Archief - Logje

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
d

d.huyss

Legacy Member
De laatste 2 weken heb ik nogal last van wat probleempjes op deze computer: pop-ups die geopend worden, allerhande foutmeldingen (van internet explorer tot svchost).
Ik heb ondertussen een systeemhersel uitgevoerd, maar zonder succes. Ook heb ik online gescand op virussen, maar niets gevonden.
Misschien kunnen er boosdoeners gevonden worden in mijn Hijackthislogje? Alvast bedankt!

Logfile of HijackThis v1.99.1
Scan saved at 14:08, on 2008-08-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\1024\SVCHOST.EXE
C:\WINDOWS\system32\AFinding.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\system32\macidwe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system\proxy.exe
C:\WINDOWS\system32\Nobicyt.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\routing.exe
C:\WINDOWS\system32\roxtctm.exe
C:\WINDOWS\system32\sobicyt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\tdxdowkc.exe
C:\WINDOWS\system32\WServing.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\inf\svchoct.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\mmchost.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mmchost.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
J

Jurgenv1

Legacy Member
Post eens een nieuw hijackthis logje hier met de nieuwere versie van hijackthis.
d

d.huyss

Legacy Member
Oei, sorry.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:39, on 2008-08-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\AFinding.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\system32\macidwe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system\proxy.exe
C:\WINDOWS\system32\Nobicyt.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\routing.exe
C:\WINDOWS\system32\roxtctm.exe
C:\WINDOWS\system32\sobicyt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\tdxdowkc.exe
C:\WINDOWS\system32\WServing.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\inf\svchoct.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FAMTACE.EXE
C:\WINDOWS\system32\dwwin.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [minitnyus] C:\WINDOWS\system32\inf\svchosd.exe C:\WINDOWS\wftadfi16_080818a.dll tanlt88
O4 - HKLM\..\Policies\Explorer\Run: [mininyust] C:\WINDOWS\system32\inf\svchoct.exe C:\WINDOWS\wftadfi16_080825a.dll tanlt88
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\mmchost.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mmchost.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: afinding Service (afinding) - Unknown owner - C:\WINDOWS\system32\AFinding.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe (file missing)
O23 - Service: CA License Server (CA_LIC_SRVR) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Internet Service - Unknown owner - C:\WINDOWS\smss.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: macidwe Service (macidwe) - Unknown owner - C:\WINDOWS\system32\macidwe.exe
O23 - Service: IPSE Service (Messanger) - Unknown owner - c:\windows\svchost.exe
O23 - Service: MsService - Unknown owner - C:\WINDOWS\system\proxy.exe
O23 - Service: nobicyt Service (nobicyt) - Unknown owner - C:\WINDOWS\system32\Nobicyt.exe
O23 - Service: perfs Service (perfs) - Unknown owner - C:\WINDOWS\system32\perfs.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: routing Service (routing) - Unknown owner - C:\WINDOWS\system32\routing.exe
O23 - Service: roxtctm Corporation inc. (roxtctm) - Unknown owner - C:\WINDOWS\system32\roxtctm.exe
O23 - Service: sobicyt Service (sobicyt) - Unknown owner - C:\WINDOWS\system32\sobicyt.exe
O23 - Service: tdxdowkc Service (tdxdowkc) - Unknown owner - C:\WINDOWS\system32\tdxdowkc.exe
O23 - Service: wserving Service (wserving) - Unknown owner - C:\WINDOWS\system32\WServing.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 9828 bytes
J

Jurgenv1

Legacy Member
* Download en bewaar SDFix
op je bureaublad.

Dubbelklik op SDFix.exe en kies voor Install om het tooltje uit te pakken in een eigen map op je bureaubad. Herstart dan je pc in Veilige modus

  • In veilige modus, open de SDFix map op je bureaublad en dubbelklik op RunThis.bat om het tooltje te starten.
  • Typ Y om het clean proces te starten.
  • het verwijdert alle Trojan Services of Registry Entries die met deze infectie te maken hebben, als het tooltje klaar is zal het jou vertellen om eender welke toets te drukken om je pc te herstarten, doe dit ook.
  • Wanneer de pc herstart zal het tooltje opnieuw runnen en het opruimproces be�indigen en je de melding Finished tonen, druk dan op eender welke toets om het scriptje te be�indigen en je bureaublad zullen tevoorschijn komen.
  • Wanneer je bureaublad icoontjes verschijnen zal het rapportje van SDFix openen en ook in de map bewaren onder de naam Report.txt.
  • Kopieer en plak nu de inhoud van dat rapportje hier met een nieuw hijackthis logje.
d

d.huyss

Legacy Member
Bedankt Jurgenv1.

Logje van SDFix:
SDFix: Version 1.219
Run by Gebruiker on 2008-08-28 at 20:39

Microsoft Windows XP [versie 5.1.2600]
Running From: C:\Documents and Settings\Gebruiker\Bureaublad\SDFix

Checking Services :

Name :
afinding
macidwe
nobicyt
perfs
routing
Service
sobicyt
tdxdowkc
wserving

Path :
C:\WINDOWS\system32\AFinding.exe
C:\WINDOWS\system32\macidwe.exe
C:\WINDOWS\system32\Nobicyt.exe
C:\WINDOWS\system32\perfs.exe
C:\WINDOWS\system32\routing.exe
C:\WINDOWS\system32\svchost.exe -k SERVICE
C:\WINDOWS\system32\sobicyt.exe
C:\WINDOWS\system32\tdxdowkc.exe
C:\WINDOWS\system32\WServing.exe

afinding - Deleted
macidwe - Deleted
nobicyt - Deleted
perfs - Deleted
routing - Deleted
Service - Deleted
sobicyt - Deleted
tdxdowkc - Deleted
wserving - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\.exe - Deleted
C:\WINDOWS\svchost.exe - Deleted
C:\WINDOWS\system32\.exe - Deleted
C:\WINDOWS\system32\AFinding.exe - Deleted
C:\WINDOWS\system32\atsxyzd.sys - Deleted
C:\WINDOWS\system32\comsa32.sys - Deleted
C:\WINDOWS\system32\macidwe.exe - Deleted
C:\WINDOWS\system32\Nobicyt.exe - Deleted
C:\WINDOWS\system32\routing.exe - Deleted
C:\WINDOWS\system32\rtl60.bpl - Deleted
C:\WINDOWS\system32\sobicyt.exe - Deleted
C:\WINDOWS\system32\tdxdowkc.exe - Deleted
C:\WINDOWS\system32\WServing.exe - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 20:51:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.0"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
"C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE"="C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE:*:Enabled:SVCHOST.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\DOCUME~1\GEBRUI~1\BUREAU~1\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 17 Aug 2004 97,792 A..H. --- "C:\WINDOWS\system32\6to4ex.dll"
Thu 7 Sep 2006 5 A.SH. --- "C:\WINDOWS\system32\cedabcfeef_d.dll"
Mon 25 Aug 2008 15,360 A..H. --- "C:\WINDOWS\system32\dbi102.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna1Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna2Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\KarnaDrv.dll"
Sun 30 Jul 2006 205,918 ..SH. --- "C:\WINDOWS\system32\srqss.bak1"
Wed 27 Aug 2008 14,848 A..H. --- "C:\WINDOWS\system32\zordisa.dll"
Thu 5 May 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0001.tmp"
Sun 11 Feb 2007 25,088 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0002.tmp"
Sun 11 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0003.tmp"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0004.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0005.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0006.tmp"
Mon 28 Apr 2008 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0007.tmp"
Fri 16 May 2008 36,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0008.tmp"
Sun 18 May 2008 305,664 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0009.tmp"
Sun 8 Jun 2008 100,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0010.tmp"
Wed 11 Jun 2008 139,264 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0011.tmp"
Mon 28 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0012.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0019.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0050.tmp"
Sat 1 Jul 2006 1,275,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0081.tmp"
Sun 11 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0150.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0392.tmp"
Mon 19 Feb 2007 4,508,672 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0408.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0522.tmp"
Sat 17 May 2008 62,464 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0881.tmp"
Mon 30 Oct 2006 200,704 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0913.tmp"
Mon 19 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0955.tmp"
Wed 9 Mar 2005 77,312 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0990.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0993.tmp"
Sat 1 Jul 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1075.tmp"
Mon 9 Jun 2008 130,560 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1079.tmp"
Sat 1 Jul 2006 464,896 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1119.tmp"
Mon 9 Jun 2008 133,120 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1152.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1342.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1359.tmp"
Mon 19 Feb 2007 4,472,832 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1375.tmp"
Sun 11 Feb 2007 4,467,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1450.tmp"
Sun 11 Feb 2007 4,475,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1464.tmp"
Sat 1 Jul 2006 1,138,688 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1695.tmp"
Sun 24 Sep 2006 24,576 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1799.tmp"
Mon 5 Nov 2007 17,835 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1955.tmp"
Sun 8 Jun 2008 99,840 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1979.tmp"
Mon 17 Mar 2008 22,551 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2363.tmp"
Sun 11 Feb 2007 4,471,296 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2422.tmp"
Sat 1 Jul 2006 1,350,656 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2448.tmp"
Sun 4 Feb 2007 29,696 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2819.tmp"
Mon 29 Jan 2007 19,968 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2903.tmp"
Sun 11 Feb 2007 4,445,184 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3175.tmp"
Sun 29 May 2005 64,000 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3220.tmp"
Sat 1 Jul 2006 152,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3427.tmp"
Sat 1 Jul 2006 1,267,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3784.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3973.tmp"
Sat 24 Feb 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Mon 19 May 2008 53,760 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL1195.tmp"
Fri 30 Mar 2007 81,920 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL2597.tmp"
Thu 7 Sep 2006 96 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT1.tmp"
Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a282fd7b00204b775909f4664bd74484\BIT2.tmp"
Mon 2 Jul 2007 27,648 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0001.tmp"
Sun 8 Jun 2008 19,837 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0002.tmp"
Wed 17 Aug 2005 60,928 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0004.tmp"
Thu 24 Feb 2005 27,648 A..H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL1747.tmp"
Sat 7 May 2005 39,424 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL2602.tmp"
Sat 17 May 2008 38,954 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL3715.tmp"
Wed 25 May 2005 49,152 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0254.tmp"
Sat 7 May 2005 25,088 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0429.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0481.tmp"
Sun 10 Apr 2005 19,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0731.tmp"
Wed 1 Jun 2005 25,600 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0810.tmp"
Wed 1 Jun 2005 29,184 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0918.tmp"
Tue 31 May 2005 112,128 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1221.tmp"
Fri 28 Mar 2008 30,208 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1489.tmp"
Wed 1 Jun 2005 24,064 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1788.tmp"
Sun 29 May 2005 83,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2040.tmp"
Wed 1 Jun 2005 51,200 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2269.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2285.tmp"
Wed 1 Jun 2005 24,576 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2484.tmp"
Wed 1 Jun 2005 23,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2505.tmp"
Sat 28 May 2005 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2576.tmp"
Sat 28 May 2005 87,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2644.tmp"
Fri 28 Mar 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2969.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3447.tmp"
Wed 1 Jun 2005 26,624 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3565.tmp"
Wed 1 Jun 2005 20,992 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3600.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3655.tmp"
Thu 9 Jun 2005 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3690.tmp"
Thu 9 Jun 2005 43,008 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3810.tmp"
Thu 5 May 2005 4,348 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1key.bak"
Wed 23 Aug 2006 20 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1lic.bak"
Tue 4 Jul 2006 400 A.SH. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv2key.bak"

Finished!

Log van HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:04, on 2008-08-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\smss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system\proxy.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\DOCUME~1\GEBRUI~1\LOCALS~1\Temp\ffxi369.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\GEBRUI~1\LOCALS~1\Temp\dwbins.exe
C:\WINDOWS\system32\xdufytw.sys
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\mmchost.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mmchost.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: CA License Client (CA_LIC_CLNT) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe (file missing)
O23 - Service: CA License Server (CA_LIC_SRVR) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Internet Service - Unknown owner - C:\WINDOWS\smss.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: IPSE Service (Messanger) - Unknown owner - c:\windows\svchost.exe (file missing)
O23 - Service: MsService - Unknown owner - C:\WINDOWS\system\proxy.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: roxtctm Corporation inc. (roxtctm) - Unknown owner - C:\WINDOWS\system32\roxtctm.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 8433 bytes
J

Jurgenv1

Legacy Member
Fix de volgende regel in hijackthis:

O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"

* Download LSPFix.
Start het programma.
Plaats een vinkje bij I know what I am doing.
Zorg dat in het rechtse venster (remove venster) alle verwijzingen staan van: mmchost.dll.
(Let op enkel deze mogen in het remove-venster staan, geen anderen!!!)
Klik op Finish en start de computer opnieuw.

Post dan een nieuw hijackthis logje hier.
d

d.huyss

Legacy Member
Bedankt Jurgenv1, na het uitvoeren van de stappen, lijkt mijn pc het plots al een stuk beter te doen. Wel nog steeds af en toe foutmeldingen van svchost en scriptfout van internet explorer "a is null or not an object".

Repair summary van LSP-Fix v1.1:
0 NameSpace provider entries removed
0 NameSpace provider entries renumbered
2 Protocol provider entries removed
19 Protocol provider entries renumbered

HiJackThislog
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:04, on 2008-08-31
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\inf\svchoct.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\1024\SVCHOST.EXE
C:\WINDOWS\system32\afisicx.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\system32\macidwe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system\proxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\noxtcyr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\roxtctm.exe
C:\WINDOWS\system32\sotpeca.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\tdxdowkc.exe
C:\WINDOWS\system32\wsldoekd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [mininyust] C:\WINDOWS\system32\inf\svchoct.exe C:\WINDOWS\wftadfi16_080828a.dll tanlt88
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: afisicx Corporation (afisicx) - Unknown owner - C:\WINDOWS\system32\afisicx.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe (file missing)
O23 - Service: CA License Server (CA_LIC_SRVR) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Internet Service - Unknown owner - C:\WINDOWS\smss.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: macidwe Portable Media Serial Service (macidwe) - Unknown owner - C:\WINDOWS\system32\macidwe.exe
O23 - Service: IPSE Service (Messanger) - Unknown owner - c:\windows\svchost.exe (file missing)
O23 - Service: MsService - Unknown owner - C:\WINDOWS\system\proxy.exe
O23 - Service: noxtcyr Manages messages (noxtcyr) - Unknown owner - C:\WINDOWS\system32\noxtcyr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: roxtctm Corporation inc. (roxtctm) - Unknown owner - C:\WINDOWS\system32\roxtctm.exe
O23 - Service: sotpeca Portable Media Serial Service (sotpeca) - Unknown owner - C:\WINDOWS\system32\sotpeca.exe
O23 - Service: tdxdowkc Corporation inc. (tdxdowkc) - Unknown owner - C:\WINDOWS\system32\tdxdowkc.exe
O23 - Service: wsldoekd Corporation (wsldoekd) - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 9455 bytes
J

Jurgenv1

Legacy Member
Fix de volgende regels in hijackthis:

O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"

Post dan nog eens een nieuw logje van SDfix hier met een nieuw logje van hijackthis.
d

d.huyss

Legacy Member
Bedankt. Nog steeds foutmeldingen van svchost, de rest lijkt het goed te doen :-)

SDFix-log:
SDFix: Version 1.219
Run by Gebruiker on 2008-09-02 at 17:43

Microsoft Windows XP [versie 5.1.2600]
Running From: C:\Documents and Settings\Gebruiker\Bureaublad\SDFix

Checking Services :

Name :
macidwe
tdxdowkc

Path :
C:\WINDOWS\system32\macidwe.exe
C:\WINDOWS\system32\tdxdowkc.exe

macidwe - Deleted
tdxdowkc - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\atsxyzd.sys - Deleted
C:\WINDOWS\system32\comsa32.sys - Deleted
C:\WINDOWS\system32\macidwe.exe - Deleted
C:\WINDOWS\system32\rtl60.bpl - Deleted
C:\WINDOWS\system32\tdxdowkc.exe - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-02 17:55:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.0"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
"C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE"="C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE:*:Enabled:SVCHOST.EXE"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\DOCUME~1\GEBRUI~1\BUREAU~1\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 17 Aug 2004 97,792 A..H. --- "C:\WINDOWS\system32\6to4ex.dll"
Thu 7 Sep 2006 5 A.SH. --- "C:\WINDOWS\system32\cedabcfeef_d.dll"
Mon 25 Aug 2008 15,360 A..H. --- "C:\WINDOWS\system32\dbi102.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna1Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna2Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\KarnaDrv.dll"
Sun 30 Jul 2006 205,918 ..SH. --- "C:\WINDOWS\system32\srqss.bak1"
Fri 29 Aug 2008 14,848 A..H. --- "C:\WINDOWS\system32\zordisa.dll"
Thu 5 May 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0001.tmp"
Sun 11 Feb 2007 25,088 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0002.tmp"
Sun 11 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0003.tmp"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0004.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0005.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0006.tmp"
Mon 28 Apr 2008 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0007.tmp"
Fri 16 May 2008 36,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0008.tmp"
Sun 18 May 2008 305,664 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0009.tmp"
Sun 8 Jun 2008 100,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0010.tmp"
Wed 11 Jun 2008 139,264 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0011.tmp"
Mon 28 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0012.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0019.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0050.tmp"
Sat 1 Jul 2006 1,275,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0081.tmp"
Sun 11 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0150.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0392.tmp"
Mon 19 Feb 2007 4,508,672 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0408.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0522.tmp"
Sat 17 May 2008 62,464 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0881.tmp"
Mon 30 Oct 2006 200,704 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0913.tmp"
Mon 19 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0955.tmp"
Wed 9 Mar 2005 77,312 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0990.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0993.tmp"
Sat 1 Jul 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1075.tmp"
Mon 9 Jun 2008 130,560 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1079.tmp"
Sat 1 Jul 2006 464,896 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1119.tmp"
Mon 9 Jun 2008 133,120 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1152.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1342.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1359.tmp"
Mon 19 Feb 2007 4,472,832 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1375.tmp"
Sun 11 Feb 2007 4,467,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1450.tmp"
Sun 11 Feb 2007 4,475,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1464.tmp"
Sat 1 Jul 2006 1,138,688 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1695.tmp"
Sun 24 Sep 2006 24,576 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1799.tmp"
Mon 5 Nov 2007 17,835 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1955.tmp"
Sun 8 Jun 2008 99,840 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1979.tmp"
Mon 17 Mar 2008 22,551 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2363.tmp"
Sun 11 Feb 2007 4,471,296 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2422.tmp"
Sat 1 Jul 2006 1,350,656 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2448.tmp"
Sun 4 Feb 2007 29,696 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2819.tmp"
Mon 29 Jan 2007 19,968 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2903.tmp"
Sun 11 Feb 2007 4,445,184 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3175.tmp"
Sun 29 May 2005 64,000 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3220.tmp"
Sat 1 Jul 2006 152,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3427.tmp"
Sat 1 Jul 2006 1,267,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3784.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3973.tmp"
Sat 24 Feb 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Mon 19 May 2008 53,760 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL1195.tmp"
Fri 30 Mar 2007 81,920 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL2597.tmp"
Thu 7 Sep 2006 96 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT1.tmp"
Mon 2 Jul 2007 27,648 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0001.tmp"
Sun 8 Jun 2008 19,837 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0002.tmp"
Wed 17 Aug 2005 60,928 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0004.tmp"
Thu 24 Feb 2005 27,648 A..H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL1747.tmp"
Sat 7 May 2005 39,424 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL2602.tmp"
Sat 17 May 2008 38,954 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL3715.tmp"
Wed 25 May 2005 49,152 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0254.tmp"
Sat 7 May 2005 25,088 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0429.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0481.tmp"
Sun 10 Apr 2005 19,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0731.tmp"
Wed 1 Jun 2005 25,600 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0810.tmp"
Wed 1 Jun 2005 29,184 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0918.tmp"
Tue 31 May 2005 112,128 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1221.tmp"
Fri 28 Mar 2008 30,208 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1489.tmp"
Wed 1 Jun 2005 24,064 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1788.tmp"
Sun 29 May 2005 83,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2040.tmp"
Wed 1 Jun 2005 51,200 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2269.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2285.tmp"
Wed 1 Jun 2005 24,576 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2484.tmp"
Wed 1 Jun 2005 23,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2505.tmp"
Sat 28 May 2005 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2576.tmp"
Sat 28 May 2005 87,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2644.tmp"
Fri 28 Mar 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2969.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3447.tmp"
Wed 1 Jun 2005 26,624 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3565.tmp"
Wed 1 Jun 2005 20,992 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3600.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3655.tmp"
Thu 9 Jun 2005 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3690.tmp"
Thu 9 Jun 2005 43,008 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3810.tmp"
Thu 5 May 2005 4,348 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1key.bak"
Wed 23 Aug 2006 20 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1lic.bak"
Tue 4 Jul 2006 400 A.SH. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv2key.bak"

Finished!


Hijackthislog:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:09, on 2008-09-02
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\smss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system\proxy.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\1024\SVCHOST.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: afisicx Corporation (afisicx) - Unknown owner - C:\WINDOWS\system32\afisicx.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe (file missing)
O23 - Service: CA License Server (CA_LIC_SRVR) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Internet Service - Unknown owner - C:\WINDOWS\smss.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exe
O23 - Service: IPSE Service (Messanger) - Unknown owner - c:\windows\svchost.exe (file missing)
O23 - Service: MsService - Unknown owner - C:\WINDOWS\system\proxy.exe
O23 - Service: noxtcyr Manages messages (noxtcyr) - Unknown owner - C:\WINDOWS\system32\noxtcyr.exe
O23 - Service: noytcyr Service (noytcyr) - Unknown owner - C:\WINDOWS\system32\noytcyr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: roxtctm Corporation inc. (roxtctm) - Unknown owner - C:\WINDOWS\system32\roxtctm.exe
O23 - Service: roytctm Service (roytctm) - Unknown owner - C:\WINDOWS\system32\roytctm.exe
O23 - Service: sotpeca Portable Media Serial Service (sotpeca) - Unknown owner - C:\WINDOWS\system32\sotpeca.exe
O23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exe
O23 - Service: tdydowkc Service (tdydowkc) - Unknown owner - C:\WINDOWS\system32\tdydowkc.exe
O23 - Service: wsldoekd Corporation (wsldoekd) - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 9411 bytes
d

d.huyss

Legacy Member
Jurgenv1: Het eerste deel van SDfix gebeurt in veilige modus, daarna start de pc op, en als ik dan het vervolg in veilige modus wil doen, gebeurt er niets. Heb dus het 2e deel in normale modus gedaan.


SDFix: Version 1.219
Run by Gebruiker on 2008-09-04 at 10:13

Microsoft Windows XP [versie 5.1.2600]
Running From: C:\Documents and Settings\Gebruiker\Bureaublad\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-04 10:30:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.0"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
"C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE"="C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE:*:Enabled:SVCHOST.EXE"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :



Files with Hidden Attributes :

Tue 17 Aug 2004 97,792 A..H. --- "C:\WINDOWS\system32\6to4ex.dll"
Thu 7 Sep 2006 5 A.SH. --- "C:\WINDOWS\system32\cedabcfeef_d.dll"
Mon 25 Aug 2008 15,360 A..H. --- "C:\WINDOWS\system32\dbi102.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna1Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna2Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\KarnaDrv.dll"
Sun 30 Jul 2006 205,918 ..SH. --- "C:\WINDOWS\system32\srqss.bak1"
Fri 29 Aug 2008 14,848 A..H. --- "C:\WINDOWS\system32\zordisa.dll"
Thu 5 May 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0001.tmp"
Sun 11 Feb 2007 25,088 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0002.tmp"
Sun 11 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0003.tmp"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0004.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0005.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0006.tmp"
Mon 28 Apr 2008 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0007.tmp"
Fri 16 May 2008 36,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0008.tmp"
Sun 18 May 2008 305,664 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0009.tmp"
Sun 8 Jun 2008 100,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0010.tmp"
Wed 11 Jun 2008 139,264 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0011.tmp"
Mon 28 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0012.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0019.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0050.tmp"
Sat 1 Jul 2006 1,275,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0081.tmp"
Sun 11 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0150.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0392.tmp"
Mon 19 Feb 2007 4,508,672 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0408.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0522.tmp"
Sat 17 May 2008 62,464 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0881.tmp"
Mon 30 Oct 2006 200,704 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0913.tmp"
Mon 19 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0955.tmp"
Wed 9 Mar 2005 77,312 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0990.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0993.tmp"
Sat 1 Jul 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1075.tmp"
Mon 9 Jun 2008 130,560 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1079.tmp"
Sat 1 Jul 2006 464,896 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1119.tmp"
Mon 9 Jun 2008 133,120 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1152.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1342.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1359.tmp"
Mon 19 Feb 2007 4,472,832 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1375.tmp"
Sun 11 Feb 2007 4,467,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1450.tmp"
Sun 11 Feb 2007 4,475,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1464.tmp"
Sat 1 Jul 2006 1,138,688 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1695.tmp"
Sun 24 Sep 2006 24,576 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1799.tmp"
Mon 5 Nov 2007 17,835 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1955.tmp"
Sun 8 Jun 2008 99,840 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1979.tmp"
Mon 17 Mar 2008 22,551 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2363.tmp"
Sun 11 Feb 2007 4,471,296 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2422.tmp"
Sat 1 Jul 2006 1,350,656 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2448.tmp"
Sun 4 Feb 2007 29,696 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2819.tmp"
Mon 29 Jan 2007 19,968 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2903.tmp"
Sun 11 Feb 2007 4,445,184 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3175.tmp"
Sun 29 May 2005 64,000 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3220.tmp"
Sat 1 Jul 2006 152,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3427.tmp"
Sat 1 Jul 2006 1,267,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3784.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3973.tmp"
Sat 24 Feb 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Mon 19 May 2008 53,760 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL1195.tmp"
Fri 30 Mar 2007 81,920 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL2597.tmp"
Thu 7 Sep 2006 96 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Wed 30 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT1.tmp"
Mon 2 Jul 2007 27,648 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0001.tmp"
Sun 8 Jun 2008 19,837 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0002.tmp"
Wed 17 Aug 2005 60,928 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0004.tmp"
Thu 24 Feb 2005 27,648 A..H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL1747.tmp"
Sat 7 May 2005 39,424 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL2602.tmp"
Sat 17 May 2008 38,954 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL3715.tmp"
Wed 25 May 2005 49,152 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0254.tmp"
Sat 7 May 2005 25,088 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0429.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0481.tmp"
Sun 10 Apr 2005 19,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0731.tmp"
Wed 1 Jun 2005 25,600 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0810.tmp"
Wed 1 Jun 2005 29,184 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0918.tmp"
Tue 31 May 2005 112,128 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1221.tmp"
Fri 28 Mar 2008 30,208 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1489.tmp"
Wed 1 Jun 2005 24,064 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1788.tmp"
Sun 29 May 2005 83,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2040.tmp"
Wed 1 Jun 2005 51,200 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2269.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2285.tmp"
Wed 1 Jun 2005 24,576 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2484.tmp"
Wed 1 Jun 2005 23,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2505.tmp"
Sat 28 May 2005 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2576.tmp"
Sat 28 May 2005 87,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2644.tmp"
Fri 28 Mar 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2969.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3447.tmp"
Wed 1 Jun 2005 26,624 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3565.tmp"
Wed 1 Jun 2005 20,992 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3600.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3655.tmp"
Thu 9 Jun 2005 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3690.tmp"
Thu 9 Jun 2005 43,008 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3810.tmp"
Thu 5 May 2005 4,348 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1key.bak"
Wed 23 Aug 2006 20 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1lic.bak"
Tue 4 Jul 2006 400 A.SH. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv2key.bak"

Finished!
J

Jurgenv1

Legacy Member
Fix de volgende regels in hijackthis:

O23 - Service: afisicx Corporation (afisicx) - Unknown owner - C:\WINDOWS\system32\afisicx.exe
O23 - Service: Internet Service - Unknown owner - C:\WINDOWS\smss.exe
O23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exe
O23 - Service: IPSE Service (Messanger) - Unknown owner - c:\windows\svchost.exe (file missing)
O23 - Service: MsService - Unknown owner - C:\WINDOWS\system\proxy.exe
O23 - Service: noxtcyr Manages messages (noxtcyr) - Unknown owner - C:\WINDOWS\system32\noxtcyr.exe
O23 - Service: noytcyr Service (noytcyr) - Unknown owner - C:\WINDOWS\system32\noytcyr.exe
O23 - Service: roxtctm Corporation inc. (roxtctm) - Unknown owner - C:\WINDOWS\system32\roxtctm.exe
O23 - Service: roytctm Service (roytctm) - Unknown owner - C:\WINDOWS\system32\roytctm.exe
O23 - Service: sotpeca Portable Media Serial Service (sotpeca) - Unknown owner - C:\WINDOWS\system32\sotpeca.exe
O23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exe
O23 - Service: tdydowkc Service (tdydowkc) - Unknown owner - C:\WINDOWS\system32\tdydowkc.exe
O23 - Service: wsldoekd Corporation (wsldoekd) - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe

* Download OTMoveIt.exe en plaats het op je bureaublad:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

* Open OTMoveIt.exe.
In het linkerpaneel, waar het zegt: "Paste List of Files/Folders to be Moved" ,kopieer en plak onderstaand gedeelte:

C:\WINDOWS\system32\afisicx.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\system32\mabidwe.exe
C:\WINDOWS\system\proxy.exe
C:\WINDOWS\system32\noxtcyr.exe
C:\WINDOWS\system32\noytcyr.exe
C:\WINDOWS\system32\roxtctm.exe
C:\WINDOWS\system32\roytctm.exe
C:\WINDOWS\system32\sotpeca.exe
C:\WINDOWS\system32\soxpeca.exe
C:\WINDOWS\system32\tdydowkc.exe
C:\WINDOWS\system32\wsldoekd.exe


Daarna klik de MoveIt knop onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in volgende map: C:\_OTMoveIt\MovedFiles.
Kopieer en plak de inhoud van die log in je volgende post met een nieuw hijackthis logje.
d

d.huyss

Legacy Member
Bedankt Jurgenv1. Voorlopig lijkt alles het weer wat beter te doen: geen foutmeldingen meer van svchost, wel nog steeds de foutmelding 'Fout in het script voor Internet Explorer' (http://http://img129.imageshack.us/my.php?image=ietf8.jpg)


Log van OTMoveIt:
C:\WINDOWS\system32\afisicx.exe moved successfully.
C:\WINDOWS\smss.exe moved successfully.
C:\WINDOWS\system32\mabidwe.exe moved successfully.
C:\WINDOWS\system\proxy.exe moved successfully.
C:\WINDOWS\system32\noxtcyr.exe moved successfully.
C:\WINDOWS\system32\noytcyr.exe moved successfully.
C:\WINDOWS\system32\roxtctm.exe moved successfully.
C:\WINDOWS\system32\roytctm.exe moved successfully.
C:\WINDOWS\system32\sotpeca.exe moved successfully.
C:\WINDOWS\system32\soxpeca.exe moved successfully.
C:\WINDOWS\system32\tdydowkc.exe moved successfully.
C:\WINDOWS\system32\wsldoekd.exe moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09072008_144317



HiJackThislog:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:45, on 2008-09-07
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\1024\SVCHOST.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: afisicx Corporation (afisicx) - Unknown owner - C:\WINDOWS\system32\afisicx.exe (file missing)
O23 - Service: CA License Client (CA_LIC_CLNT) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe (file missing)
O23 - Service: CA License Server (CA_LIC_SRVR) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exe (file missing)
O23 - Service: IPSE Service (Messanger) - Unknown owner - c:\windows\svchost.exe (file missing)
O23 - Service: noxtcyr Manages messages (noxtcyr) - Unknown owner - C:\WINDOWS\system32\noxtcyr.exe (file missing)
O23 - Service: noytcyr Service (noytcyr) - Unknown owner - C:\WINDOWS\system32\noytcyr.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: roxtctm Corporation inc. (roxtctm) - Unknown owner - C:\WINDOWS\system32\roxtctm.exe (file missing)
O23 - Service: roytctm Service (roytctm) - Unknown owner - C:\WINDOWS\system32\roytctm.exe (file missing)
O23 - Service: sotpeca Portable Media Serial Service (sotpeca) - Unknown owner - C:\WINDOWS\system32\sotpeca.exe (file missing)
O23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exe (file missing)
O23 - Service: tdydowkc Service (tdydowkc) - Unknown owner - C:\WINDOWS\system32\tdydowkc.exe (file missing)
O23 - Service: wsldoekd Corporation (wsldoekd) - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 9267 bytes
J

Jurgenv1

Legacy Member
* fix de volgende regels in hijackthis:

O4 - HKLM\..\Run: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\1024\SVCHOST.EXE"
O23 - Service: afisicx Corporation (afisicx) - Unknown owner - C:\WINDOWS\system32\afisicx.exe (file missing)
O23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exe (file missing)
O23 - Service: IPSE Service (Messanger) - Unknown owner - c:\windows\svchost.exe (file missing)
O23 - Service: noxtcyr Manages messages (noxtcyr) - Unknown owner - C:\WINDOWS\system32\noxtcyr.exe (file missing)
O23 - Service: noytcyr Service (noytcyr) - Unknown owner - C:\WINDOWS\system32\noytcyr.exe (file missing)
O23 - Service: roxtctm Corporation inc. (roxtctm) - Unknown owner - C:\WINDOWS\system32\roxtctm.exe (file missing)
O23 - Service: roytctm Service (roytctm) - Unknown owner - C:\WINDOWS\system32\roytctm.exe (file missing)
O23 - Service: sotpeca Portable Media Serial Service (sotpeca) - Unknown owner - C:\WINDOWS\system32\sotpeca.exe (file missing)
O23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exe (file missing)
O23 - Service: tdydowkc Service (tdydowkc) - Unknown owner - C:\WINDOWS\system32\tdydowkc.exe (file missing)
O23 - Service: wsldoekd Corporation (wsldoekd) - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe (file missing)

Voer dan nog eens SDfix uit voor me?
d

d.huyss

Legacy Member
Ondertussen nog steeds dezelfde problemen (wel in veeeel mindere mate): svchost en script internet explorer.

SDfix:

SDFix: Version 1.222
Run by Gebruiker on 2008-09-08 at 13:43

Microsoft Windows XP [versie 5.1.2600]
Running From: C:\Documents and Settings\Gebruiker\Bureaublad\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-08 13:50:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.0"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
"C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE"="C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE:*:Enabled:SVCHOST.EXE"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :



Files with Hidden Attributes :

Tue 17 Aug 2004 97,792 A..H. --- "C:\WINDOWS\system32\6to4ex.dll"
Thu 7 Sep 2006 5 A.SH. --- "C:\WINDOWS\system32\cedabcfeef_d.dll"
Mon 25 Aug 2008 15,360 A..H. --- "C:\WINDOWS\system32\dbi102.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna1Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna2Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\KarnaDrv.dll"
Sun 30 Jul 2006 205,918 ..SH. --- "C:\WINDOWS\system32\srqss.bak1"
Fri 29 Aug 2008 14,848 A..H. --- "C:\WINDOWS\system32\zordisa.dll"
Thu 5 May 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0001.tmp"
Sun 11 Feb 2007 25,088 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0002.tmp"
Sun 11 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0003.tmp"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0004.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0005.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0006.tmp"
Mon 28 Apr 2008 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0007.tmp"
Fri 16 May 2008 36,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0008.tmp"
Sun 18 May 2008 305,664 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0009.tmp"
Sun 8 Jun 2008 100,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0010.tmp"
Wed 11 Jun 2008 139,264 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0011.tmp"
Mon 28 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0012.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0019.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0050.tmp"
Sat 1 Jul 2006 1,275,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0081.tmp"
Sun 11 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0150.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0392.tmp"
Mon 19 Feb 2007 4,508,672 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0408.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0522.tmp"
Sat 17 May 2008 62,464 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0881.tmp"
Mon 30 Oct 2006 200,704 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0913.tmp"
Mon 19 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0955.tmp"
Wed 9 Mar 2005 77,312 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0990.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0993.tmp"
Sat 1 Jul 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1075.tmp"
Mon 9 Jun 2008 130,560 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1079.tmp"
Sat 1 Jul 2006 464,896 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1119.tmp"
Mon 9 Jun 2008 133,120 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1152.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1342.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1359.tmp"
Mon 19 Feb 2007 4,472,832 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1375.tmp"
Sun 11 Feb 2007 4,467,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1450.tmp"
Sun 11 Feb 2007 4,475,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1464.tmp"
Sat 1 Jul 2006 1,138,688 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1695.tmp"
Sun 24 Sep 2006 24,576 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1799.tmp"
Mon 5 Nov 2007 17,835 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1955.tmp"
Sun 8 Jun 2008 99,840 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1979.tmp"
Mon 17 Mar 2008 22,551 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2363.tmp"
Sun 11 Feb 2007 4,471,296 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2422.tmp"
Sat 1 Jul 2006 1,350,656 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2448.tmp"
Sun 4 Feb 2007 29,696 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2819.tmp"
Mon 29 Jan 2007 19,968 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2903.tmp"
Sun 11 Feb 2007 4,445,184 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3175.tmp"
Sun 29 May 2005 64,000 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3220.tmp"
Sat 1 Jul 2006 152,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3427.tmp"
Sat 1 Jul 2006 1,267,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3784.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3973.tmp"
Sat 24 Feb 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Mon 19 May 2008 53,760 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL1195.tmp"
Fri 30 Mar 2007 81,920 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL2597.tmp"
Thu 7 Sep 2006 96 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Mon 2 Jul 2007 27,648 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0001.tmp"
Sun 8 Jun 2008 19,837 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0002.tmp"
Wed 17 Aug 2005 60,928 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0004.tmp"
Thu 24 Feb 2005 27,648 A..H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL1747.tmp"
Sat 7 May 2005 39,424 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL2602.tmp"
Sat 17 May 2008 38,954 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL3715.tmp"
Wed 25 May 2005 49,152 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0254.tmp"
Sat 7 May 2005 25,088 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0429.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0481.tmp"
Sun 10 Apr 2005 19,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0731.tmp"
Wed 1 Jun 2005 25,600 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0810.tmp"
Wed 1 Jun 2005 29,184 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0918.tmp"
Tue 31 May 2005 112,128 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1221.tmp"
Fri 28 Mar 2008 30,208 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1489.tmp"
Wed 1 Jun 2005 24,064 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1788.tmp"
Sun 29 May 2005 83,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2040.tmp"
Wed 1 Jun 2005 51,200 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2269.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2285.tmp"
Wed 1 Jun 2005 24,576 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2484.tmp"
Wed 1 Jun 2005 23,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2505.tmp"
Sat 28 May 2005 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2576.tmp"
Sat 28 May 2005 87,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2644.tmp"
Fri 28 Mar 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2969.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3447.tmp"
Wed 1 Jun 2005 26,624 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3565.tmp"
Wed 1 Jun 2005 20,992 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3600.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3655.tmp"
Thu 9 Jun 2005 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3690.tmp"
Thu 9 Jun 2005 43,008 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3810.tmp"
Thu 5 May 2005 4,348 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1key.bak"
Wed 23 Aug 2006 20 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1lic.bak"
Tue 4 Jul 2006 400 A.SH. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv2key.bak"

Finished!



HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:00, on 2008-09-08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: afisicx Corporation (afisicx) - Unknown owner - C:\WINDOWS\system32\afisicx.exe (file missing)
O23 - Service: CA License Client (CA_LIC_CLNT) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe (file missing)
O23 - Service: CA License Server (CA_LIC_SRVR) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exe (file missing)
O23 - Service: IPSE Service (Messanger) - Unknown owner - c:\windows\svchost.exe (file missing)
O23 - Service: noxtcyr Manages messages (noxtcyr) - Unknown owner - C:\WINDOWS\system32\noxtcyr.exe (file missing)
O23 - Service: noytcyr Service (noytcyr) - Unknown owner - C:\WINDOWS\system32\noytcyr.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: roxtctm Corporation inc. (roxtctm) - Unknown owner - C:\WINDOWS\system32\roxtctm.exe (file missing)
O23 - Service: roytctm Service (roytctm) - Unknown owner - C:\WINDOWS\system32\roytctm.exe (file missing)
O23 - Service: sotpeca Portable Media Serial Service (sotpeca) - Unknown owner - C:\WINDOWS\system32\sotpeca.exe (file missing)
O23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exe (file missing)
O23 - Service: tdydowkc Service (tdydowkc) - Unknown owner - C:\WINDOWS\system32\tdydowkc.exe (file missing)
O23 - Service: wsldoekd Corporation (wsldoekd) - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 9048 bytes
J

Jurgenv1

Legacy Member
Open Kladblok. Kopieer de onderstaande tekst en plak die in een nieuw document:

sc delete afisicx
sc delete mabidwe
sc delete Messanger
sc delete noxtcyr
sc delete noytcyr
sc delete roxtctm
sc delete roytctm
sc delete sotpeca
sc delete rsoxpeca
sc delete tdydowkc
sc delete wsldoekd

Sla dit op als delservices.bat, kies bij opslaan voor "alle bestanden" en plaats het op je bureaublad.

Dubbelklik op delservices.bat (dat nu op je bureaublad staat).

Post dan een nieuw logje hier.
d

d.huyss

Legacy Member
Bedankt Jurgenv1, pc loopt weer vlotter. Maar nog steeds die foutmelding van script IE.

HiJackThislog:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33, on 2008-09-12
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FAMTACE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hln.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: CA License Client (CA_LIC_CLNT) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe (file missing)
O23 - Service: CA License Server (CA_LIC_SRVR) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 8053 bytes


SDFix:

SDFix: Version 1.222
Run by Gebruiker on 2008-09-12 at 10:41

Microsoft Windows XP [versie 5.1.2600]
Running From: C:\Documents and Settings\Gebruiker\Bureaublad\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-12 10:49:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.0"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
"C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE"="C:\\WINDOWS\\system32\\1024\\SVCHOST.EXE:*:Enabled:SVCHOST.EXE"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :



Files with Hidden Attributes :

Tue 17 Aug 2004 97,792 A..H. --- "C:\WINDOWS\system32\6to4ex.dll"
Thu 7 Sep 2006 5 A.SH. --- "C:\WINDOWS\system32\cedabcfeef_d.dll"
Mon 25 Aug 2008 15,360 A..H. --- "C:\WINDOWS\system32\dbi102.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna1Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\Karna2Drv.dll"
Wed 2 Feb 2000 40,960 ..SHR --- "C:\WINDOWS\system32\KarnaDrv.dll"
Sun 30 Jul 2006 205,918 ..SH. --- "C:\WINDOWS\system32\srqss.bak1"
Fri 29 Aug 2008 14,848 A..H. --- "C:\WINDOWS\system32\zordisa.dll"
Thu 5 May 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0001.tmp"
Sun 11 Feb 2007 25,088 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0002.tmp"
Sun 11 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0003.tmp"
Sun 23 Oct 2005 20,480 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0004.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0005.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0006.tmp"
Mon 28 Apr 2008 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0007.tmp"
Fri 16 May 2008 36,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0008.tmp"
Sun 18 May 2008 305,664 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0009.tmp"
Sun 8 Jun 2008 100,864 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0010.tmp"
Wed 11 Jun 2008 139,264 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0011.tmp"
Mon 28 Jul 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0012.tmp"
Mon 12 Feb 2007 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0019.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0050.tmp"
Sat 1 Jul 2006 1,275,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0081.tmp"
Sun 11 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0150.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0392.tmp"
Mon 19 Feb 2007 4,508,672 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0408.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0522.tmp"
Sat 17 May 2008 62,464 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0881.tmp"
Mon 30 Oct 2006 200,704 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0913.tmp"
Mon 19 Feb 2007 4,453,888 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0955.tmp"
Wed 9 Mar 2005 77,312 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0990.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL0993.tmp"
Sat 1 Jul 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1075.tmp"
Mon 9 Jun 2008 130,560 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1079.tmp"
Sat 1 Jul 2006 464,896 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1119.tmp"
Mon 9 Jun 2008 133,120 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1152.tmp"
Sat 1 Jul 2006 464,384 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1342.tmp"
Sun 11 Feb 2007 4,463,616 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1359.tmp"
Mon 19 Feb 2007 4,472,832 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1375.tmp"
Sun 11 Feb 2007 4,467,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1450.tmp"
Sun 11 Feb 2007 4,475,392 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1464.tmp"
Sat 1 Jul 2006 1,138,688 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1695.tmp"
Sun 24 Sep 2006 24,576 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1799.tmp"
Mon 5 Nov 2007 17,835 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1955.tmp"
Sun 8 Jun 2008 99,840 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL1979.tmp"
Mon 17 Mar 2008 22,551 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2363.tmp"
Sun 11 Feb 2007 4,471,296 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2422.tmp"
Sat 1 Jul 2006 1,350,656 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2448.tmp"
Sun 4 Feb 2007 29,696 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2819.tmp"
Mon 29 Jan 2007 19,968 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL2903.tmp"
Sun 11 Feb 2007 4,445,184 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3175.tmp"
Sun 29 May 2005 64,000 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3220.tmp"
Sat 1 Jul 2006 152,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3427.tmp"
Sat 1 Jul 2006 1,267,712 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3784.tmp"
Sun 24 Sep 2006 24,064 A..H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\~WRL3973.tmp"
Sat 24 Feb 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Mon 19 May 2008 53,760 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL1195.tmp"
Fri 30 Mar 2007 81,920 ...H. --- "C:\Documents and Settings\Gebruiker\Mijn documenten\Mijn ontvangen bestanden\~WRL2597.tmp"
Thu 7 Sep 2006 96 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Mon 2 Jul 2007 27,648 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0001.tmp"
Sun 8 Jun 2008 19,837 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0002.tmp"
Wed 17 Aug 2005 60,928 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL0004.tmp"
Thu 24 Feb 2005 27,648 A..H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL1747.tmp"
Sat 7 May 2005 39,424 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL2602.tmp"
Sat 17 May 2008 38,954 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Sjablonen\~WRL3715.tmp"
Wed 25 May 2005 49,152 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0254.tmp"
Sat 7 May 2005 25,088 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0429.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0481.tmp"
Sun 10 Apr 2005 19,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0731.tmp"
Wed 1 Jun 2005 25,600 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0810.tmp"
Wed 1 Jun 2005 29,184 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL0918.tmp"
Tue 31 May 2005 112,128 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1221.tmp"
Fri 28 Mar 2008 30,208 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1489.tmp"
Wed 1 Jun 2005 24,064 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL1788.tmp"
Sun 29 May 2005 83,968 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2040.tmp"
Wed 1 Jun 2005 51,200 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2269.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2285.tmp"
Wed 1 Jun 2005 24,576 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2484.tmp"
Wed 1 Jun 2005 23,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2505.tmp"
Sat 28 May 2005 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2576.tmp"
Sat 28 May 2005 87,552 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2644.tmp"
Fri 28 Mar 2008 31,232 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL2969.tmp"
Sun 10 Apr 2005 20,480 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3447.tmp"
Wed 1 Jun 2005 26,624 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3565.tmp"
Wed 1 Jun 2005 20,992 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3600.tmp"
Mon 21 May 2007 162,304 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3655.tmp"
Thu 9 Jun 2005 37,376 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3690.tmp"
Thu 9 Jun 2005 43,008 ...H. --- "C:\Documents and Settings\Gebruiker\Application Data\Microsoft\Word\~WRL3810.tmp"
Thu 5 May 2005 4,348 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1key.bak"
Wed 23 Aug 2006 20 A..H. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv1lic.bak"
Tue 4 Jul 2006 400 A.SH. --- "C:\Documents and Settings\Gebruiker\Bureaublad\--MUZIEK--\Back-up van licentie\drmv2key.bak"

Finished!
J

Jurgenv1

Legacy Member
Ga naar 'uitvoeren' en typ het volgende:

sc delete soxpeca

Herstart dan je pc en post een nieuw logje hier.
d

d.huyss

Legacy Member
Danku Jurgenv1. Voorlopig nog geen enkele foutmelding.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:47, on 2008-09-17
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hln.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hajdiee.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://hajdiee.spaces.live.com/PhotoUpload/MsnPUpld.cab?10,0,916,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: CA License Client (CA_LIC_CLNT) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe (file missing)
O23 - Service: CA License Server (CA_LIC_SRVR) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 7720 bytes
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan