Archief - Trojan.Vundo

Yu

Ik zit met een Trojan Horse op m'n pc (zie titel thread)
en weet niet echt hoe deze te verwijderen. Ik heb nog niets verwijderd, dit is de laatste logfile die HijackThis heeft aangemaakt.

Mocht je tijd hebben, wil je eens kijken wat ik moet doen?

Alvast bedankt !!!

greetz

Logfile of HijackThis v1.99.1
Scan saved at 11:38:42, on 31/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\rcmtnrkw.dll",forkonce
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Administrator\Local Settings\Temp\{CD006470-7D99-415A-92C5-7E84B896E64F}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C7933DF-6A45-435A-BD93-5113C95B4375}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

COMBOFIX LOG FILE:
ComboFix 07-07-30.2 - "Administrator" 2007-07-31 14:42:43.1 [GMT 2:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.Waar


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\wxppkmwx.dll
C:\WINDOWS\system32\wintfj32.dll
C:\WINDOWS\system32\cfhkj.bak1
C:\WINDOWS\system32\cfhkj.bak2
C:\WINDOWS\system32\cfhkj.ini
C:\WINDOWS\system32\cfhkj.bak1
C:\WINDOWS\system32\cfhkj.bak2
C:\WINDOWS\system32\cfhkj.ini
C:\WINDOWS\system32\jkhfc.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-31 )))))))))))))))))))))))))))))))


2007-07-31 14:41 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-31 11:36 125,504 --a------ C:\WINDOWS\system32\rcmtnrkw.dll
2007-07-30 18:33 66,112 --a------ C:\WINDOWS\system32\niwusmmk.exe
2007-07-29 14:09 66,112 --a------ C:\WINDOWS\system32\pkbkbdkx.exe
2007-07-29 13:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Shared
2007-07-29 13:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Incomplete
2007-07-29 13:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\LimeWire
2007-07-29 13:08 <DIR> d-------- C:\Program Files\LimeWire
2007-07-29 13:04 66,112 --a------ C:\WINDOWS\system32\ksblkufn.exe
2007-07-28 11:49 66,112 --a------ C:\WINDOWS\system32\mplihqui.exe
2007-07-05 22:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\pdf995
2007-07-05 22:07 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2007-07-05 22:07 118,784 --a------ C:\WINDOWS\system32\pdfmona.dll
2007-07-05 22:07 <DIR> d-------- C:\Program Files\pdf995
2007-07-05 22:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\pdf995
2007-07-05 16:08 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-07-05 15:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Atari
2007-07-05 15:25 197,120 --a------ C:\WINDOWS\patchw32.dll
2007-07-05 15:25 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
2007-07-05 15:25 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Leadertech
2007-07-05 15:20 <DIR> d-------- C:\Program Files\Atari
2007-07-05 15:15 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2007-07-05 15:15 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2007-07-05 15:14 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-07-05 15:14 <DIR> d-------- C:\Program Files\D-Tools
2007-07-04 18:28 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft Games
2007-07-04 13:12 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe
2007-07-04 13:12 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll
2007-07-04 13:12 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll
2007-07-04 13:12 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll
2007-07-04 13:12 194,320 --a------ C:\WINDOWS\system32\qcut.dll
2007-07-04 13:12 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll
2007-07-04 13:12 10,240 --a------ C:\WINDOWS\system32\vidx16.dll
2007-07-04 13:10 <DIR> d-------- C:\Program Files\Sierra On-Line
2007-07-03 20:07 31,254 --------- C:\WINDOWS\system32\nnnmjif.dll
2007-07-03 18:04 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-03 17:58 <DIR> d-------- C:\Program Files\KONAMI
2007-07-03 17:42 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2007-07-03 17:42 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2007-07-03 17:42 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-06-25 12:53 <DIR> d-------- C:\Program Files\Common Files\Macromedia Shared
2007-06-25 12:52 <DIR> d-------- C:\Program Files\WinSCP3
2007-06-18 16:29 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Help
2007-06-18 13:44 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-06-18 13:44 <DIR> d-------- C:\NVIDIA
2007-06-18 13:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-06-18 12:19 98,064 --a------ C:\WINDOWS\system32\Dunzip32.dll
2007-06-18 12:19 89,360 --a------ C:\WINDOWS\system32\Vb5db.dll
2007-06-18 12:19 803,680 --a------ C:\WINDOWS\system32\Axdist.exe
2007-06-18 12:19 7,168 --a------ C:\WINDOWS\system32\Dtctrace.dll
2007-06-18 12:19 57,856 --a------ C:\WINDOWS\system32\Adme.dll
2007-06-18 12:19 509,280 --a------ C:\WINDOWS\system32\Wint351.exe
2007-06-18 12:19 48,128 --a------ C:\WINDOWS\system32\Dtcutil.dll
2007-06-18 12:19 430,080 --a------ C:\WINDOWS\system32\MSREPL35.DLL
2007-06-18 12:19 385,024 --a------ C:\WINDOWS\system32\VBAR332.DLL
2007-06-18 12:19 36,864 --a------ C:\WINDOWS\system32\MSJTER35.DLL
2007-06-18 12:19 294,912 --a------ C:\WINDOWS\system32\MSXBSE35.DLL
2007-06-18 12:19 262,144 --a------ C:\WINDOWS\system32\MSRD2X35.DLL
2007-06-18 12:19 194,048 --a------ C:\WINDOWS\system32\Dtccm.dll
2007-06-18 12:19 139,264 --a------ C:\WINDOWS\system32\MSJINT35.DLL
2007-06-18 12:19 130,320 --a------ C:\WINDOWS\system32\Dzip32.dll
2007-06-18 12:19 114,688 --a------ C:\WINDOWS\system32\Dzactx.dll
2007-06-18 12:19 110,592 --a------ C:\WINDOWS\system32\Duzactx.dll
2007-06-18 12:19 1,056,768 --a------ C:\WINDOWS\system32\MSJET35.DLL
2007-06-18 12:19 1,015,808 --a------ C:\WINDOWS\system32\actrpt.dll
2007-06-18 12:19 <DIR> d-------- C:\Program Files\ING
2007-06-12 12:22 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-06-12 12:21 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-06-12 01:13 <DIR> d-------- C:\WINDOWS\Prefetch
2007-06-12 00:55 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-06-12 00:54 <DIR> d-------- C:\Program Files\messenger
2007-06-12 00:53 <DIR> d-------- C:\WINDOWS\provisioning
2007-06-12 00:53 <DIR> d-------- C:\WINDOWS\peernet
2007-06-12 00:49 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-06-12 00:41 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-06-12 00:37 <DIR> d-------- C:\WINDOWS\EHome
2007-06-12 00:20 <DIR> d-------- C:\Program Files\Gabest
2007-06-12 00:20 <DIR> d-------- C:\Program Files\ffdshow
2007-06-12 00:20 <DIR> d-------- C:\Program Files\AC3Filter
2007-06-11 20:25 4,569 --------- C:\WINDOWS\system32\secupd.dat
2007-06-11 20:25 11,776 --------- C:\WINDOWS\system32\spnpinst.exe
2007-06-11 19:25 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-06-11 19:25 66,560 --a------ C:\WINDOWS\system32\mtxclu.dll
2007-06-11 19:25 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2007-06-11 19:25 581,120 --a------ C:\WINDOWS\system32\rpcrt4.dll
2007-06-11 19:25 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2007-06-11 19:25 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-06-11 19:25 243,200 --a------ C:\WINDOWS\system32\es.dll
2007-06-11 19:25 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-06-11 19:25 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-06-11 19:24 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-06-11 19:24 77,312 --a------ C:\WINDOWS\system32\browser.dll
2007-06-11 19:24 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-06-11 19:24 614,912 --a------ C:\WINDOWS\system32\h323msp.dll
2007-06-11 19:24 40,960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-06-11 19:24 397,824 --a------ C:\WINDOWS\system32\rpcss.dll
2007-06-11 19:24 332,288 --a------ C:\WINDOWS\system32\ipnathlp.dll
2007-06-11 19:24 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2007-06-11 19:24 101,376 --a------ C:\WINDOWS\system32\txflog.dll
2007-06-11 19:24 1,284,608 --a------ C:\WINDOWS\system32\ole32.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-03 16:47 12464 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-06-12 18:01 53622 --a------ C:\WINDOWS\system32\perfc013.dat
2007-06-12 18:01 364660 --a------ C:\WINDOWS\system32\perfh013.dat


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8BF884A4-CF81-4E00-B7C1-076FCE6CFDD7}]
2007-07-03 20:07 31254 --------- C:\WINDOWS\system32\nnnmjif.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NAV Agent"="C:\PROGRA~1\NORTON~1\navapw32.exe" [2002-03-05 12:02]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2001-10-03 10:09]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-06-10 17:24]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:03]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{8BF884A4-CF81-4E00-B7C1-076FCE6CFDD7}"= C:\WINDOWS\system32\nnnmjif.dll [2007-07-03 20:07 31254]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnmjif]
nnnmjif.dll 2007-07-03 20:07 31254 C:\WINDOWS\system32\nnnmjif.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

R3 alcan5wn;Alcatel SpeedTouch USB ADSL PPP Networking Driver (NDISWAN);C:\WINDOWS\system32\DRIVERS\alcan5wn.sys
R3 alcaudsl;Alcatel Speed Touch ADSL Modem ATM Transport;C:\WINDOWS\system32\DRIVERS\alcaudsl.sys
R3 ctljystk;Creative SB Live!-spelpoort;C:\WINDOWS\system32\DRIVERS\ctljystk.sys
R3 NAVAP;NAVAP;\??\C:\WINDOWS\System32\Drivers\NAVAP.SYS
S3 FETNDIS;VIA Rhine Family Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\fetnd5b.sys
S3 NTSIM;NTSIM;\??\C:\WINDOWS\System32\ntsim.sys


Contents of the 'Scheduled Tasks' folder
2007-07-31 12:49:28 C:\WINDOWS\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
2007-07-28 10:20:06 C:\WINDOWS\Tasks\WebReg psc 2350 series.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 14:50:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-31 14:56:36 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-31 14:56

--- E O F ---


-
--
---
---- HIJACK LOG FILE
Logfile of HijackThis v1.99.1
Scan saved at 15:14:30, on 31/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8BF884A4-CF81-4E00-B7C1-076FCE6CFDD7} - C:\WINDOWS\system32\nnnmjif.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Administrator\Local Settings\Temp\{CD006470-7D99-415A-92C5-7E84B896E64F}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C7933DF-6A45-435A-BD93-5113C95B4375}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: nnnmjif - C:\WINDOWS\SYSTEM32\nnnmjif.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

C:\WINDOWS\system32\rcmtnrkw.dll
C:\WINDOWS\system32\niwusmmk.exe
C:\WINDOWS\system32\pkbkbdkx.exe
C:\WINDOWS\system32\ksblkufn.exe
C:\WINDOWS\system32\mplihqui.exe
C:\WINDOWS\system32\nnnmjif.dll

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje.

OTMoveIt - LOG FILE

DllUnregisterServer procedure not found in C:\WINDOWS\system32\rcmtnrkw.dll
C:\WINDOWS\system32\rcmtnrkw.dll NOT unregistered.
C:\WINDOWS\system32\rcmtnrkw.dll moved successfully.
File move failed. C:\WINDOWS\system32\niwusmmk.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\system32\pkbkbdkx.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\system32\ksblkufn.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\system32\mplihqui.exe scheduled to be moved on reboot.
LoadLibrary failed for C:\WINDOWS\system32\nnnmjif.dll
C:\WINDOWS\system32\nnnmjif.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\nnnmjif.dll scheduled to be moved on reboot.

Created on 08/01/2007 14:49:45

HIJACK LOG FILE:
Logfile of HijackThis v1.99.1
Scan saved at 14:57:16, on 1/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\Administrator\Bureaublad\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Administrator\Local Settings\Temp\{CD006470-7D99-415A-92C5-7E84B896E64F}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

ps, nu kan ik op "fix checked" klikken in dat hijack programma'tje

Ok, kan ik een nieuw logje van combofix zien?

ComboFix 07-07-30.2 - "Administrator" 2007-08-02 1:12:12.2 [GMT 2:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.32.1043.18.Waar


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\dowkhnas.dll
C:\WINDOWS\system32\xbadd.bak1
C:\WINDOWS\system32\xbadd.bak2
C:\WINDOWS\system32\xbadd.ini
C:\WINDOWS\system32\ddabx.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((( Files Created from 2007-07-01 to 2007-08-01 )))))))))))))))))))))))))))))))


2007-08-01 21:37 125,504 --a------ C:\WINDOWS\system32\ajepjadh.dll
2007-07-31 14:41 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-30 18:33 66,112 --a------ C:\WINDOWS\system32\niwusmmk.exe
2007-07-29 14:09 66,112 --a------ C:\WINDOWS\system32\pkbkbdkx.exe
2007-07-29 13:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Shared
2007-07-29 13:16 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Incomplete
2007-07-29 13:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\LimeWire
2007-07-29 13:08 <DIR> d-------- C:\Program Files\LimeWire
2007-07-29 13:04 66,112 --a------ C:\WINDOWS\system32\ksblkufn.exe
2007-07-28 11:49 66,112 --a------ C:\WINDOWS\system32\mplihqui.exe
2007-07-05 22:09 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\pdf995
2007-07-05 22:07 51,716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2007-07-05 22:07 118,784 --a------ C:\WINDOWS\system32\pdfmona.dll
2007-07-05 22:07 <DIR> d-------- C:\Program Files\pdf995
2007-07-05 22:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\pdf995
2007-07-05 16:08 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-07-05 15:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Atari
2007-07-05 15:25 197,120 --a------ C:\WINDOWS\patchw32.dll
2007-07-05 15:25 <DIR> d-------- C:\Program Files\Common Files\PocketSoft
2007-07-05 15:25 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Leadertech
2007-07-05 15:20 <DIR> d-------- C:\Program Files\Atari
2007-07-05 15:15 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2007-07-05 15:15 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2007-07-05 15:14 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-07-05 15:14 <DIR> d-------- C:\Program Files\D-Tools
2007-07-04 18:28 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft Games
2007-07-04 13:12 63,488 --a------ C:\WINDOWS\system32\unam4ie.exe
2007-07-04 13:12 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll
2007-07-04 13:12 38,160 --a------ C:\WINDOWS\system32\LMRTREND.dll
2007-07-04 13:12 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll
2007-07-04 13:12 194,320 --a------ C:\WINDOWS\system32\qcut.dll
2007-07-04 13:12 182,032 --a------ C:\WINDOWS\system32\dxtmsft3.dll
2007-07-04 13:12 10,240 --a------ C:\WINDOWS\system32\vidx16.dll
2007-07-04 13:10 <DIR> d-------- C:\Program Files\Sierra On-Line
2007-07-03 20:07 31,254 --------- C:\WINDOWS\system32\nnnmjif.dll
2007-07-03 18:04 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-03 17:58 <DIR> d-------- C:\Program Files\KONAMI
2007-07-03 17:42 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2007-07-03 17:42 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2007-07-03 17:42 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-30 23:21 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-05 12:03 --------- d-------- C:\Program Files\Steam
2007-07-03 16:47 12464 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-06-25 12:53 --------- d-------- C:\Program Files\Common Files\Macromedia Shared
2007-06-25 12:52 --------- d-------- C:\Program Files\WinSCP3
2007-06-18 16:29 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Help
2007-06-18 12:19 --------- d-------- C:\Program Files\ING
2007-06-12 23:45 --------- d-------- C:\Program Files\MSN Messenger
2007-06-12 18:01 53622 --a------ C:\WINDOWS\system32\perfc013.dat
2007-06-12 18:01 364660 --a------ C:\WINDOWS\system32\perfh013.dat
2007-06-12 17:35 --------- d-------- C:\Program Files\messenger
2007-06-12 00:53 --------- d-------- C:\Program Files\Movie Maker
2007-06-12 00:48 --------- d-------- C:\Program Files\Windows NT
2007-06-12 00:20 --------- d-------- C:\Program Files\Gabest
2007-06-12 00:20 --------- d-------- C:\Program Files\ffdshow
2007-06-12 00:20 --------- d-------- C:\Program Files\AC3Filter
2007-06-11 20:49 1416 --a------ C:\WINDOWS\mozver.dat
2007-06-11 14:20 --------- d-------- C:\Program Files\Microsoft.NET
2007-06-11 14:19 --------- d-------- C:\Program Files\Microsoft Works
2007-06-11 12:25 --------- d--h----- C:\Program Files\WindowsUpdate
2007-06-10 23:49 --------- d-------- C:\Program Files\Lavasoft
2007-06-10 23:49 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-10 17:24 --------- d-------- C:\Program Files\SymNetDrv
2007-06-10 17:24 --------- d-------- C:\Program Files\Symantec
2007-06-10 17:23 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-06-10 09:40 --------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-06-10 09:33 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-06-10 03:01 69772 --a------ C:\WINDOWS\hpoins05.dat
2007-06-10 02:55 --------- d-------- C:\Program Files\HP
2007-06-10 02:55 --------- d-------- C:\Program Files\Common Files\HP
2007-06-10 02:54 --------- d-------- C:\Program Files\Hewlett-Packard
2007-06-10 02:53 --------- d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-06-10 02:00 640 --a------ C:\WINDOWS\eReg.dat
2007-06-10 02:00 --------- d-------- C:\Program Files\directx
2007-06-10 01:45 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\MSN6
2007-06-10 01:44 --------- d-------- C:\Program Files\IrfanView
2007-06-10 01:43 --------- d-------- C:\Program Files\Winamp
2007-06-10 01:24 0 --a------ C:\WINDOWS\nsreg.dat
2007-06-10 01:22 --------- d-------- C:\Program Files\Norton AntiVirus
2007-06-10 01:11 --------- d-------- C:\Program Files\Alcatel
2007-06-10 01:08 --------- d-------- C:\Program Files\VIA Technologies, Inc
2007-06-10 00:52 --------- d-------- C:\Program Files\Ahead
2007-06-10 00:48 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
2007-06-09 19:14 --------- d-------- C:\Program Files\microsoft frontpage
2007-06-09 19:13 0 -rahs---- C:\MSDOS.SYS
2007-06-09 19:13 0 -rahs---- C:\IO.SYS
2007-06-09 19:13 0 --a------ C:\CONFIG.SYS
2007-06-09 19:13 0 --a------ C:\AUTOEXEC.BAT
2007-06-09 19:11 --------- d-------- C:\Program Files\Common Files\MSSoap
2007-06-09 19:10 21748 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-06-09 19:10 --------- d-------- C:\Program Files\Online Services
2007-06-09 19:10 --------- d-------- C:\Program Files\MSN Gaming Zone
2007-06-09 18:18 --------- d-------- C:\Program Files\Common Files\SpeechEngines
2007-06-09 18:18 --------- d-------- C:\Program Files\Common Files\ODBC
2007-06-04 15:18 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 15:17 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 15:14 6272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-05-16 17:19 683520 --a------ C:\WINDOWS\system32\inetcomm.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8BF884A4-CF81-4E00-B7C1-076FCE6CFDD7}]
2007-07-03 20:07 31254 --------- C:\WINDOWS\system32\nnnmjif.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NAV Agent"="C:\PROGRA~1\NORTON~1\navapw32.exe" [2002-03-05 12:02]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2001-10-03 10:09]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-06-10 17:24]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:03]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{8BF884A4-CF81-4E00-B7C1-076FCE6CFDD7}"= C:\WINDOWS\system32\nnnmjif.dll [2007-07-03 20:07 31254]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnmjif]
nnnmjif.dll 2007-07-03 20:07 31254 C:\WINDOWS\system32\nnnmjif.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

R3 alcan5wn;Alcatel SpeedTouch USB ADSL PPP Networking Driver (NDISWAN);C:\WINDOWS\system32\DRIVERS\alcan5wn.sys
R3 alcaudsl;Alcatel Speed Touch ADSL Modem ATM Transport;C:\WINDOWS\system32\DRIVERS\alcaudsl.sys
R3 ctljystk;Creative SB Live!-spelpoort;C:\WINDOWS\system32\DRIVERS\ctljystk.sys
R3 NAVAP;NAVAP;\??\C:\WINDOWS\System32\Drivers\NAVAP.SYS
S3 FETNDIS;VIA Rhine Family Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\fetnd5b.sys
S3 NTSIM;NTSIM;\??\C:\WINDOWS\System32\ntsim.sys


Contents of the 'Scheduled Tasks' folder
2007-08-01 23:19:04 C:\WINDOWS\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
2007-07-28 10:20:06 C:\WINDOWS\Tasks\WebReg psc 2350 series.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-02 01:20:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-02 1:26:28 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-02 01:26
C:\ComboFix2.txt ... 2007-07-31 14:56

--- E O F ---

Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

C:\WINDOWS\system32\ajepjadh.dll
C:\WINDOWS\system32\niwusmmk.exe
C:\WINDOWS\system32\pkbkbdkx.exe
C:\WINDOWS\system32\ksblkufn.exe
C:\WINDOWS\system32\mplihqui.exe

Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje.

OTMoveIt LOG FILE

DllUnregisterServer procedure not found in C:\WINDOWS\system32\ajepjadh.dll
C:\WINDOWS\system32\ajepjadh.dll NOT unregistered.
C:\WINDOWS\system32\ajepjadh.dll moved successfully.
File move failed. C:\WINDOWS\system32\niwusmmk.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\system32\pkbkbdkx.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\system32\ksblkufn.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\system32\mplihqui.exe scheduled to be moved on reboot.

Created on 08/02/2007 18:21:47



Logfile of HijackThis v1.99.1
Scan saved at 18:29:04, on 2/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8BF884A4-CF81-4E00-B7C1-076FCE6CFDD7} - C:\WINDOWS\system32\nnnmjif.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Administrator\Local Settings\Temp\{CD006470-7D99-415A-92C5-7E84B896E64F}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C7933DF-6A45-435A-BD93-5113C95B4375}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: nnnmjif - C:\WINDOWS\SYSTEM32\nnnmjif.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Kan je deze ook nog eens moven?

C:\WINDOWS\system32\nnnmjif.dll

dan zegt ie 't volgende:

LoadLibrary failed for C:\WINDOWS\system32\nnnmjif.dll
C:\WINDOWS\system32\nnnmjif.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\nnnmjif.dll scheduled to be moved on reboot.

Created on 08/03/2007 00:26:45

Ok herstart je pc en post een nieuw hijackthis logje hier.

Logfile of HijackThis v1.99.1
Scan saved at 13:26:48, on 4/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Documents and Settings\Administrator\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = C:\Documents and Settings\Administrator\Local Settings\Temp\{CD006470-7D99-415A-92C5-7E84B896E64F}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C7933DF-6A45-435A-BD93-5113C95B4375}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

Ziet er goed uit, hoe werkt alles verder?

nog altijd:
Trojan.vundo...

djuu

Download VundoFix.exe naar je bureaublad.

• Dubbelklik VundoFix.exe om het te starten.
• Klik de Scan for Vundo knop.
• Eenmaal gedaan met scannen, klik de Remove Vundo knop.
• Je zal een melding krijgen of je de bestanden wilt laten verwijderen, klik YES
• Nadat je Yes hebt geklikt, zullen de icoontjes op je bureaublad verdwijnen tijdens het verwijderen van Vundo.
• Wanneer voltooid zal je de melding krijgen dat het je PC zal afsluiten, klik OK.
• Start je pc terug opnieuw op.
• Post de inhoud van C:\vundofix.txt en een nieuwe hijackthislog in je volgende post.

Note: Het is mogelijk dat vundofix een bestand gevonden heeft dat niet kon verwijderd worden.
In dit geval zal VundoFix na het heropstarten van je pc nog eens opstarten. Dan moet je de instructies van hierboven nog eens uitvoeren vanaf: "Click the Scan for Vundo."

gjkmp.dll
nnnmjif.dll
pmkjg.dll

Deze drie bestanden kan hij aan geen kanten verwijderen...

Kan je het logje eens hier posten?