Archief - Pop ups :s

Krijg je die constant of alleen bij 1 website?

Ik krijg ze constant.
Ik gebruik firefox en pop-ups komen van internet explorer

Post eens een nieuw logje van combofix hier.

ComboFix 08-01-31.5 - chu wai shing 2008-01-31 18:36:03.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.190 [GMT 1:00]
Running from: C:\Documents and Settings\chu wai shing\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\chu wai shing\Application Data\inst.exe
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete
.
---- Previous Run -------
.
C:\Documents and Settings\chu po man\Application Data\setup_nl[1].exe
C:\Documents and Settings\chu wah chu\Application Data\macromedia\Flash Player\#SharedObjects\NR28MT3W\iforex.com
C:\Documents and Settings\chu wah chu\Application Data\macromedia\Flash Player\#SharedObjects\NR28MT3W\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\chu wah chu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\chu wah chu\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\chu wai shing\Application Data\inst.exe
C:\Documents and Settings\chu wai shing\Application Data\macromedia\Flash Player\#SharedObjects\8UJVNENG\iforex.com
C:\Documents and Settings\chu wai shing\Application Data\macromedia\Flash Player\#SharedObjects\8UJVNENG\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\chu wai shing\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\chu wai shing\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-31 )))))))))))))))))))))))))))))))
.

2008-01-31 17:29 . 2008-01-31 18:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-31 17:29 . 2008-01-31 17:29 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-28 23:49 . 2008-01-28 23:46 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-28 23:46 . 2008-01-29 20:32 <DIR> d-------- C:\Documents and Settings\chu wai shing\.housecall6.6
2008-01-27 20:56 . 2008-01-27 20:56 <DIR> d-------- C:\Documents and Settings\chu wai shing\Application Data\HP
2008-01-27 20:43 . 2006-05-08 22:04 430,080 -ra------ C:\WINDOWS\system32\hp4370co.dll
2008-01-27 20:40 . 2008-01-27 20:40 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared
2008-01-27 20:40 . 2008-01-27 20:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sonic
2008-01-27 20:39 . 2008-01-27 20:39 <DIR> d-------- C:\Program Files\Common Files\HP
2008-01-27 20:36 . 2008-01-27 20:38 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-01-27 20:34 . 2008-01-27 20:35 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-01-27 20:34 . 2008-01-27 20:34 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-01-27 20:34 . 2008-01-27 20:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HP
2008-01-27 20:31 . 2008-01-27 20:35 <DIR> d-------- C:\Program Files\HP
2008-01-27 20:28 . 2008-01-27 20:44 102,174 --a------ C:\WINDOWS\hpgins15.dat
2008-01-27 20:28 . 2006-05-18 19:09 282 --------- C:\WINDOWS\hpgmdl15.dat
2008-01-27 20:21 . 2008-01-27 20:28 <DIR> d-------- C:\Program Files\COL11004
2008-01-24 16:57 . 2008-01-24 16:57 167,545 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-24 13:51 . 2008-01-24 13:51 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\schijfbewaker
2008-01-24 13:50 . 2008-01-24 13:58 <DIR> d-------- C:\Program Files\SchijfBewaker
2008-01-24 13:50 . 2008-01-24 13:50 <DIR> d-------- C:\Program Files\Common Files\SchijfBewaker
2008-01-21 03:18 . 2008-01-21 03:18 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-01-21 03:18 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-01-21 03:17 . 2008-01-21 03:21 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-01-21 03:16 . 2008-01-21 03:16 86,144 --a------ C:\WINDOWS\system32\drivers\mnmddd.sys
2008-01-06 21:39 . 2008-01-06 21:41 <DIR> d-------- C:\Documents and Settings\chu wai shing\Application Data\PowerChallenge
2007-12-23 15:11 . 2007-12-23 15:11 0 --a------ C:\WINDOWS\system32\mapisvc.inf
2007-12-22 17:59 . 2007-12-22 17:59 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-22 17:59 . 2008-01-23 21:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-15 20:51 . 2008-01-21 03:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-12 18:18 . 2007-12-12 19:29 248 --a------ C:\WINDOWS\system32\systemdrv32.aso
2007-12-12 18:12 . 2007-12-12 19:29 <DIR> d-------- C:\Program Files\Absolute Poker
2007-12-12 18:12 . 2007-12-12 18:12 <DIR> d-------- C:\Program Files\_uninstallation_info
2007-12-06 22:57 . 2007-12-06 22:57 <DIR> d-------- C:\Program Files\MSBuild
2007-12-06 22:51 . 2007-12-06 22:56 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-12-06 12:20 . 2007-12-06 12:20 <DIR> d-------- C:\Program Files\MagicDisc
2007-12-06 12:20 . 2007-09-05 01:46 92,544 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
2007-12-03 21:33 . 2007-12-09 16:07 75,032 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2007-12-02 13:43 . 2007-12-02 14:00 127 --a------ C:\WINDOWS\ChssBase.ini
2007-12-02 13:40 . 2007-12-02 13:46 <DIR> d-------- C:\Documents and Settings\chu wai shing\Application Data\ChessBase

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 21:01 --------- d-----w C:\Program Files\Soulseek
2008-01-28 20:25 --------- d-----w C:\Program Files\mIRC
2008-01-27 17:20 --------- d-----w C:\Documents and Settings\chu wai shing\Application Data\dvdcss
2008-01-27 17:18 --------- d-----w C:\Documents and Settings\chu wai shing\Application Data\Vso
2008-01-27 04:28 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-01-27 04:28 47,360 ----a-w C:\Documents and Settings\chu wai shing\Application Data\pcouffin.sys
2008-01-24 11:47 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-01-21 18:22 --------- d-----w C:\Documents and Settings\chu wah chu\Application Data\Axis16ford
2008-01-06 15:04 --------- d-----w C:\Documents and Settings\chu wai shing\Application Data\LimeWire
2007-12-23 14:10 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-12-23 14:10 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-12-18 18:26 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-15 19:35 --------- d-----w C:\Program Files\MSN Messenger
2007-12-06 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-06 11:34 --------- d-----w C:\Program Files\URUSoft
2007-12-06 11:23 --------- d-----w C:\Program Files\MagicISO
2007-12-02 12:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-02 11:38 --------- d-----w C:\Documents and Settings\chu wai shing\Application Data\BSplayer
2007-10-13 21:29 81,920 ----a-w C:\Documents and Settings\chu wai shing\Application Data\ezpinst.exe
2007-02-16 19:43 19,263,165 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_02_16_20_42_15_full.dmp.zip
2006-02-19 02:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
2007-10-13 21:46 56 --sh--r C:\WINDOWS\system32\E44C0935FA.sys
2007-10-13 21:46 10,856 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.exe" [2004-04-09 04:00 98304]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-23 15:10 949376]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42 267064]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20 73728]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Snelle start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Snelle start.lnk
backup=C:\WINDOWS\pss\Adobe Reader Snelle start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^chu wai shing^Start Menu^Programs^Startup^MagicDisc.lnk]
path=C:\Documents and Settings\chu wai shing\Start Menu\Programs\Startup\MagicDisc.lnk
backup=C:\WINDOWS\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2007-09-18 15:16 171464 C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-09-26 13:42 267064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetMeter]
C:\Program Files\NetRatingsNetmeter\NetMeter\NielsenOnline.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 05:24 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-06-14 17:32 132760 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

R1 mnmddd;mnmddd;C:\WINDOWS\system32\drivers\mnmddd.sys [2008-01-21 03:16]
R1 nmconpid;nmconpid;C:\WINDOWS\system32\drivers\nmconpid.sys [2007-03-17 01:42]
R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-09-17 17:08]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 13:00]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-01-21 03:18]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{21551A31-41DA-E83C-0207-080407040603}]
C:\WINDOWS\system32\explore.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 16:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-01-01 06:49:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-31 18:43:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
.
**************************************************************************
.
Completion time: 2008-01-31 18:48:13 - machine was rebooted [chu wai shing]
ComboFix-quarantined-files.txt 2008-01-31 17:48:09
.
2007-09-08 19:51:08 --- E O F ---

Ga naar http://www.virustotal.com/nl/ en upload het volgend bestandje:

C:\WINDOWS\system32\drivers\mnmddd.sys

Post het resultaat hier.

0 bytes size received / Se ha recibido un archivo vacio

Bij : C:\WINDOWS\system32\drivers\mnmdd.sys (misschien is die belangrijk)
Niks gevonden

Probeer dat bestand eens in te pakken met winzip of winrar en upload de archive dan.

Bestand mnmddd.rar ontvangen op 2008.02.01 23:39:33 (CET)
Huidig status: Einde
Resultaat: 1/32 (3.13%)


Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2008.2.2.10 2008.02.01 -
AntiVir 7.6.0.61 2008.02.01 -
Authentium 4.93.8 2008.02.01 -
Avast 4.7.1098.0 2008.02.01 -
AVG 7.5.0.516 2008.02.01 -
BitDefender 7.2 2008.02.01 -
CAT-QuickHeal 9.00 2008.02.01 -
ClamAV 0.92 2008.02.01 -
DrWeb 4.44.0.09170 2008.02.01 -
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5502 2008.02.01 -
Ewido 4.0 2008.02.01 -
FileAdvisor 1 2008.02.01 -
Fortinet 3.14.0.0 2008.02.01 -
F-Prot 4.4.2.54 2008.02.01 -
F-Secure 6.70.13260.0 2008.02.01 -
Ikarus T3.1.1.20 2008.02.01 -
Kaspersky 7.0.0.125 2008.02.01 -
McAfee 5221 2008.02.01 -
Microsoft 1.3204 2008.02.01 -
NOD32v2 2844 2008.02.01 -
Norman 5.80.02 2008.02.01 -
Panda 9.0.0.4 2008.02.01 -
Prevx1 V2 2008.02.01 Heuristic: Suspicious Self Modifying EXE
Rising 20.29.22.00 2008.01.30 -
Sophos 4.26.0 2008.02.01 -
Sunbelt 2.2.907.0 2008.02.01 -
Symantec 10 2008.02.01 -
TheHacker 6.2.9.205 2008.02.01 -
VBA32 3.12.2.6 2008.01.31 -
VirusBuster 4.3.26:9 2008.02.01 -
Webwasher-Gateway 6.6.2 2008.02.01 -

1. Download The Avenger by Swandog46 naar je Bureaublad.

• Klik op Avenger.zip om het uit te pakken naar je bureaublad

2. Nu, start The Avenger door op het icoontje met het zwaard te dubbelklikken.

• Onder "Script file to execute" kies "Input Script Manually".
• Klik op het vergrootglas icoontje die een nieuw venster zal openen met de naam "View/edit script"
• Kopieer en plak volgend volledig vetgedrukt erin:
  Files to delete:
  C:\Documents and Settings\chu wai shing\Application Data\inst.exe
  
  Opgelet: Bovenstaande code werd enkel gemaakt voor deze computer/situatie/user. Indien je deze code op een andere computer gebruikt kan het schade toebrengen!
• Klik Done
• Daarna klik op het Groen verkeerslicht om het script uit te voeren
• Antwoord "Yes/Ja" wanneer daarnaar gevraagd wordt.

3. The Avenger zal daarna het volgende doen:

• Uw computer herstarten. ( In gevallen waar het script een code bevat met "Drivers to Unload", dan zal The Avenger tweemaal uw systeem herstarten)
• Na herstart, zal het vlug een zwart command window openen. Dit is normaal.
• Na herstart, zal het een log maken die zal openen met de resultaten van The Avenger. Deze log zal te vinden zijn op C:\avenger.txt
• The Avenger maakt ook backups aan met alle bestanden, etc., die eerder werden verwijderd door The Avenger, deze backups bevinden zich op volgende plaats: C:\avenger\backup.zip.

4. Kopieer en plak de inhoud van avenger.txt in je volgende post samen met een nieuw hijackthislog.

C:\Documents and Settings\chu wai shing\Application Data\inst.exe bestaat niet
(er bestaat wel C:\Documents and Settings\chu wai shing\Application Data\ezpinst.exe)

Hier is een hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:47:10, on 2/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\DOCUME~1\CHUWAH~1\LOCALS~1\Temp\84.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Documents and Settings\chu wai shing\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.demorgen.be/?wt.bron=ipodtouch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Video Input] viwsvc.exe
O4 - HKLM\..\Run: [NvGraphicsInterface] C:\DOCUME~1\CHUWAH~1\LOCALS~1\Temp\84.exe
O4 - HKLM\..\Run: [d0763f72] rundll32.exe "C:\WINDOWS\system32\kqkohqes.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games &#8211; Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://poemiec.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://sympatico.zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games &#8211; Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod-service (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7151 bytes

(er bestaat wel C:\Documents and Settings\chu wai shing\Application Data\ezpinst.exe)

Klik om te vergroten...

Probeer dan dit scriptje:


Files to delete:
C:\Documents and Settings\chu wai shing\Application Data\ezpinst.exe

lukt niet
zelfde error

ik krijg meer pop-ups dan ervoor

Post eens een nieuw logje van dr.web hier.

12.exe C:\Documents and Settings\chu wah chu\Local Settings\temp Trojan.Virtumod.240 Verwijderd.
32.exe C:\Documents and Settings\chu wah chu\Local Settings\temp Trojan.Virtumod.240 Verwijderd.
33.exe C:\Documents and Settings\chu wah chu\Local Settings\temp Trojan.Virtumod.240 Verwijderd.
42.exe C:\Documents and Settings\chu wah chu\Local Settings\temp Trojan.Virtumod.240 Verwijderd.
45.exe C:\Documents and Settings\chu wah chu\Local Settings\temp Trojan.Virtumod.240 Verwijderd.
50.exe C:\Documents and Settings\chu wah chu\Local Settings\temp Trojan.Virtumod.240 Verwijderd.
55.exe C:\Documents and Settings\chu wah chu\Local Settings\temp Trojan.Virtumod.240 Verwijderd.
58.exe C:\Documents and Settings\chu wah chu\Local Settings\temp Trojan.Virtumod.240 Verwijderd.
sr4[1].exe C:\Documents and Settings\chu wah chu\Local Settings\Temporary Internet Files\Content.IE5\7734281E Trojan.Virtumod.240 Verwijderd.
ptch[1] C:\Documents and Settings\chu wah chu\Local Settings\Temporary Internet Files\Content.IE5\BIGUZXLR Trojan.Virtumod.269 Verwijderd.
css4[1] C:\Documents and Settings\chu wah chu\Local Settings\Temporary Internet Files\Content.IE5\BV09SKE7 Trojan.Virtumod.268 Verwijderd.
hctp[1] C:\Documents and Settings\chu wah chu\Local Settings\Temporary Internet Files\Content.IE5\BV09SKE7 Trojan.Click.16975 Verwijderd.
ADCFreeInstaller_nl[1].exe C:\Documents and Settings\chu wai shing\Local Settings\Temporary Internet Files\Content.IE5\38PNII8G Trojan.Winfixer Verwijderd.
GG5WSPAA.NQF C:\Program Files\ESET\infected Trojan.Virtumod.260 Verwijderd.
H0USDIBA.NQF C:\Program Files\ESET\infected Trojan.Virtumod.260 Verwijderd.
J5GFPVDA.NQF C:\Program Files\ESET\infected Trojan.Virtumod.260 Verwijderd.
A0086536.dll C:\System Volume Information\_restore{5FBFCE21-155B-4A3C-B3CD-EE5C7CB82694}\RP292 Trojan.Virtumod.269 Verwijderd.
A0086555.dll C:\System Volume Information\_restore{5FBFCE21-155B-4A3C-B3CD-EE5C7CB82694}\RP292 Trojan.Click.16975 Verwijderd.
A0087258.dll C:\System Volume Information\_restore{5FBFCE21-155B-4A3C-B3CD-EE5C7CB82694}\RP297 Trojan.Click.16975 Verwijderd.
A0087274.dll C:\System Volume Information\_restore{5FBFCE21-155B-4A3C-B3CD-EE5C7CB82694}\RP297 Trojan.Virtumod.268 Verwijderd.
gktwjfkx.dll C:\WINDOWS\system32 Trojan.Virtumod.269 Verwijderd.

Download VundoFix.exe naar je bureaublad.

• Dubbelklik VundoFix.exe om het te starten.
• Klik de Scan for Vundo knop.
• Eenmaal gedaan met scannen, klik de Remove Vundo knop.
• Je zal een melding krijgen of je de bestanden wilt laten verwijderen, klik YES
• Nadat je Yes hebt geklikt, zullen de icoontjes op je bureaublad verdwijnen tijdens het verwijderen van Vundo.
• Wanneer voltooid zal je de melding krijgen dat het je PC zal afsluiten, klik OK.
• Start je pc terug opnieuw op.
• Post de inhoud van C:\vundofix.txt en een nieuwe hijackthislog in je volgende post.

Note: Het is mogelijk dat vundofix een bestand gevonden heeft dat niet kon verwijderd worden.
In dit geval zal VundoFix na het heropstarten van je pc nog eens opstarten. Dan moet je de instructies van hierboven nog eens uitvoeren vanaf: "Click the Scan for Vundo."

VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.10

Scan started at 19:17:53 4/02/2008

Listing files found while scanning....

C:\WINDOWS\system32\atrlfnfs.dll
C:\WINDOWS\system32\awtqnmj.dll
C:\WINDOWS\system32\ddefe.ini
C:\WINDOWS\system32\ddefe.ini2
C:\WINDOWS\system32\efcdbxu.dll
C:\WINDOWS\system32\efedd.dll
C:\WINDOWS\system32\fnqekoiq.dll
C:\WINDOWS\system32\gopbyvgu.dll
C:\WINDOWS\system32\hggddec.dll
C:\WINDOWS\system32\hggecdd.dll
C:\WINDOWS\system32\mljghhf.dll
C:\WINDOWS\system32\pmnkjkj.dll
C:\WINDOWS\system32\qommlki.dll
C:\WINDOWS\system32\quarmvai.dll
C:\WINDOWS\system32\xfgernku.dll
C:\WINDOWS\system32\xxyvtqq.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\atrlfnfs.dll
C:\WINDOWS\system32\atrlfnfs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\awtqnmj.dll
C:\WINDOWS\system32\awtqnmj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddefe.ini
C:\WINDOWS\system32\ddefe.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ddefe.ini2
C:\WINDOWS\system32\ddefe.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\efcdbxu.dll
C:\WINDOWS\system32\efcdbxu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\efedd.dll
C:\WINDOWS\system32\efedd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fnqekoiq.dll
C:\WINDOWS\system32\fnqekoiq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gopbyvgu.dll
C:\WINDOWS\system32\gopbyvgu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggddec.dll
C:\WINDOWS\system32\hggddec.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\hggecdd.dll
C:\WINDOWS\system32\hggecdd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljghhf.dll
C:\WINDOWS\system32\mljghhf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnkjkj.dll
C:\WINDOWS\system32\pmnkjkj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qommlki.dll
C:\WINDOWS\system32\qommlki.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\quarmvai.dll
C:\WINDOWS\system32\quarmvai.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xfgernku.dll
C:\WINDOWS\system32\xfgernku.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xxyvtqq.dll
C:\WINDOWS\system32\xxyvtqq.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.10

Scan started at 20:08:26 4/02/2008

Listing files found while scanning....

C:\WINDOWS\system32\ffhkj.ini
C:\WINDOWS\system32\ffhkj.ini2
C:\WINDOWS\system32\hggddec.dll
C:\WINDOWS\system32\jkhff.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ffhkj.ini
C:\WINDOWS\system32\ffhkj.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ffhkj.ini2
C:\WINDOWS\system32\ffhkj.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggddec.dll
C:\WINDOWS\system32\hggddec.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\jkhff.dll
C:\WINDOWS\system32\jkhff.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\hggddec.dll
C:\WINDOWS\system32\hggddec.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:36:56, on 4/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\DOCUME~1\CHUWAH~1\LOCALS~1\Temp\84.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\chu wai shing\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.demorgen.be/?wt.bron=ipodtouch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {849A141B-1CC1-4700-9A53-92639B7E6C72} - C:\WINDOWS\system32\efedd.dll (file missing)
O2 - BHO: (no name) - {9AA57522-2ECD-47DF-BD38-20E7E577A464} - C:\WINDOWS\system32\hggddec.dll
O2 - BHO: (no name) - {B28E8AD7-0DD1-47BF-9CDB-A8A5BF840AF7} - C:\WINDOWS\system32\jkhff.dll (file missing)
O2 - BHO: {d6ff213b-d94c-4688-6954-59c6fe085e8d} - {d8e580ef-6c95-4596-8864-c49db312ff6d} - C:\WINDOWS\system32\atrlfnfs.dll (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - (no file)
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvGraphicsInterface] C:\DOCUME~1\CHUWAH~1\LOCALS~1\Temp\84.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games &#8211; Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://poemiec.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://sympatico.zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games &#8211; Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod-service (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 8275 bytes

1. Download The Avenger by Swandog46 naar je Bureaublad.

• Klik op Avenger.zip om het uit te pakken naar je bureaublad

2. Nu, start The Avenger door op het icoontje met het zwaard te dubbelklikken.

• Onder "Script file to execute" kies "Input Script Manually".
• Klik op het vergrootglas icoontje die een nieuw venster zal openen met de naam "View/edit script"
• Kopieer en plak volgend volledig vetgedrukt erin:
  
  Files to delete:
  C:\WINDOWS\system32\hggddec.dll
  
  
  
  Opgelet: Bovenstaande code werd enkel gemaakt voor deze computer/situatie/user. Indien je deze code op een andere computer gebruikt kan het schade toebrengen!
• Klik Done
• Daarna klik op het Groen verkeerslicht om het script uit te voeren
• Antwoord "Yes/Ja" wanneer daarnaar gevraagd wordt.

3. The Avenger zal daarna het volgende doen:

• Uw computer herstarten. ( In gevallen waar het script een code bevat met "Drivers to Unload", dan zal The Avenger tweemaal uw systeem herstarten)
• Na herstart, zal het vlug een zwart command window openen. Dit is normaal.
• Na herstart, zal het een log maken die zal openen met de resultaten van The Avenger. Deze log zal te vinden zijn op C:\avenger.txt
• The Avenger maakt ook backups aan met alle bestanden, etc., die eerder werden verwijderd door The Avenger, deze backups bevinden zich op volgende plaats: C:\avenger\backup.zip.

4. Kopieer en plak de inhoud van avenger.txt in je volgende post samen met een nieuw hijackthislog.

heb weeral dezelfde error