Archief - Popups met Systeem Errors

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
S

Scissor

Legacy Member
Ik heb sinds een weekje heel veel foutmeldingen, die o.a. terugverwijzen naar een site van http://bsa.safetydownload.com. Ik heb hitman pro enzo hier opstaan maar om een of andere reden kunnen zij niet updaten wegens geen connectie met het Internet te kunnen maken (net als I'explorer en firefox versies hoger dan 2.0.0.5, dat geheel terzijde).


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 0:31:29, on 4/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Guido\Desktop\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.80.97.214:8880
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {3b50351e-6ede-345b-dfb4-084ee339dbd0} - {0dbd933e-e480-4bfd-b543-ede6e15305b3} - C:\WINDOWS\system32\yqxrccck.dll
O2 - BHO: (no name) - {200D0AAD-71B1-51C9-DDB0-092BA4662A54} - C:\Program Files\Xlvmtjkp\eevcxehf.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8A61098D-612B-4EF2-943D-64E920684061} - (no file)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\jjvzzitp.dll
O4 - HKLM\..\Run: [avp] C:\WINDOWS\TEMP\win69.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [e82b7e34] rundll32.exe "C:\WINDOWS\system32\ddbogwuu.dll",b
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1183963686280
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: gosB0 - gosB0.tmp (file missing)
O20 - Winlogon Notify: jjvzzitp - C:\WINDOWS\SYSTEM32\jjvzzitp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
J

Jurgenv1

Legacy Member
1. Download dit bestand: - combofix.exe
2. Dubbelklik op combofix.exe en volg de instructies die je krijgt.
3. Wanneer het tooltje klaar is zal het een rapport maken voor je, post die log hier met een nieuw hijackthis logje.

Note:
Niet klikken terwijl combofix bezig is, dat zou het tooltje doen vastlopen!
S

Scissor

Legacy Member
Eerst dus de Combofix Log

ComboFix 08-01-04.1 - Guido 2008-01-05 2:04:41.2 - NTFSx86
Running from: C:\Documents and Settings\Guido\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users.WINDOWS\Application Data.\kbgnkhep.dll
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\Log\2008 Jan 04 - 12_46_28 AM_062.log
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\Log\2008 Jan 04 - 12_46_38 AM_421.log
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\rs.dat
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\Settings\CustomScan.stg
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\Settings\IgnoreList.stg
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\Settings\ScanInfo.stg
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\Settings\ScanResults.stg
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\Settings\SelectedFolders.stg
C:\Documents and Settings\Guido\Application Data\AntiSpywareBot\Settings\Settings.stg
C:\Program Files\SecCenter
C:\Program Files\SecCenter\scprot4.exe
C:\Program Files\Xlvmtjkp
C:\Program Files\Xlvmtjkp\eevcxehf.dll
C:\WINDOWS\system32\dmqltbrv.ini
C:\WINDOWS\system32\drvcomr.dll
C:\WINDOWS\system32\fibagbia
C:\WINDOWS\system32\fibagbia\bg1.gif
C:\WINDOWS\system32\fibagbia\bgtop.gif
C:\WINDOWS\system32\fibagbia\bottom1.gif
C:\WINDOWS\system32\fibagbia\essentials.gif
C:\WINDOWS\system32\fibagbia\fibagbia1.exe
C:\WINDOWS\system32\fibagbia\fibagbia2.exe
C:\WINDOWS\system32\fibagbia\fibagbia3.exe
C:\WINDOWS\system32\fibagbia\icon1.ico
C:\WINDOWS\system32\fibagbia\install1.gif
C:\WINDOWS\system32\fibagbia\left1.gif
C:\WINDOWS\system32\fibagbia\li.gif
C:\WINDOWS\system32\fibagbia\logo.gif
C:\WINDOWS\system32\fibagbia\main.htm
C:\WINDOWS\system32\fibagbia\mainframe.htm
C:\WINDOWS\system32\fibagbia\reinstall1.gif
C:\WINDOWS\system32\fibagbia\right1.gif
C:\WINDOWS\system32\fibagbia\s1.htm
C:\WINDOWS\system32\fibagbia\s2.htm
C:\WINDOWS\system32\fibagbia\s3.htm
C:\WINDOWS\system32\fibagbia\SMTop1.gif
C:\WINDOWS\system32\fibagbia\SMTop2.gif
C:\WINDOWS\system32\fibagbia\SMTop3.gif
C:\WINDOWS\system32\fibagbia\SMTop4.gif
C:\WINDOWS\system32\fibagbia\soft1_off.gif
C:\WINDOWS\system32\fibagbia\soft1_off_ext.gif
C:\WINDOWS\system32\fibagbia\soft1_on.gif
C:\WINDOWS\system32\fibagbia\soft1_on_ext.gif
C:\WINDOWS\system32\fibagbia\soft2_off.gif
C:\WINDOWS\system32\fibagbia\soft2_off_ext.gif
C:\WINDOWS\system32\fibagbia\soft2_on.gif
C:\WINDOWS\system32\fibagbia\soft2_on_ext.gif
C:\WINDOWS\system32\fibagbia\soft3_off.gif
C:\WINDOWS\system32\fibagbia\soft3_off_ext.gif
C:\WINDOWS\system32\fibagbia\soft3_on.gif
C:\WINDOWS\system32\fibagbia\soft3_on_ext.gif
C:\WINDOWS\system32\fibagbia\softbottom_off.gif
C:\WINDOWS\system32\fibagbia\softbottom_on.gif
C:\WINDOWS\system32\fibagbia\softleft_off.gif
C:\WINDOWS\system32\fibagbia\softleft_on.gif
C:\WINDOWS\system32\fibagbia\top1.gif
C:\WINDOWS\system32\fibagbia\top2.gif
C:\WINDOWS\system32\fibagbia\turnoff1.gif
C:\WINDOWS\system32\fibagbia\turnon1.gif
C:\WINDOWS\system32\fnbtxhmp.ini
C:\WINDOWS\system32\gklbgpwd.ini
C:\WINDOWS\system32\hjaxxhwt.ini
C:\WINDOWS\system32\mtkvdsge.ini
C:\WINDOWS\system32\ngoebdow.ini
C:\WINDOWS\system32\nraitwln.ini
C:\WINDOWS\system32\onnmp.bak1
C:\WINDOWS\system32\onnmp.ini
C:\WINDOWS\system32\pxgdlmiu.ini
C:\WINDOWS\system32\rnoginpw.ini
C:\WINDOWS\system32\srdgtqxs.ini
C:\WINDOWS\system32\tqnudxbd.dll
C:\WINDOWS\system32\tvmrfvcu.ini
C:\WINDOWS\system32\uoqqxsdf.ini
C:\WINDOWS\system32\wedeurrl.ini
C:\WINDOWS\Tasks.\AntiSpywareBot Scheduled Scan.job

.
((((((((((((((((((((((((( Files Created from 2007-12-05 to 2008-01-05 )))))))))))))))))))))))))))))))
.

2008-01-04 21:51 . 2008-01-04 21:51 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-01-04 18:02 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 01:26 . 2008-01-04 01:38 91,492 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-01-04 01:26 . 2008-01-04 01:38 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-01-04 01:24 . 2008-01-04 01:24 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-01-04 01:24 . 2008-01-04 21:52 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-01-04 01:24 . 2008-01-05 02:22 1,589,536 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-04 01:24 . 2008-01-04 21:38 16,672 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-04 01:24 . 2008-01-04 03:03 9,776 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-04 01:24 . 2008-01-04 03:03 2,012 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-04 01:11 . 2008-01-04 01:11 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2008-01-04 00:21 . 2008-01-03 23:29 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS.0\Sjablonen
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS.0\Onlangs geopend
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS.0\Netwerkprinteromgeving
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS.0\Mijn documenten
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> dr------- C:\Documents and Settings\Default User.WINDOWS.0\Menu Start
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS.0\Favorieten
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS.0\Bureaublad
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> d--h----- C:\Documents and Settings\All Users.WINDOWS.0\Sjablonen
2008-01-04 00:21 . 2008-01-03 23:38 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS.0\Menu Start
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Favorieten
2008-01-04 00:21 . 2008-01-03 23:34 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS.0\Documenten
2008-01-04 00:21 . 2008-01-04 00:21 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Bureaublad
2008-01-04 00:12 . 2008-01-04 00:12 <DIR> d-------- C:\Documents and Settings\Guido\Application Data\PC Tools
2008-01-04 00:11 . 2008-01-04 00:11 <DIR> d--h----- C:\WINDOWS\PIF
2008-01-04 00:11 . 2008-01-04 00:11 <DIR> d-------- C:\Program Files\Runtime Software
2008-01-04 00:11 . 2008-01-04 00:11 <DIR> d-------- C:\Program Files\Data Doctor Recovery Pen Drive (Demo)
2008-01-03 23:36 . 2008-01-03 23:36 <DIR> d--hs---- C:\Documents and Settings\All Users.WINDOWS.0\DRM
2008-01-03 23:31 . 2008-01-03 23:31 <DIR> d-------- C:\Program Files\Windows Plus
2008-01-03 17:54 . 2008-01-03 17:54 268 --ah----- C:\sqmdata11.sqm
2008-01-03 17:54 . 2008-01-03 17:54 244 --ah----- C:\sqmnoopt11.sqm
2007-12-21 12:34 . 2008-01-04 21:55 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-12-21 12:34 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-12-21 12:34 . 2008-01-04 14:05 74,240 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-12-21 12:34 . 2008-01-04 14:05 56,832 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-12-21 12:34 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-12-21 12:34 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-12-20 13:14 . 2008-01-04 01:36 1,089,652 ---hs---- C:\WINDOWS\system32\uuwgobdd.ini
2007-12-20 13:08 . 2008-01-05 02:15 165,472 --a------ C:\WINDOWS\system32\qhucphlm.dll
2007-12-18 20:47 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\ycxwonaf.dll
2007-12-17 20:46 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\vmrtdpim.dll
2007-12-16 20:45 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\yfkbxovv.dll
2007-12-14 15:10 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\thkdjsma.dll
2007-12-12 22:56 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\grcleqea.dll
2007-12-11 22:55 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\eokmslkg.dll
2007-12-10 22:54 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\bpqkdmdx.dll
2007-12-09 22:52 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\lddqoial.dll
2007-12-06 19:14 . 2008-01-05 02:15 80,448 --a------ C:\WINDOWS\system32\ehlugawp.dll
2007-12-05 19:14 . 2008-01-05 02:15 81,984 --a------ C:\WINDOWS\system32\jjstgtyb.dll
2007-12-05 16:21 . 2003-10-17 00:00 3,423,744 --a------ C:\WINDOWS\system32\libfilefmt-1.1.0.dll
2007-12-05 16:21 . 2003-10-17 00:00 706,048 --a------ C:\WINDOWS\system32\libmcl-3.1.1.dll
2007-12-05 16:21 . 2003-10-17 00:00 20,480 --a------ C:\WINDOWS\system32\libavi-dd-1.2.0.dll
2007-12-05 16:15 . 2007-12-05 16:15 556 --a------ C:\WINDOWS\eReg.dat
2007-12-05 16:14 . 2007-12-05 16:14 <DIR> d-------- C:\Program Files\AceGain
2007-12-05 16:10 . 2007-12-05 16:14 729,088 --a------ C:\WINDOWS\iun6002.exe
2007-12-05 15:50 . 2008-01-04 00:11 <DIR> d-------- C:\Program Files\EA GAMES

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-05 01:15 79,424 ----a-w C:\WINDOWS\system32\ioafoeui.dll
2008-01-05 01:15 77,376 ----a-w C:\WINDOWS\system32\ofwynfvw.dll
2008-01-05 01:15 36,352 ----a-w C:\WINDOWS\system32\cbxvuur.dll
2008-01-04 16:26 --------- d-----w C:\Program Files\Soulseek
2008-01-04 00:33 --------- d-----w C:\Program Files\F-Secure
2008-01-03 23:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-03 23:11 --------- d-----w C:\Program Files\Hitman Pro
2008-01-03 23:11 --------- d-----w C:\Program Files\Data Doctor Recovery Pen Drive
2007-11-26 17:28 --------- d-----w C:\Program Files\Lavasoft
2007-11-26 17:28 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2007-11-26 17:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-25 23:47 --------- d-----w C:\Program Files\Acoustica Mixcraft 3
2007-11-25 23:47 --------- d-----w C:\Documents and Settings\Guido\Application Data\Acoustica
2007-11-25 23:46 --------- d-----w C:\Program Files\VST
2007-11-25 23:46 --------- d-----w C:\Program Files\Acoustica Shared Effects
2007-11-25 23:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Acoustica
2007-11-25 23:40 --------- d-----w C:\Program Files\Acoustica Beatcraft
2007-11-25 19:49 --------- d-----w C:\Program Files\ydypmdmj
2007-11-15 01:26 --------- d-----w C:\Program Files\Skype
2007-11-14 15:00 --------- d-----w C:\Program Files\Diablo II
2007-11-14 14:58 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-11-14 14:58 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-11-14 14:58 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-11-14 13:32 --------- d-----w C:\Documents and Settings\Guido\Application Data\Skype
2007-11-13 13:06 --------- d-----w C:\Documents and Settings\Guido\Application Data\Winamp
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 00:34 --------- d-----w C:\Program Files\Common Files\Skype
2007-11-12 00:34 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Skype
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 16:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-08-12 13:49 20 ---h--w C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLec.DAT
2007-08-12 13:49 20 ---h--w C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLds.DAT
2006-05-16 12:50 35,113,704 ----a-w C:\Program Files\Common Files\directx_9c_redist.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 09:37 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avp"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51 218376]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43 8466432]
"AceGain LiveUpdate"="C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe" [ ]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24 1065800]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:56 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gosB0]
gosB0.tmp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jjvzzitp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^F-Secure Automatic Update.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\F-Secure Automatic Update.lnk
backup=C:\WINDOWS\pss\F-Secure Automatic Update.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
backup=C:\WINDOWS\pss\NkbMonitor.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 02:06 40048 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
C:\WINDOWS\TEMP\win69.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
rundll32.exe C:\WINDOWS\system32\drvcom.dll,startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-03 23:56 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
C:\Program Files\F-Secure\Common\FSM32.EXE /splash

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
C:\Program Files\F-Secure\TNB\TNBUtil.exe /CHECKALL /WAITFORSW

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kbgnkhep]
regsvr32 /u C:\Documents and Settings\All Users.WINDOWS\Application Data\kbgnkhep.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SC2]
C:\Program Files\SecCenter\scprot4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 03:00 132496 --a------ C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2007-10-10 06:28 36352 --a------ C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ydypmdmj]
rundll32.exe C:\Program Files\ydypmdmj\slqbybwz.dll,Init


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 02:22:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-05 2:29:52
ComboFix-quarantined-files.txt 2008-01-05 01:29:25
.
2008-01-04 02:02:47 --- E O F ---



Dan de Hijackthis

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 2:41:35, on 5/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Soulseek\slsk.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Guido\Desktop\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.80.97.214:8880
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1183963686280
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: gosB0 - gosB0.tmp (file missing)
O20 - Winlogon Notify: jjvzzitp - C:\WINDOWS\
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

--
End of file - 5818 bytes


Alvast bedankt voor de hulp trouwens!
J

Jurgenv1

Legacy Member
* Download OTMoveIt.exe en plaats het op je bureaublad:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

* Open OTMoveIt.exe.
In het linkerpaneel, waar het zegt: "Paste List of Files/Folders to be Moved" ,kopieer en plak onderstaand gedeelte:

C:\WINDOWS\system32\uuwgobdd.ini
C:\WINDOWS\system32\qhucphlm.dll
C:\WINDOWS\system32\ycxwonaf.dll
C:\WINDOWS\system32\vmrtdpim.dll
C:\WINDOWS\system32\yfkbxovv.dll
C:\WINDOWS\system32\thkdjsma.dll
C:\WINDOWS\system32\grcleqea.dll
C:\WINDOWS\system32\eokmslkg.dll
C:\WINDOWS\system32\bpqkdmdx.dll
C:\WINDOWS\system32\lddqoial.dll
C:\WINDOWS\system32\ehlugawp.dll
C:\WINDOWS\system32\jjstgtyb.dll
C:\WINDOWS\system32\ioafoeui.dll
C:\WINDOWS\system32\ofwynfvw.dll
C:\WINDOWS\system32\cbxvuur.dll
C:\Program Files\ydypmdmj

Daarna klik de MoveIt knop onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in volgende map: C:\_OTMoveIt\MovedFiles.
Kopieer en plak de inhoud van die log in je volgende post.
S

Scissor

Legacy Member
Hier de log:

File/Folder not found.
C:\WINDOWS\system32\uuwgobdd.ini moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\qhucphlm.dll
C:\WINDOWS\system32\qhucphlm.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\qhucphlm.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\ycxwonaf.dll
C:\WINDOWS\system32\ycxwonaf.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ycxwonaf.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\vmrtdpim.dll
C:\WINDOWS\system32\vmrtdpim.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\vmrtdpim.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\yfkbxovv.dll
C:\WINDOWS\system32\yfkbxovv.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\yfkbxovv.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\thkdjsma.dll
C:\WINDOWS\system32\thkdjsma.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\thkdjsma.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\grcleqea.dll
C:\WINDOWS\system32\grcleqea.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\grcleqea.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\eokmslkg.dll
C:\WINDOWS\system32\eokmslkg.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\eokmslkg.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\bpqkdmdx.dll
C:\WINDOWS\system32\bpqkdmdx.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\bpqkdmdx.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\lddqoial.dll
C:\WINDOWS\system32\lddqoial.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\lddqoial.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\ehlugawp.dll
C:\WINDOWS\system32\ehlugawp.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ehlugawp.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\jjstgtyb.dll
C:\WINDOWS\system32\jjstgtyb.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\jjstgtyb.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\ioafoeui.dll
C:\WINDOWS\system32\ioafoeui.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ioafoeui.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\ofwynfvw.dll
C:\WINDOWS\system32\ofwynfvw.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\ofwynfvw.dll scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\cbxvuur.dll
C:\WINDOWS\system32\cbxvuur.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\cbxvuur.dll scheduled to be moved on reboot.
C:\Program Files\ydypmdmj moved successfully.

Created on 01/05/2008 15:33:16
S

Scissor

Legacy Member
Start Time= zo 06/01/2008 18:18:41,54

QuickScan did not find any signs of infected files

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2008-01-05 15:33:24 165472 ( A.... ) "C:\WINDOWS\system32\qhucphlm.dll"
2008-01-05 15:33:24 81984 ( A.... ) "C:\WINDOWS\system32\jjstgtyb.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\yfkbxovv.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\ycxwonaf.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\vmrtdpim.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\thkdjsma.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\lddqoial.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\grcleqea.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\eokmslkg.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\ehlugawp.dll"
2008-01-05 15:33:24 80448 ( A.... ) "C:\WINDOWS\system32\bpqkdmdx.dll"
2008-01-05 15:33:24 79424 ( A.... ) "C:\WINDOWS\system32\ioafoeui.dll"
2008-01-05 15:33:24 77376 ( A.... ) "C:\WINDOWS\system32\ofwynfvw.dll"
2008-01-05 15:33:24 36352 ( A.... ) "C:\WINDOWS\system32\cbxvuur.dll"
2008-01-04 01:24:50 ( .D... ) "C:\Program Files\Kaspersky Lab"
2008-01-04 00:12:10 ( .D... ) "C:\Documents and Settings\Guido\Application Data\PC Tools"
2008-01-04 00:11:20 ( .D... ) "C:\Program Files\Runtime Software"
2008-01-04 00:11:20 ( .D... ) "C:\Program Files\Data Doctor Recovery Pen Drive (Demo)"
2008-01-03 23:31:18 ( .D... ) "C:\Program Files\Windows Plus"
2007-12-21 12:34:24 ( .D... ) "C:\Program Files\Spyware Doctor"
2007-12-05 16:14:38 ( .D... ) "C:\Program Files\AceGain"
2007-12-05 16:14:20 729088 ( A.... ) "C:\WINDOWS\iun6002.exe"
2007-12-05 15:50:02 ( .D... ) "C:\Program Files\EA GAMES"
2007-12-03 00:00:06 18684536 ( A.... ) "C:\WINDOWS\system32\MRT.exe"
2007-12-02 22:31:00 ( .D... ) "C:\Program Files\Data Doctor Recovery Pen Drive"
2007-11-26 18:28:28 ( .D... ) "C:\Program Files\Lavasoft"
2007-11-26 18:27:58 ( .D... ) "C:\Program Files\Common Files\Wise Installation Wizard"
2007-11-26 00:47:32 ( .D... ) "C:\Documents and Settings\Guido\Application Data\Acoustica"
2007-11-26 00:46:38 ( .D... ) "C:\Program Files\VST"
2007-11-26 00:37:40 ( .D... ) "C:\Program Files\Acoustica Shared Effects"
2007-11-25 22:25:56 ( .D... ) "C:\Program Files\Hitman Pro"
2007-11-25 21:18:50 ( .D... ) "C:\Program Files\Acoustica Beatcraft"
2007-11-25 21:07:32 ( .D... ) "C:\Program Files\Acoustica Mixcraft 3"
2007-11-14 15:58:54 21840 ( A.... ) "C:\WINDOWS\system32\SIntfNT.dll"
2007-11-14 15:58:54 17212 ( A.... ) "C:\WINDOWS\system32\SIntf32.dll"
2007-11-14 15:58:54 12067 ( A.... ) "C:\WINDOWS\system32\SIntf16.dll"
2007-11-14 15:47:58 ( .D... ) "C:\Program Files\Diablo II"
2007-11-13 12:31:12 60416 ( ..... ) "C:\WINDOWS\system32\tzchange.exe"
2007-11-12 01:35:46 ( .D... ) "C:\Documents and Settings\Guido\Application Data\Skype"
2007-11-12 01:34:50 ( .D... ) "C:\Program Files\Skype"
2007-11-12 01:34:50 ( .D... ) "C:\Program Files\Common Files\Skype"
2007-10-31 00:42:28 3590656 ( A.... ) "C:\WINDOWS\system32\mshtml.dll"
2007-10-29 23:43:04 1287680 ( A.... ) "C:\WINDOWS\system32\quartz.dll"
2007-10-29 11:04:04 350720 ( A.... ) "C:\WINDOWS\system32\xpsp3res.dll"
2007-10-27 17:40:06 227328 ( A.... ) "C:\WINDOWS\system32\wmasf.dll"
2007-10-26 04:34:02 8460288 ( A.... ) "C:\WINDOWS\system32\shell32.dll"
2007-10-11 00:56:00 1159680 ( A.... ) "C:\WINDOWS\system32\urlmon.dll"
2007-10-11 00:56:00 824832 ( A.... ) "C:\WINDOWS\system32\wininet.dll"
2007-10-11 00:56:00 671232 ( A.... ) "C:\WINDOWS\system32\mstime.dll"
2007-10-11 00:56:00 232960 ( A.... ) "C:\WINDOWS\system32\webcheck.dll"
2007-10-11 00:56:00 105984 ( A.... ) "C:\WINDOWS\system32\url.dll"
2007-10-11 00:56:00 102400 ( A.... ) "C:\WINDOWS\system32\occache.dll"
2007-10-11 00:55:58 478208 ( A.... ) "C:\WINDOWS\system32\mshtmled.dll"
2007-10-11 00:55:58 193024 ( A.... ) "C:\WINDOWS\system32\msrating.dll"
2007-10-11 00:55:56 459264 ( A.... ) "C:\WINDOWS\system32\msfeeds.dll"
2007-10-11 00:55:56 267776 ( A.... ) "C:\WINDOWS\system32\iertutil.dll"
2007-10-11 00:55:56 52224 ( A.... ) "C:\WINDOWS\system32\msfeedsbs.dll"
2007-10-11 00:55:56 44544 ( A.... ) "C:\WINDOWS\system32\iernonce.dll"
2007-10-11 00:55:56 27648 ( A.... ) "C:\WINDOWS\system32\jsproxy.dll"
2007-10-11 00:55:54 6065664 ( A.... ) "C:\WINDOWS\system32\ieframe.dll"
2007-10-11 00:55:52 384512 ( A.... ) "C:\WINDOWS\system32\iedkcs32.dll"
2007-10-11 00:55:52 383488 ( A.... ) "C:\WINDOWS\system32\ieapfltr.dll"
2007-10-11 00:55:52 230400 ( A.... ) "C:\WINDOWS\system32\ieaksie.dll"
2007-10-11 00:55:52 214528 ( A.... ) "C:\WINDOWS\system32\dxtrans.dll"
2007-10-11 00:55:52 153088 ( A.... ) "C:\WINDOWS\system32\ieakeng.dll"
2007-10-11 00:55:52 132608 ( A.... ) "C:\WINDOWS\system32\extmgr.dll"
2007-10-11 00:55:52 124928 ( A.... ) "C:\WINDOWS\system32\advpack.dll"
2007-10-11 00:55:52 63488 ( A.... ) "C:\WINDOWS\system32\icardie.dll"
2007-10-10 11:59:40 70656 ( A.... ) "C:\WINDOWS\system32\ie4uinit.exe"
2007-10-10 11:59:40 13824 ( A.... ) "C:\WINDOWS\system32\ieudinit.exe"
2007-10-10 06:46:56 161792 ( A.... ) "C:\WINDOWS\system32\ieakui.dll"


((((((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"avp"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"AceGain LiveUpdate"="C:\\Program Files\\AceGain\\LiveUpdate\\LiveUpdate.exe"
"SDTray"="\"C:\\Program Files\\Spyware Doctor\\SDTrayApp.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveAutoRun"=dword:03ffffff
"NoDriveTypeAutoRun"=dword:000000ff

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"AdobeUpdater"="C:\\Program Files\\Common Files\\Adobe\\Updater5\\AdobeUpdater.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^F-Secure Automatic Update.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\F-Secure Automatic Update.lnk"
"backup"="C:\\WINDOWS\\pss\\F-Secure Automatic Update.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\F-Secure\\BackWeb\\7681197\\program\\F-SECU~1.EXE -startup"
"item"="F-Secure Automatic Update"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
"path"="C:\\Documents and Settings\\All Users.WINDOWS\\Start Menu\\Programs\\Startup\\NkbMonitor.exe.lnk"
"backup"="C:\\WINDOWS\\pss\\NkbMonitor.exe.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Nikon\\PICTUR~1\\NKBMON~1.EXE "
"item"="NkbMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Reader_sl"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="win69"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\TEMP\\win69.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="drvcom"
"hkey"="HKLM"
"command"="rundll32.exe C:\\WINDOWS\\system32\\drvcom.dll,startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ctfmon"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\system32\\ctfmon.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="daemon"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="FSM32"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\F-Secure\\Common\\FSM32.EXE\" /splash"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TNBUtil"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\F-Secure\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kbgnkhep]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="kbgnkhep"
"hkey"="HKLM"
"command"="regsvr32 /u \"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\kbgnkhep.dll\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsnMsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvMcTray"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SC2]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="scprot4"
"hkey"="HKLM"
"command"="C:\\Program Files\\SecCenter\\scprot4.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.6.0_02\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Winamp\\winampa.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ydypmdmj]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="slqbybwz"
"hkey"="HKLM"
"command"="rundll32.exe \"C:\\Program Files\\ydypmdmj\\slqbybwz.dll\",Init"
"inimapping"="0"


Contents of the 'Scheduled Tasks' folder

Completion time: zo 06/01/2008 18:20:50,17
ComboFix ver 06.06.17 - This logfile is located at C:\ComboFix.txt
J

Jurgenv1

Legacy Member
* Download OTMoveIt.exe en plaats het op je bureaublad:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

* Open OTMoveIt.exe.
In het linkerpaneel, waar het zegt: "Paste List of Files/Folders to be Moved" ,kopieer en plak onderstaand gedeelte:

C:\WINDOWS\system32\qhucphlm.dll
C:\WINDOWS\system32\jjstgtyb.dll
C:\WINDOWS\system32\yfkbxovv.dll
C:\WINDOWS\system32\ycxwonaf.dll
C:\WINDOWS\system32\vmrtdpim.dll
C:\WINDOWS\system32\thkdjsma.dll
C:\WINDOWS\system32\lddqoial.dll
C:\WINDOWS\system32\grcleqea.dll
C:\WINDOWS\system32\eokmslkg.dll
C:\WINDOWS\system32\ehlugawp.dll
C:\WINDOWS\system32\bpqkdmdx.dll
C:\WINDOWS\system32\ioafoeui.dll
C:\WINDOWS\system32\ofwynfvw.dll
C:\WINDOWS\system32\cbxvuur.dll

Daarna klik de MoveIt knop onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in volgende map: C:\_OTMoveIt\MovedFiles.
Kopieer en plak de inhoud van die log in je volgende post met een nieuw hijackthis logje.
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan