:16 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-08-12 14:31 -------- d-------- C:\Program Files\GIMP-2.0
2006-08-12 14:30 -------- d-------- C:\Program Files\Common Files\GTK
2006-08-10 21:02 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Sun
2006-08-10 18:20 -------- d-------- C:\Documents and Settings\Jonas\Application Data\teamspeak2
2006-08-08 20:30 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Ventrilo
2006-08-08 20:28 -------- d-------- C:\Program Files\VentriloMIX
2006-08-05 21:21 -------- d-------- C:\Program Files\FLVPlayer
2006-08-05 20:25 -------- d-------- C:\Documents and Settings\Jonas\Application Data\IrfanView
2006-08-05 18:36 -------- d-------- C:\Program Files\IrfanView
2006-08-03 00:12 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-08-03 00:08 258048 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-08-03 00:07 1681920 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys
2006-08-03 00:02 86016 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-08-03 00:02 77824 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-08-03 00:02 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-08-03 00:02 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-08-03 00:02 114688 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-08-03 00:01 401408 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-08-03 00:00 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-08-02 23:55 2373088 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-08-02 23:51 2354720 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-08-02 23:49 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-08-02 23:45 5136384 --a------ C:\WINDOWS\system32\atioglxx.dll
2006-08-02 23:41 208896 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-08-02 23:40 303104 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-08-02 23:40 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-08-02 23:35 286720 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-08-02 20:20 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2006-08-02 17:46 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Macromedia
2006-08-02 17:27 520192 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-08-01 19:34 -------- d-------- C:\Documents and Settings\Jonas\Application Data\SmartFTP
2006-08-01 19:33 -------- d-------- C:\Program Files\SmartFTP Client 2.0 Setup Files
2006-08-01 18:26 -------- d-------- C:\Program Files\Windows Media Player
2006-07-31 20:11 -------- d-------- C:\Program Files\QuickTime
2006-07-31 20:10 -------- d-------- C:\Program Files\iTunes
2006-07-31 20:04 -------- d-------- C:\Program Files\iPod
2006-07-31 19:49 -------- d-------- C:\Program Files\Microsoft ActiveSync
2006-07-31 19:49 -------- d-------- C:\Program Files\Common Files\System
2006-07-31 19:49 -------- d-------- C:\Program Files\Common Files\Designer
2006-07-30 19:04 -------- d-------- C:\Program Files\PCFriendly
2006-07-29 19:32 48936 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-07-29 14:44 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Apple Computer
2006-07-27 15:26 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-26 16:10 -------- d-------- C:\Documents and Settings\Jonas\Application Data\Lavasoft
2006-07-26 12:52 -------- d-------- C:\Program Files\Logitech
2006-07-26 12:52 -------- d-------- C:\Program Files\Common Files\Logitech
2006-07-26 12:49 -------- d-------- C:\Program Files\The All-Seeing Eye
2006-07-26 11:34 -------- d-------- C:\Program Files\Kaspersky Lab
2006-07-25 14:08 -------- d-------- C:\Program Files\Microsoft Office
2006-07-23 19:37 62 --ahs---- C:\Documents and Settings\Jonas\Application Data\desktop.ini
2006-07-23 17:47 0 -rahs---- C:\MSDOS.SYS
2006-07-23 17:47 0 -rahs---- C:\IO.SYS
2006-07-23 17:47 0 --a------ C:\CONFIG.SYS
2006-07-23 17:47 0 --a------ C:\AUTOEXEC.BAT
2006-07-21 10:29 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MBM 5"="\"C:\\Program Files\\Motherboard Monitor 5\\MBM5.EXE\""
"EM_EXEC"="C:\\PROGRA~1\\Logitech\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Gamma Loader.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Adobe Gamma Loader.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma Loader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^HP Digital Imaging Monitor.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\HP Digital Imaging Monitor.lnk"
"backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe "
"item"="HP Digital Imaging Monitor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^MediaKey.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\MediaKey.lnk"
"backup"="C:\\WINDOWS\\pss\\MediaKey.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\Program Files\\MediaKey\\Versato.exe "
"item"="MediaKey"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Microsoft Office.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Microsoft Office.lnk"
"backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l"
"item"="Microsoft Office"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Jonas^Menu Start^Programma's^Opstarten^Adobe Gamma.lnk]
"path"="C:\\Documents and Settings\\Jonas\\Menu Start\\Programma's\\Opstarten\\Adobe Gamma.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Gamma.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "
"item"="Adobe Gamma"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^Jonas^Menu Start^Programma's^Opstarten^BHODemon 2.0.lnk]
"path"="C:\\Documents and Settings\\Jonas\\Menu Start\\Programma's\\Opstarten\\BHODemon 2.0.lnk"
"backup"="C:\\WINDOWS\\pss\\BHODemon 2.0.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\BHODEM~1\\BHODemon.exe "
"item"="BHODemon 2.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Adobe Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="apdproxy"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATICCC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CLIStart"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATIPTA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="atiptaxx"
"hkey"="HKLM"
"command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\CTFMON.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\defender]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dfndrff_e10"
"hkey"="HKLM"
"command"="c:\\\\dfndrff_e10.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\DeluxeCommunications]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Dxc"
"hkey"="HKLM"
"command"="C:\\Program Files\\DeluxeCommunications\\Dxc.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\keyboard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="kybrdff_e10"
"hkey"="HKLM"
"command"="c:\\\\kybrdff_e10.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\msnmsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\newname]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwnmff_e10"
"hkey"="HKLM"
"command"="c:\\\\nwnmff_e10.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\TotalRecorderScheduler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TotRecSched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HighCriteria\\TotalRecorder\\TotRecSched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Windows Defender]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MSASCui"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\zango]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zango"
"hkey"="HKLM"
"command"="\"c:\\program files\\zango\\zango.exe\""
"inimapping"="0"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: Mon 25-09-2006 20:52:27.14
ComboFix.txt
ComboFix2.txt

* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
• Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
• Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
• Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
• Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
• Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
• Klik daarna de groene pijl rechts om de scan te starten.
• Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
• Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
  
• Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
  
  
  
  Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
• Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
• Sluit daarna Dr.Web Cureit.
• Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
• Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post met een nieuw hijackthis logje.

hij is nu aan het scannen maar hij geeft mIRC aan als spyware :|

Logfile of HijackThis v1.99.1
Scan saved at 19:22:16, on 26-9-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Jonas\Bureaublad\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

De log van DrWeb was 0 kb en kon niet geopend worden, maar alles was verwijderd, enkele dingen zitten in quarantaine

Kan je ewidop en ad-aware nog eens runnen in veilige modus en dan het rapport van ewido hier posten?