Archief - Worm via Windows Live Messenger

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
[

[EZ]

Legacy Member
Hallo


Kheb een worm binnegekrege via Windows Live Messenger, 't is die worm waardoor ge naar iedereen een youtube-link stuurt, die hen dan ook infecteerd het virus.


WLM heb'k direct geuninstalled, en dan HJT laten lopen, resultaat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:02:32, on 4/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\avgamsvr.exe
C:\PROGRA~1\AVG\avgupsvc.exe
C:\PROGRA~1\AVG\avgemc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compal Electronics, INC\Sidewalker\CSWalker.exe
C:\PROGRA~1\AVG\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\vsnp2std.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\sysregi.exe
C:\WINDOWS\ehSched.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Games\Xfire\xfire.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Sidewalker] C:\Program Files\Compal Electronics, INC\Sidewalker\CSWalker.exe
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] ehSched.exe
O4 - HKLM\..\Run: [Nod32 Runtime] sysregi.exe
O4 - HKLM\..\RunServices: [Nod32 Runtime] sysregi.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\AVG\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.telenet.be
O15 - Trusted Zone: http://www.moodle.snirp.info
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178135653625
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{28EF73D6-293F-4D18-8F81-FD92190FA726}: NameServer = 192.168.0.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgemc.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6294 bytes
Klik om te vergroten...


Alvast bedankt
EZ
T

TomWij

Legacy Member
Je log ziet er perfect uit, alleen draai je wel twee virus scanners wat wel mogelijk eens vertraging kan veroorzaken. (NOD32 en AVG)
[

[EZ]

Legacy Member
NOD32 is hier nochthans niet geïnstalleerd, staat ook niet in softwarelijst of program files :confused:
T

TiZon

Legacy Member
Ik zie toch nog een probleem:
C:\WINDOWS\system32\sysregi.exe
O4 - HKLM\..\Run: [Nod32 Runtime] sysregi.exe
O4 - HKLM\..\RunServices: [Nod32 Runtime] sysregi.exe
Klik

En van deze ben ik niet zeker:
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab

Die NOD 32-melding is een mask van die spyware...

PS: ik ben zelf ooit nog begonnen aan studies bij MRU, maar ik heb dat jammer genoeg nooit afgemaakt, dus wacht maar op een certified user, voor zekerheid, maar hier heb je alvast wat ik zou doen:

-Combofix draaien
-nieuwe log vragen
-waarschijnlijk staan de files er dan nog, dus verwijderen mbv een CFScript.txt en dit dan in de exe van combofix laten slepen.

Jurgen? :p
[

[EZ]

Legacy Member
TiZon zei:
En van deze ben ik niet zeker:
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab
Klik om te vergroten...
Die link gaat nu precies niet meer, maar kzie "ijji" staan in de link, kheb daar ooit 2 games van gehad op deze laptop (GunZ en nog een cartoonracegame), dus is wrs daarvan afkomstig.

Maar die games zijn al lang weg dus die key (of hoe moet'k da noeme :p) mag dan ook weg wrs?
T

TiZon

Legacy Member
Ja, waarschijnlijk wel ja :)

Maar ik durf mij nooit echt zeker uitspreken over die dingen, je kan het allemaal neig goed omeep helpen met die dingen ^^ vandaar :D
[

[EZ]

Legacy Member
Kheb voor'k hier men logje poste die sticky MSN-virus gevolgd, AVG had toen enkele dll's gevonden en aangepast, Ad-Aware had 1 critical object gevonde, en van ComboFix weet'k het eiglijk niet.

Die dll's die AVG had aangepast waren deze:
- kernel32.dll
- wsock32.dll
- user32.dll
- shell32.dll
- ntoskrnl.exe
- hosts


Elke keer als'k nu scan met AVG vindt hij die direct en past hij ze waar aan, kan dat kwaad?
(kweet nie of die er al stonden voor'k het virus had eiglijk :x)
[

[EZ]

Legacy Member
Kgebruik wel een custom theme voor Windows, als die shell32.dll wordt gereset naar het originele, gaan de custom themes dan nog werken?
J

Jurgenv1

Legacy Member
Het logje is allesbehalve clean..

@ TS:

* Download en bewaar SDFix
op je bureaublad.

Dubbelklik op SDFix.exe en kies voor Install om het tooltje uit te pakken in een eigen map op je bureaubad. Herstart dan je pc in Veilige modus

  • In veilige modus, open de SDFix map op je bureaublad en dubbelklik op RunThis.bat om het tooltje te starten.
  • Typ Y om het clean proces te starten.
  • het verwijdert alle Trojan Services of Registry Entries die met deze infectie te maken hebben, als het tooltje klaar is zal het jou vertellen om eender welke toets te drukken om je pc te herstarten, doe dit ook.
  • Wanneer de pc herstart zal het tooltje opnieuw runnen en het opruimproces beëindigen en je de melding Finished tonen, druk dan op eender welke toets om het scriptje te beëindigen en je bureaublad zullen tevoorschijn komen.
  • Wanneer je bureaublad icoontjes verschijnen zal het rapportje van SDFix openen en ook in de map bewaren onder de naam Report.txt.
  • Kopieer en plak nu de inhoud van dat rapportje hier met een nieuw hijackthis logje.
[

[EZ]

Legacy Member
ok, gedaan:


SDFix zei:
SDFix: Version 1.188
Run by Enzo on vr 06/06/2008 at 15:05

Microsoft Windows XP [versie 5.1.2600]
Running From: C:\DOCUME~1\Enzo\BUREAU~1\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\ehSched.exe - Deleted
C:\WINDOWS\system32\sysregi.exe - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 15:25:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_0c45&Pid_624f\5&12245c4c&0&4]
"Capabilities"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd502c52]
"001b5937159b"=hex:50,f5,19,04,35,04,af,a0,3f,c3,e2,27,f7,2b,fd,6a
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol 120%\"
"h0"=dword:00000001
"ujdew"=hex:b6,1c,0e,5a,0b,fa,9d,1d,74,1e,83,db,81,d7,34,b9,65,60,dc,bd,c8,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:72,14,5e,07,45,fc,d8,7d,d0,63,17,5e,89,a3,9e,26,2f,34,83,6a,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0009dd502c52]
"001b5937159b"=hex:50,f5,19,04,35,04,af,a0,3f,c3,e2,27,f7,2b,fd,6a
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol 120%\"
"h0"=dword:00000001
"ujdew"=hex:b6,1c,0e,5a,0b,fa,9d,1d,74,1e,83,db,81,d7,34,b9,65,60,dc,bd,c8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:72,14,5e,07,45,fc,d8,7d,d0,63,17,5e,89,a3,9e,26,2f,34,83,6a,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol 120%\"
"h0"=dword:00000001
"ujdew"=hex:ae,d2,d0,7e,ec,dd,df,ec,eb,5a,31,bc,1c,fe,c8,f4,f5,58,02,45,62,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:72,14,5e,07,45,fc,d8,7d,d0,63,17,5e,89,a3,9e,26,2f,34,83,6a,0a,..

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2ADAFE30-0838-6739-06C9-EAB46ED7AB24}]
"abinbfpmiljdaihmdjkmlgkpfjjbikajlp"=hex:61,61,00,00
"bbinbfpmiljdaihmdjfnkcpmhjgdlgggalag"=hex:61,61,00,00

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Games\\Splinter Cell Pandora Tomorrow\\pandora.exe"="C:\\Program Files\\Games\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:pandora"
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\counter-strike source\\hl2.exe"="C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life 2 deathmatch\\hl2.exe"="C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Games\\Live for Speed S2 Alpha\\LFS.exe"="C:\\Program Files\\Games\\Live for Speed S2 Alpha\\LFS.exe:*:Enabled:LFS"
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\day of defeat source\\hl2.exe"="C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\day of defeat source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life\\hl.exe"="C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\source sdk base\\hl2.exe"="C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\source sdk base\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Games\\RollerCoaster Tycoon\\rct.exe"="C:\\Program Files\\Games\\RollerCoaster Tycoon\\rct.exe:*:Enabled:rct"
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\counter-strike\\hl.exe"="C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Games\\Xfire\\xfire.exe"="C:\\Program Files\\Games\\Xfire\\xfire.exe:*:Enabled:Xfire"
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life 2\\hl2.exe"="C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life 2\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\AVG\\avginet.exe"="C:\\Program Files\\AVG\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\AVG\\avgamsvr.exe"="C:\\Program Files\\AVG\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\AVG\\avgcc.exe"="C:\\Program Files\\AVG\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\AVG\\avgemc.exe"="C:\\Program Files\\AVG\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\Games\\Steam\\Steam.exe"="C:\\Program Files\\Games\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1.icd"="C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1.icd:*:Enabled:Age of Empires II Expansion"
"C:\\Program Files\\Last.fm\\LastFM.exe"="C:\\Program Files\\Last.fm\\LastFM.exe:*:Enabled:Last.fm"
"C:\\Program Files\\Games\\Age of Empires II\\EMPIRES2.ICD"="C:\\Program Files\\Games\\Age of Empires II\\EMPIRES2.ICD:*:Enabled:Age of Empires II"
"C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1.exe"="C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1 (IGZones).exe"="C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1 (IGZones).exe:*:Enabled:Age of Empires II Expansion"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~""="DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~":*:Enabled:Nod32 Runtime"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

Remaining Files :


File Backups: - C:\DOCUME~1\Enzo\BUREAU~1\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 14 Apr 2008 1,695,232 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot\TeaTimer.exe"
Mon 14 Apr 2008 4,639 A.SH. --- "C:\Program Files\Windows Media Player\mplayer2.exe"
Mon 14 Apr 2008 73,728 A.SH. --- "C:\Program Files\Windows Media Player\wmplayer.exe"
Mon 28 May 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 3 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sat 1 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\523d056929e13eacf8392044f602e53e\BIT6.tmp"
Fri 9 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9ace568958858279a6c5830b433e310b\BIT3.tmp"
Sat 1 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\afa5528a2269b5106016bdbc1ea3037f\BIT5.tmp"
Sun 18 May 2008 24,064 A..H. --- "C:\Documents and Settings\Enzo\Mijn documenten\Mijn documenten\School\~WRL1516.tmp"
Sun 18 May 2008 60,928 A..H. --- "C:\Documents and Settings\Enzo\Mijn documenten\Mijn documenten\School\~WRL1756.tmp"
Mon 8 Jan 2007 26,112 A..H. --- "C:\Documents and Settings\Miguel\Mijn documenten\Mijn afbeeldingen\andere\~WRL1547.tmp"
Mon 8 Jan 2007 25,600 A..H. --- "C:\Documents and Settings\Miguel\Mijn documenten\Mijn afbeeldingen\andere\~WRL3429.tmp"

Finished!
Klik om te vergroten...


HJT zei:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:34:51, on 6/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\avgamsvr.exe
C:\PROGRA~1\AVG\avgupsvc.exe
C:\PROGRA~1\AVG\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Compal Electronics, INC\Sidewalker\CSWalker.exe
C:\PROGRA~1\AVG\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\vsnp2std.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Sidewalker] C:\Program Files\Compal Electronics, INC\Sidewalker\CSWalker.exe
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\AVG\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.telenet.be
O15 - Trusted Zone: http://www.moodle.snirp.info
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178135653625
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{28EF73D6-293F-4D18-8F81-FD92190FA726}: NameServer = 192.168.0.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5858 bytes
Klik om te vergroten...



Kheb gisteren ook nog da "scf/ scannow" ofzo gedaan gisteren, kweet nie of da iets opgebracht heeft...
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
[

[EZ]

Legacy Member
De 2 logs in 1 post was te lang (31485 tekens :p), dus hier is de ComboFix log:


ComboFix 08-06-01.6 - Enzo 2008-06-06 18:04:49.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1043.18.1557 [GMT 2:00]
Gestart vanuit: C:\Documents and Settings\Enzo\Menu Start\Cleaning\ComboFix\ComboFix.exe

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.
/wow section - STAGE 38
De syntaxis van de opdracht is onjuist.


(((((((((((((((((((( Bestanden Gemaakt van 2008-05-06 to 2008-06-06 ))))))))))))))))))))))))))))))
.

2008-06-06 14:15 . 2008-06-06 14:15 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-05 19:37 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-06-05 19:36 . 2001-09-06 21:26 386,560 --a--c--- C:\WINDOWS\system32\dllcache\sgiul50.dll
2008-06-05 19:35 . 2001-09-06 20:29 899,594 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-06-05 19:34 . 2008-04-14 22:11 2,070,272 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-06-05 19:33 . 2001-08-17 21:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys
2008-06-05 19:32 . 2008-04-14 22:32 702,845 --a--c--- C:\WINDOWS\system32\dllcache\i81xdnt5.dll
2008-06-05 19:31 . 2001-09-06 21:26 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2008-06-05 19:30 . 2001-09-06 18:59 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-06-05 19:29 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-06-05 19:28 . 2008-04-14 22:12 2,193,408 --a--c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-06-05 15:38 . 2008-06-05 15:38 <DIR> d-------- C:\Program Files\Wolters Plantyn
2008-06-04 20:32 . 2008-06-04 20:32 17 --a------ C:\WINDOWS\Missing.ini
2008-06-04 14:49 . 2008-06-06 16:32 <DIR> dr-h----- C:\Documents and Settings\Enzo\Onlangs geopend
2008-06-03 20:53 . 2008-06-03 21:43 <DIR> d-------- C:\Program Files\Ad-Aware SE Personal
2008-06-03 20:52 . 2008-06-03 20:52 61,444 --a------ C:\WINDOWS\scvhosted.exe
2008-06-03 19:35 . 2008-06-03 21:36 417,792 --a------ C:\WINDOWS\39382.got
2008-06-01 15:26 . 2008-06-04 20:32 32 --a------ C:\WINDOWS\CD-Start.INI
2008-05-29 16:28 . 2008-05-29 16:28 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-29 16:20 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-05-29 16:20 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-05-29 16:20 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-05-28 20:02 . 2008-06-04 18:53 <DIR> d-------- C:\Program Files\Windows Live
2008-05-28 20:02 . 2008-05-28 20:05 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-28 20:02 . 2008-06-04 18:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-28 13:36 . 2008-06-04 21:19 <DIR> d-------- C:\Documents and Settings\Enzo\Application Data\teamspeak2
2008-05-23 16:18 . 2008-05-23 16:18 368,640 --a------ C:\WINDOWS\system32\ReWire.dll
2008-05-23 16:18 . 2008-05-23 16:18 233,472 --a------ C:\WINDOWS\system32\REX Shared Library.dll
2008-05-23 16:14 . 2008-05-23 16:22 <DIR> d-------- C:\Program Files\Reason
2008-05-23 15:53 . 2008-05-23 15:53 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-17 20:42 . 2003-12-13 00:40 202,763 --a------ C:\WINDOWS\system32\uxtheme.backup
2008-05-17 18:16 . 2007-04-02 23:56 19,456 --a--c--- C:\WINDOWS\system32\dllcache\agt0804.dll
2008-05-17 18:16 . 2007-04-02 23:56 19,456 --a--c--- C:\WINDOWS\system32\dllcache\agt0404.dll
2008-05-17 18:16 . 2008-04-14 22:30 7,168 --a--c--- C:\WINDOWS\system32\dllcache\f3ahvoas.dll
2008-05-17 18:16 . 2008-04-14 22:31 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbdlk41j.dll
2008-05-17 18:16 . 2008-04-14 22:31 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd106n.dll
2008-05-17 18:16 . 2008-04-14 22:31 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbd101.dll
2008-05-17 18:15 . 2008-04-14 22:32 218,112 --a--c--- C:\WINDOWS\system32\dllcache\c_g18030.dll
2008-05-17 18:15 . 2008-04-14 22:33 119,808 --a--c--- C:\WINDOWS\system32\dllcache\mtstocom.exe
2008-05-17 18:15 . 2008-04-14 22:32 29,184 --a--c--- C:\WINDOWS\system32\dllcache\rw330ext.dll
2008-05-17 18:15 . 2008-04-14 22:32 27,648 --a--c--- C:\WINDOWS\system32\dllcache\rw001ext.dll
2008-05-17 18:15 . 2007-04-02 23:56 19,456 --a--c--- C:\WINDOWS\system32\dllcache\agt0412.dll
2008-05-17 18:15 . 2007-04-02 23:56 19,456 --a--c--- C:\WINDOWS\system32\dllcache\agt040d.dll
2008-05-17 18:15 . 2007-04-02 23:56 19,456 --a--c--- C:\WINDOWS\system32\dllcache\agt0401.dll
2008-05-17 18:15 . 2008-04-14 22:31 7,168 --a--c--- C:\WINDOWS\system32\dllcache\kbdibm02.dll
2008-05-17 18:15 . 2008-04-14 22:31 6,656 --a--c--- C:\WINDOWS\system32\dllcache\kbdlk41a.dll
2008-05-17 18:14 . 2008-04-14 22:32 294,912 -----c--- C:\WINDOWS\system32\dllcache\dlimport.exe
2008-05-17 18:14 . 2008-04-14 22:31 6,144 --a--c--- C:\WINDOWS\system32\dllcache\kbdax2.dll
2008-05-17 18:12 . 2008-04-14 00:10 10,240 --------- C:\WINDOWS\system32\drivers\sffp_mmc.sys
2008-05-17 18:10 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\005639_.tmp
2008-05-17 11:41 . 2008-05-17 11:41 <DIR> d-------- C:\Documents and Settings\Enzo\Application Data\CDBurnerXP_Soft
2008-05-17 11:34 . 2008-05-17 11:34 <DIR> d-------- C:\Documents and Settings\Enzo\Application Data\Ahead
2008-05-16 17:47 . 2008-05-16 17:50 <DIR> d-------- C:\Program Files\BBlean
2008-05-14 03:29 . 2008-05-14 03:29 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-05-13 16:54 . 2008-05-13 16:54 <DIR> d-------- C:\WINDOWS\$regcmp$
2008-05-11 22:19 . 2008-06-06 17:03 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-11 22:19 . 2008-05-11 22:19 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-11 14:05 . 2002-06-06 14:38 139,264 --a------ C:\WINDOWS\system32\eax.dll
2008-05-11 14:01 . 2002-08-08 06:11 319,488 -ra------ C:\WINDOWS\system32\MafiaSetup.exe
2008-05-10 15:31 . 2008-05-10 15:31 <DIR> d-------- C:\Program Files\EditPad Pro 6

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 15:21 --------- d-----w C:\Documents and Settings\Enzo\Application Data\Xfire
2008-06-05 17:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-06-05 16:34 --------- d-----w C:\Program Files\AVG
2008-06-05 10:48 --------- d-----w C:\Program Files\Office
2008-06-04 17:16 --------- d-----w C:\Documents and Settings\Enzo\Application Data\AVG7
2008-06-03 18:53 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-03 18:44 --------- d-----w C:\Program Files\Ad-Aware 2007
2008-05-28 12:15 --------- d-----w C:\Program Files\BSplayer
2008-05-28 11:37 --------- d-----w C:\Program Files\Last.fm
2008-05-25 14:13 --------- d-----w C:\Documents and Settings\Enzo\Application Data\BitTorrent
2008-05-23 14:18 --------- d-----w C:\Documents and Settings\Enzo\Application Data\Propellerhead Software
2008-05-23 13:53 --------- d-----r C:\Program Files\Games
2008-04-29 15:06 --------- d-----w C:\Documents and Settings\Miguel\Application Data\LimeWire
2008-04-28 18:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-27 11:07 --------- d-----w C:\Program Files\Spybot
2008-04-27 09:02 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-04-26 17:44 --------- d-----w C:\Documents and Settings\Enzo\Application Data\DNA
2008-04-26 14:52 --------- d-----w C:\Program Files\DNA
2008-04-26 14:52 --------- d-----w C:\Program Files\BitTorrent
2008-04-25 17:41 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-04-23 11:35 --------- d-----w C:\Program Files\Winamp
2008-04-23 11:35 --------- d-----w C:\Documents and Settings\Enzo\Application Data\Winamp
2008-04-19 13:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Propellerhead Software
2008-04-14 20:49 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 20:36 332,800 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 20:32 99,840 ----a-w C:\WINDOWS\system32\winscard.dll
2008-04-14 20:31 763,904 ----a-w C:\WINDOWS\system32\winntbbu.dll
2008-04-14 20:30 9,344 ----a-w C:\WINDOWS\system32\framebuf.dll
2008-04-14 20:30 572,928 ----a-w C:\WINDOWS\system32\gpedit.dll
2008-04-14 20:30 3,584 ----a-w C:\WINDOWS\system32\icmp.dll
2008-04-14 20:30 3,072 ----a-w C:\WINDOWS\system32\dpnlobby.dll
2008-04-14 20:30 3,072 ----a-w C:\WINDOWS\system32\dpnaddr.dll
2008-04-14 20:30 285,696 ----a-w C:\WINDOWS\system32\atmfd.dll
2008-04-14 20:30 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll
2008-04-14 20:30 16,896 ----a-w C:\WINDOWS\system32\cfgmgr32.dll
2008-04-14 20:13 80,256 ----a-w C:\WINDOWS\system32\drivers\parport.sys
2008-04-14 20:13 73,472 ----a-w C:\WINDOWS\system32\drivers\sr.sys
2008-04-14 20:13 68,224 ----a-w C:\WINDOWS\system32\drivers\pci.sys
2008-04-14 20:13 46,848 ----a-w C:\WINDOWS\system32\drivers\p3.sys
2008-04-14 20:13 120,448 ----a-w C:\WINDOWS\system32\drivers\pcmcia.sys
2008-04-14 20:11 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-14 20:11 2,149,888 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-14 20:11 2,028,544 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-14 20:10 800,000 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys
2008-04-14 20:10 153,856 ----a-w C:\WINDOWS\system32\drivers\dmio.sys
2008-04-14 20:09 88,064 ----a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-14 20:09 25,088 ----a-w C:\WINDOWS\system32\drivers\kbdclass.sys
2008-04-14 20:09 14,720 ----a-w C:\WINDOWS\system32\drivers\kbdhid.sys
2008-04-14 20:08 78,336 ------w C:\WINDOWS\system32\msshavmsg.dll
2008-04-14 20:08 40,832 ----a-w C:\WINDOWS\system32\drivers\crusoe.sys
2008-04-14 20:08 37,760 ----a-w C:\WINDOWS\system32\drivers\isapnp.sys
2008-04-14 20:08 2,965,504 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-04-14 20:07 566,784 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-14 20:07 50,176 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-14 20:07 40,448 ------w C:\WINDOWS\system32\drivers\intelppm.sys
2008-04-14 20:06 65,536 ----a-w C:\WINDOWS\system32\drivers\serial.sys
2008-04-14 20:06 189,952 ----a-w C:\WINDOWS\system32\wmerror.dll
2008-04-14 20:05 53,504 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-14 20:05 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-14 20:04 67,584 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-14 20:04 58,112 ----a-w C:\WINDOWS\system32\drivers\redbook.sys
2008-04-14 20:04 273,536 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-04-14 20:04 25,728 ------w C:\WINDOWS\system32\drivers\hidbth.sys
2008-04-14 20:04 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll
2008-04-14 20:03 53,504 ----a-w C:\WINDOWS\system32\drivers\volsnap.sys
2008-04-14 20:02 8,192 ----a-w C:\WINDOWS\system32\asferror.dll
2008-04-14 20:02 44,672 ----a-w C:\WINDOWS\system32\drivers\fips.sys
2008-04-14 20:02 41,856 ----a-w C:\WINDOWS\system32\drivers\amdk7.sys
2008-04-14 20:02 39,936 ----a-w C:\WINDOWS\system32\drivers\processr.sys
2008-04-14 20:01 41,472 ----a-w C:\WINDOWS\system32\drivers\amdk6.sys
2008-04-14 20:00 30,336 ----a-w C:\WINDOWS\system32\drivers\modem.sys
2008-04-14 20:00 23,552 ----a-w C:\WINDOWS\system32\drivers\mouclass.sys
2008-04-14 20:00 188,544 ----a-w C:\WINDOWS\system32\drivers\acpi.sys
2008-04-13 22:58 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 22:51 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 22:50 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 22:50 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 22:50 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 22:49 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 22:49 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 22:49 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 22:49 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 22:49 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-04-13 22:47 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 22:47 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 22:47 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
2008-04-13 22:46 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 22:46 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
2008-04-13 22:45 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 22:45 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 22:45 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-04-13 22:44 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 22:44 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 22:30 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 22:30 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 22:27 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 22:27 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 22:27 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 22:27 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 22:27 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 22:32 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidewalker"="C:\Program Files\Compal Electronics" [ ]
"KTPWare"="C:\Program Files\Elantech\ktp.exe" [2006-03-28 10:36 512000]
"AVG7_CC"="C:\PROGRA~1\AVG\avgcc.exe" [2008-04-17 18:11 579584]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 22:33 110592 C:\WINDOWS\system32\bthprops.cpl]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-12 17:11 7577600]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-05-15 15:52 675840]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 22:32 15360]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [ ]
"ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [ ]
"AVG7_Run"="C:\PROGRA~1\AVG\avgw.exe" [2007-10-22 18:56 219136]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 01000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ir32"= C:\WINDOWS\system32\ir32_32.dll
"vidc.ir31"= C:\WINDOWS\system32\ir32_32.dll
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Gamma.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^BTTray.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Last.fm Helper.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Last.fm Helper.lnk
backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Logitech-productregistratie.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Logitech-productregistratie.lnk
backup=C:\WINDOWS\pss\Logitech-productregistratie.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
-ra------ 2005-12-12 07:50 88204 C:\WINDOWS\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 11:43 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2007-07-02 12:29 220544 C:\Program Files\Alcohol 120%\axcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
--------- 2005-08-25 07:21 53248 C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCD2000]
--a------ 2008-01-30 14:35 532480 C:\WINDOWS\system32\bcd2kcpan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2008-04-26 16:52 288576 C:\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CASS]
C:\Program Files\Compal Electronics

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 22:32 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EOUApp]
--a------ 2006-04-14 11:56 569413 C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a------ 2006-04-14 11:52 602182 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
--a------ 2006-04-14 11:51 667718 C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
--a------ 2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KTPWare]
--a------ 2006-03-28 10:36 512000 C:\Program Files\Elantech\ktp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-07-18 18:55 451872 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
---hs---- 2008-04-14 22:33 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--------- 2005-10-11 18:25 1961984 C:\Program Files\Nero\Nero BackItUp\NBJ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nod32 Runtime]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-06-12 17:11 7577600 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-06-12 17:11 1519616 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OmniPass]
C:\Program Files\OmniPass\scureapp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-04-27 09:41 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2006-04-17 08:34 16143872 C:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2std]
--a------ 2006-05-15 15:52 675840 C:\WINDOWS\vsnp2std.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp2std]
--a------ 2006-06-14 19:20 331776 C:\WINDOWS\system32\tsnp2std.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows UDP Control Center]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"btwdins"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"TapiSrv"=3 (0x3)
"Schedule"=2 (0x2)
"ISPMonitorSrv"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"iPod Service"=3 (0x3)
"usnjsvc"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LightScribeService"=2 (0x2)
"S24EventMonitor"=2 (0x2)
"RegSrvc"=2 (0x2)
"IDriverT"=3 (0x3)
"CiSvc"=3 (0x3)
"HTTPFilter"=3 (0x3)
"aawservice"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Games\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\counter-strike source\\hl2.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Games\\Live for Speed S2 Alpha\\LFS.exe"=
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life\\hl.exe"=
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\source sdk base\\hl2.exe"=
"C:\\Program Files\\Games\\RollerCoaster Tycoon\\rct.exe"=
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\counter-strike\\hl.exe"=
"C:\\Program Files\\Games\\Xfire\\xfire.exe"=
"C:\\Program Files\\Games\\Steam\\steamapps\\norskvich\\half-life 2\\hl2.exe"=
"C:\\Program Files\\AVG\\avginet.exe"=
"C:\\Program Files\\AVG\\avgamsvr.exe"=
"C:\\Program Files\\AVG\\avgcc.exe"=
"C:\\Program Files\\AVG\\avgemc.exe"=
"C:\\Program Files\\Games\\Steam\\Steam.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"C:\\Program Files\\Games\\Age of Empires II\\EMPIRES2.ICD"=
"C:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1.exe"=
"C:\\Program Files\\Games\\Age of Empires II\\age2_x1\\age2_x1 (IGZones).exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"DEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ӟ"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R1 CPEb;CPEB;C:\WINDOWS\system32\drivers\CPEb.sys [2006-02-23 18:21]
R3 SNP2STD;USB2.0 PC Camera (SNP2STD);C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2006-05-23 15:39]
S3 BCD2000;Behringer BCD2000 V1.1.1.0;C:\WINDOWS\system32\Drivers\BCD2000.SYS [2008-01-30 14:35]
S3 BCD2000WDM;Behringer BCD2000WDM V1.1.1.0;C:\WINDOWS\system32\Drivers\BCD2000WDM.SYS [2008-01-30 14:35]
S3 K320bus;Sony Ericsson K320 driver (WDM);C:\WINDOWS\system32\DRIVERS\K320bus.sys [2006-08-18 11:10]
S3 K320mgmt;Sony Ericsson K320 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\K320mgmt.sys [2006-08-18 11:10]
S3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys [2006-03-17 17:03]
S4 ISPMonitorSrv;ISP Monitor;C:\Program Files\ISP Monitor\ISPMonitorSrv.exe [2008-01-11 01:01]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3220c3f-6b8c-11dc-b0b8-0016d4cf7e2b}]
\Shell\AutoRun\command - E:\Loader.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 18:09:59
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2008-06-06 18:12:09
ComboFix-quarantined-files.txt 2008-06-06 16:11:59

Pre-Run: 10,152,714,240 bytes beschikbaar
Post-Run: 10,190,442,496 bytes beschikbaar

356 --- E O F --- 2008-06-01 18:18:26
Klik om te vergroten...
[

[EZ]

Legacy Member
en hier is de HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:13:03, on 6/06/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\avgamsvr.exe
C:\PROGRA~1\AVG\avgupsvc.exe
C:\PROGRA~1\AVG\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Compal Electronics, INC\Sidewalker\CSWalker.exe
C:\PROGRA~1\AVG\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\vsnp2std.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Games\Xfire\xfire.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Sidewalker] C:\Program Files\Compal Electronics, INC\Sidewalker\CSWalker.exe
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVG\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\AVG\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Widcomm Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.telenet.be
O15 - Trusted Zone: http://www.moodle.snirp.info
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178135653625
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{28EF73D6-293F-4D18-8F81-FD92190FA726}: NameServer = 192.168.0.1
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5870 bytes
Klik om te vergroten...
[

[EZ]

Legacy Member
ok, merci voor hulp :)


En er zijn precies geen problemen meer nie, van die Messenger-bot heb'k ook geen last meer gehad.
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan