werkbalk ,menustart en bureablad verdwijnt soms

[kendoss]

Me computer werkt niet meer zoals de oude.., is echt vervelend probleem uit het niets gaat me bureablad weg + taakbalk en menu start weg.Kan dit een virus zijn die het veroorzaakt? thnx

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:17:52, on 4-1-2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kendo\Bureaublad\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onlinesoccermanager.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2D92F25C-FDE2-43A9-99CA-E978E013A384} - C:\WINDOWS\System32\awtqn.dll (file missing)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\System32\ljjjjgf.dll
O2 - BHO: (no name) - {7100535C-F1DC-401F-A782-304338C3A435} - C:\WINDOWS\System32\ssqrr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [bm] "C:\Program Files\Common Files\SpyGuardPro\bm.exe" dm=http://spyguardpro.com ad=http://spyguardpro.com sd=http://ykeeper.spyguardpro.com
O4 - HKLM\..\Run: [ptask] C:\Program Files\SpyGuardPro\ptask.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxrnet.net/code/chm/xpre.chm::/xpreload.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1199328621828
O20 - Winlogon Notify: ljjjjgf - C:\WINDOWS\SYSTEM32\ljjjjgf.dll
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 6732 bytes

[Marckie]

Je gebruikt een oude versie van HijackThis. Best dat je eerst update naar de nieuwste versie: http://www.trendsecure.com/portal/en...HJTInstall.exe

Sluit alle open vensters.
Start HijackThis nog een keer en plaats een vinkje bij de volgende items:

O2 - BHO: (no name) - {2D92F25C-FDE2-43A9-99CA-E978E013A384} - C:\WINDOWS\System32\awtqn.dll (file missing)
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\System32\ljjjjgf.dll
O2 - BHO: (no name) - {7100535C-F1DC-401F-A782-304338C3A435} - C:\WINDOWS\System32\ssqrr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [bm] "C:\Program Files\Common Files\SpyGuardPro\bm.exe" dm=http://spyguardpro.com ad=http://spyguardpro.com sd=http://ykeeper.spyguardpro.com
O4 - HKLM\..\Run: [ptask] C:\Program Files\SpyGuardPro\ptask.exe
O20 - Winlogon Notify: ljjjjgf - C:\WINDOWS\SYSTEM32\ljjjjgf.dll

Klik daarna op "Fix checked" en sluit HijackThis af.

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

[kendoss]

bedankt voor je reactie heb inmiddels die nieuwe hijackthis gedownload.
Ik startte hijkackthis op en wou die 4 items vinden en dan fixen.Maar tot mij verbazing zag ik die 4 items ineens niet meer das echt vaag dus heb niks kunnen fixen met hijackthis.
Hier heb je alsnog me logje


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:40:44, on 4-1-2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onlinesoccermanager.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxrnet.net/code/chm/xpre.chm::/xpreload.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1199328621828
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 5339 bytes













ComboFix 08-01-04.1 - Kendo 2008-01-04 17:28:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1043.18.212 [GMT 1:00]
Gestart vanuit: C:\Documents and Settings\Kendo\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.
The following files were disabled during the run:
C:\WINDOWS\system32\sockspy.dll


(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Kendo\Application Data\inst.exe
C:\Documents and Settings\Kendo\Application Data\SpyGuardPro
C:\Documents and Settings\Kendo\Application Data\SpyGuardPro\Logs\threats.log
C:\Documents and Settings\Kendo\Application Data\SpyGuardPro\Logs\update.log
C:\Program Files\SpyGuardPro
C:\Program Files\SpyGuardPro\history.db
C:\Program Files\SpyGuardPro\main.log
C:\Program Files\SpyGuardPro\ResErrors.log
C:\SpyGuardPro
C:\WINDOWS\Downloaded Program Files.\xpreload.ocx
C:\WINDOWS\system32\nqtwa.ini
C:\WINDOWS\system32\nqtwa.ini2
C:\WINDOWS\system32\rrqss.ini
C:\WINDOWS\system32\rrqss.ini2
C:\WINDOWS\system32\ssqrr.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2007-12-04 to 2008-01-04 ))))))))))))))))))))))))))))))
.

2008-01-04 17:27 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 17:20 . 2008-01-04 17:20 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-03 14:15 . 2008-01-03 14:15 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\Bitdefender
2008-01-03 14:14 . 2008-01-03 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-01-03 14:03 . 2008-01-03 14:04 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-01-03 13:59 . 2008-01-03 14:02 121 --a------ C:\WINDOWS\bdagent.INI
2008-01-03 13:56 . 2008-01-03 13:58 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-01-03 12:32 . 2008-01-03 12:32 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Start
2008-01-03 04:39 . 2008-01-03 04:39 <DIR> d-------- C:\WINDOWS\provisioning
2008-01-03 04:39 . 2008-01-03 15:32 <DIR> d-------- C:\WINDOWS\peernet
2008-01-03 04:27 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002269_.tmp
2008-01-03 04:27 . 2008-01-03 04:27 876 --a------ C:\WINDOWS\NJSTAR.INI
2008-01-03 04:26 . 2004-08-03 22:43 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-03 04:25 . 2004-07-09 04:27 1,769,472 --a------ C:\WINDOWS\system32\dxdiagn.dll
2008-01-03 04:25 . 2004-07-09 04:27 1,703,936 --a------ C:\WINDOWS\system32\d3d9.dll
2008-01-03 04:25 . 2002-09-11 13:00 196,608 --a------ C:\WINDOWS\system32\xpsp1res.dll
2008-01-03 04:25 . 2004-07-09 04:26 57,856 --a------ C:\WINDOWS\system32\mpeg2data.ax
2008-01-03 04:25 . 2002-09-11 13:00 35,200 --a------ C:\WINDOWS\system32\drivers\amdk7.sys
2008-01-03 04:25 . 2002-09-11 13:00 19,328 --a------ C:\WINDOWS\system32\drivers\usbehci.sys
2008-01-03 04:25 . 2002-12-12 00:14 18,944 --a------ C:\WINDOWS\system32\encapi.dll
2008-01-03 04:25 . 2002-09-11 13:00 9,856 --a------ C:\WINDOWS\system32\drivers\tunmp.sys
2008-01-03 04:25 . 2002-09-11 13:00 5,120 --a------ C:\WINDOWS\system32\hccoin.dll
2008-01-03 04:25 . 2002-09-11 13:00 3,584 --a------ C:\WINDOWS\system32\dsprpres.dll
2008-01-03 04:21 . 2002-09-11 13:00 4,186,256 --------- C:\WINDOWS\system32\dllcache\luna.mst
2008-01-03 04:18 . 2008-01-03 04:18 <DIR> d-------- C:\WINDOWS\EHome
2008-01-03 03:56 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-03 03:56 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-03 03:06 . 2008-01-04 17:32 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-01-03 03:01 . 2008-01-03 03:01 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
2008-01-03 03:01 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2008-01-03 03:01 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-01-03 02:27 . 2008-01-03 02:29 32,764 --a------ C:\WINDOWS\17PHolmes572.exe
2007-12-30 00:49 . 2007-12-30 00:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2007-12-30 00:10 . 2007-12-30 00:42 <DIR> d-------- C:\Program Files\NJStar Chinese WP
2007-12-30 00:05 . 2008-01-03 01:54 <DIR> d-------- C:\Program Files\NJStar Communicator
2007-12-30 00:05 . 2008-01-03 01:54 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\NJStar
2007-12-29 23:51 . 2007-12-29 23:51 <DIR> d-------- C:\Program Files\VSO
2007-12-29 23:51 . 2008-01-03 02:20 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\Vso
2007-12-29 23:51 . 2006-09-29 11:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-12-29 23:51 . 2006-09-29 11:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-12-29 23:51 . 2006-09-29 11:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-12-29 23:51 . 2007-12-29 23:51 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-12-29 23:51 . 2007-12-29 23:51 47,360 --a------ C:\Documents and Settings\Kendo\Application Data\pcouffin.sys
2007-12-29 22:23 . 2007-12-29 22:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-12-20 18:17 . 2007-12-20 18:17 <DIR> d-------- C:\Program Files\Canon
2007-12-20 18:17 . 2007-12-20 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Canon
2007-12-20 18:03 . 2002-11-20 16:58 589,824 -ra------ C:\WINDOWS\system32\CFFFWUD.DLL
2007-12-20 18:03 . 2002-11-18 11:52 327,740 -ra------ C:\WINDOWS\system32\UCS32P.DLL
2007-12-20 18:03 . 2002-11-20 16:58 139,264 -ra------ C:\WINDOWS\system32\mpmasdll.dll
2007-12-20 18:03 . 2002-11-18 11:52 119,808 -ra------ C:\WINDOWS\system32\ITLIB32.DLL
2007-12-20 18:03 . 2002-11-18 11:52 118,784 -ra------ C:\WINDOWS\system32\MPIMGENH.DLL
2007-12-20 18:03 . 2002-11-18 11:52 45,056 -ra------ C:\WINDOWS\system32\CANOIT32.EXE
2007-12-18 23:24 . 2007-12-18 23:24 24,336 --a------ C:\WINDOWS\system32\mljhffc.dll
2007-12-18 23:24 . 2007-12-18 23:24 24,336 --a------ C:\WINDOWS\system32\ljjjjgf.dll
2007-12-18 21:57 . 2007-12-18 21:58 <DIR> d-------- C:\WINDOWS\nview
2007-12-18 21:31 . 2007-12-18 21:31 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-18 21:30 . 2007-12-09 20:17 <DIR> d--h----- C:\Documents and Settings\Administrator\Sjablonen
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> d--h----- C:\Documents and Settings\Administrator\Onlangs geopend
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> d-------- C:\Documents and Settings\Administrator\Mijn documenten
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> d-------- C:\Documents and Settings\Administrator\Favorieten
2007-12-18 21:30 . 2007-12-29 22:23 <DIR> d-------- C:\Documents and Settings\Administrator\Bureaublad
2007-12-14 21:32 . 2007-12-14 21:32 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-11 13:02 . 2007-12-11 13:02 <DIR> d-------- C:\Program Files\Microsoft.NET
2007-12-11 13:02 . 2007-12-11 13:02 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-12-11 13:00 . 2007-12-11 13:02 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-12-11 02:59 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-12-11 02:59 . 2007-12-11 13:03 379 --a------ C:\WINDOWS\ODBC.INI
2007-12-11 02:54 . 2007-12-11 02:54 <DIR> dr-h----- C:\MSOCache
2007-12-11 02:20 . 2007-12-11 02:51 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-11 02:20 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-12-11 02:20 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-12-11 02:18 . 2007-12-11 02:18 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\vlc
2007-12-11 02:17 . 2007-12-11 02:17 <DIR> d-------- C:\Program Files\VideoLAN
2007-12-11 02:16 . 2008-01-03 18:03 116 --a------ C:\WINDOWS\NeroDigital.ini
2007-12-11 02:14 . 2007-12-11 02:14 <DIR> d-------- C:\Program Files\Real
2007-12-11 02:14 . 2007-12-11 02:14 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-12-11 02:14 . 2007-12-11 02:14 <DIR> d-------- C:\Program Files\Common Files\Real
2007-12-11 02:06 . 2007-12-11 02:06 <DIR> d-------- C:\Program Files\WinAVIVideoConverter
2007-12-11 01:56 . 2007-12-11 01:56 <DIR> d-------- C:\Program Files\Codec Pack - All In 1
2007-12-11 01:56 . 2007-12-11 01:55 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-12-11 01:41 . 2007-12-11 01:41 <DIR> d-------- C:\Program Files\Common Files\NSV
2007-12-11 01:37 . 2007-12-11 01:37 <DIR> d-------- C:\Program Files\Winamp
2007-12-11 01:37 . 2007-12-11 01:40 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\Winamp
2007-12-10 00:20 . 2007-12-11 02:40 1,878 --a------ C:\WINDOWS\system32\PQ_BATCH.PQB
2007-12-10 00:17 . 2007-12-10 00:17 <DIR> d-------- C:\Program Files\PowerQuest
2007-12-10 00:17 . 2007-12-20 18:17 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-10 00:17 . 2001-08-10 07:00 1,262,956 --------- C:\WINDOWS\system32\XMNT2001.EXE
2007-12-10 00:17 . 2001-08-10 07:00 3,252 --------- C:\WINDOWS\system32\drivers\PQNTDRV.SYS
2007-12-10 00:16 . 2007-12-18 21:45 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-12-09 23:11 . 2007-12-09 23:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-09 23:00 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-12-09 23:00 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-12-09 23:00 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl
2007-12-09 23:00 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-12-09 23:00 . 2004-08-03 14:00 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-12-09 23:00 . 2004-08-03 14:04 169,240 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-12-09 23:00 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-12-09 22:55 . 2007-12-09 23:13 <DIR> d-------- C:\Documents and Settings\Kendo\Contacts

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 12:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-03 13:18 913,408 ----a-w C:\WINDOWS\system32\xreglib.dll
2008-01-03 02:20 --------- d-----w C:\Documents and Settings\Kendo\Application Data\uTorrent
2007-12-11 00:53 --------- d-----w C:\Program Files\Google
2007-12-09 20:42 --------- d-----w C:\Program Files\uTorrent
2007-12-09 20:38 --------- d-----w C:\Program Files\BitComet
2007-12-09 20:11 --------- d-----w C:\Documents and Settings\Kendo\Application Data\Nexon
2007-12-09 19:20 558,142 ----a-w C:\WINDOWS\java\Packages\6ffflz9r.zip
2007-12-09 19:20 155,995 ----a-w C:\WINDOWS\java\Packages\4fxrdzd7.zip
2007-12-09 19:20 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D92F25C-FDE2-43A9-99CA-E978E013A384}]
C:\WINDOWS\System32\awtqn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
2007-12-18 23:24 24336 --a------ C:\WINDOWS\system32\ljjjjgf.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-11 13:00 13312]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-09 21:02 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-03-03 09:44 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl"
"NeroFilterCheck"="C:\WINDOWS\System32\NeroCheck.exe" [2001-07-09 11:50 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-11 02:14 185896]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-03-03 09:44 4595712]
"nwiz"="nwiz.exe" [2003-03-03 09:44 323584 C:\WINDOWS\system32\nwiz.exe]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2008-01-03 14:18 290816]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2008-01-03 14:18 69632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-11 13:00 13312]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-12-09 21:02:01]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"= C:\WINDOWS\system32\ljjjjgf.dll [2007-12-18 23:24 24336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjjjgf]
ljjjjgf.dll 2007-12-18 23:24 24336 C:\WINDOWS\system32\ljjjjgf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=sockspy.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\System32\ssqrr.dll

R2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\System32\DRIVERS\nvcap.sys [2002-12-17 12:54]
R2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\System32\DRIVERS\NVxbar.sys [2002-12-17 12:54]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\System32\DRIVERS\Cap7134.sys [2002-11-04 15:29]
R3 Intels51;Creatix V.9X DSP Data Fax Modem;C:\WINDOWS\System32\DRIVERS\ctxs51.sys [2002-07-01 15:10]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\System32\DRIVERS\PhTVTune.sys [2002-11-04 15:32]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-04 17:34:25
Windows 5.1.2600 Service Pack 1 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\System32\sockspy.dll
-> C:\WINDOWS\system32\ljjjjgf.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106]
-> C:\WINDOWS\system32\sockspy.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2800.1106]
-> C:\WINDOWS\System32\sockspy.dll
-> C:\WINDOWS\system32\ljjjjgf.dll
.
Voltooingstijd: 2008-01-04 17:36:17 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-04 16:36:11
.
2008-01-03 03:02:11 --- E O F ---

[Marckie]

Klopt hoor. De infectie kan deze sleutels verbergen in een hijackthislog.
Sluit alle open vensters.
Start HijackThis nog een keer en plaats een vinkje bij de volgende items:

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxrnet.net/code/chm/xpre.chm::/xpreload.ocx

Klik daarna op "Fix checked" en sluit HijackThis af.
Open een kladblokbestand.
Kopieer de ondestaande code, en plak deze in het kladblokbestand.
Sla het kladblokbestand op als CFScript.txt

File::
C:\WINDOWS\002269_.tmp
C:\WINDOWS\system32\mljhffc.dll
C:\WINDOWS\system32\ljjjjgf.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D92F25C-FDE2-43A9-99CA-E978E013A384}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjjjgf]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Sleep nu het bestand CFScript.txt in het bestand ComboFix.exe

ComboFix zal opnieuw starten.
Wanneer ComboFix klaar is, dit kan na een herstart zijn, opent er een logfile.
Post de inhoud van de logfile.

Maak een nieuwe hijackthislog en post deze ook.

[kendoss]

Heb het gedaan me computer lijkt nu wel wat iets sneller


ComboFix 08-01-04.1 - Kendo 2008-01-05 15:35:14.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1043.18.198 [GMT 1:00]
Gestart vanuit: C:\Documents and Settings\Kendo\Bureaublad\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kendo\Bureaublad\CFScript.txt
* Nieuw herstelpunt werd aangemaakt

FILE
C:\WINDOWS\002269_.tmp
C:\WINDOWS\system32\ljjjjgf.dll
C:\WINDOWS\system32\mljhffc.dll
.
The following files were disabled during the run:
C:\WINDOWS\system32\sockspy.dll


(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\002269_.tmp
C:\WINDOWS\system32\ihkmp.ini
C:\WINDOWS\system32\ihkmp.ini2
C:\WINDOWS\system32\ljjjjgf.dll
C:\WINDOWS\system32\mljhffc.dll
C:\WINDOWS\system32\pmkhi.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2007-12-05 to 2008-01-05 ))))))))))))))))))))))))))))))
.

2008-01-04 17:27 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-04 17:20 . 2008-01-04 17:20 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-03 14:15 . 2008-01-03 14:15 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\Bitdefender
2008-01-03 14:14 . 2008-01-03 14:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-01-03 14:03 . 2008-01-03 14:04 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-01-03 13:59 . 2008-01-03 14:02 121 --a------ C:\WINDOWS\bdagent.INI
2008-01-03 13:56 . 2008-01-03 13:58 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-01-03 12:32 . 2008-01-03 12:32 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Start
2008-01-03 04:39 . 2008-01-03 04:39 <DIR> d-------- C:\WINDOWS\provisioning
2008-01-03 04:39 . 2008-01-03 15:32 <DIR> d-------- C:\WINDOWS\peernet
2008-01-03 04:27 . 2008-01-03 04:27 876 --a------ C:\WINDOWS\NJSTAR.INI
2008-01-03 04:26 . 2004-08-03 22:43 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-03 04:25 . 2004-07-09 04:27 1,769,472 --a------ C:\WINDOWS\system32\dxdiagn.dll
2008-01-03 04:25 . 2004-07-09 04:27 1,703,936 --a------ C:\WINDOWS\system32\d3d9.dll
2008-01-03 04:25 . 2002-09-11 13:00 196,608 --a------ C:\WINDOWS\system32\xpsp1res.dll
2008-01-03 04:25 . 2004-07-09 04:26 57,856 --a------ C:\WINDOWS\system32\mpeg2data.ax
2008-01-03 04:25 . 2002-09-11 13:00 35,200 --a------ C:\WINDOWS\system32\drivers\amdk7.sys
2008-01-03 04:25 . 2002-09-11 13:00 19,328 --a------ C:\WINDOWS\system32\drivers\usbehci.sys
2008-01-03 04:25 . 2002-12-12 00:14 18,944 --a------ C:\WINDOWS\system32\encapi.dll
2008-01-03 04:25 . 2002-09-11 13:00 9,856 --a------ C:\WINDOWS\system32\drivers\tunmp.sys
2008-01-03 04:25 . 2002-09-11 13:00 5,120 --a------ C:\WINDOWS\system32\hccoin.dll
2008-01-03 04:25 . 2002-09-11 13:00 3,584 --a------ C:\WINDOWS\system32\dsprpres.dll
2008-01-03 04:21 . 2002-09-11 13:00 4,186,256 --------- C:\WINDOWS\system32\dllcache\luna.mst
2008-01-03 04:18 . 2008-01-03 04:18 <DIR> d-------- C:\WINDOWS\EHome
2008-01-03 03:56 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-03 03:56 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-03 03:06 . 2008-01-05 15:40 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-01-03 03:01 . 2008-01-03 03:01 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
2008-01-03 03:01 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2008-01-03 03:01 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-01-03 02:27 . 2008-01-03 02:29 32,764 --a------ C:\WINDOWS\17PHolmes572.exe
2007-12-30 00:49 . 2007-12-30 00:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2007-12-30 00:10 . 2007-12-30 00:42 <DIR> d-------- C:\Program Files\NJStar Chinese WP
2007-12-30 00:05 . 2008-01-03 01:54 <DIR> d-------- C:\Program Files\NJStar Communicator
2007-12-30 00:05 . 2008-01-03 01:54 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\NJStar
2007-12-29 23:51 . 2007-12-29 23:51 <DIR> d-------- C:\Program Files\VSO
2007-12-29 23:51 . 2008-01-03 02:20 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\Vso
2007-12-29 23:51 . 2006-09-29 11:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-12-29 23:51 . 2006-09-29 11:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-12-29 23:51 . 2006-09-29 11:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-12-29 23:51 . 2007-12-29 23:51 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-12-29 23:51 . 2007-12-29 23:51 47,360 --a------ C:\Documents and Settings\Kendo\Application Data\pcouffin.sys
2007-12-29 22:23 . 2007-12-29 22:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2007-12-20 18:17 . 2007-12-20 18:17 <DIR> d-------- C:\Program Files\Canon
2007-12-20 18:17 . 2007-12-20 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Canon
2007-12-20 18:03 . 2002-11-20 16:58 589,824 -ra------ C:\WINDOWS\system32\CFFFWUD.DLL
2007-12-20 18:03 . 2002-11-18 11:52 327,740 -ra------ C:\WINDOWS\system32\UCS32P.DLL
2007-12-20 18:03 . 2002-11-20 16:58 139,264 -ra------ C:\WINDOWS\system32\mpmasdll.dll
2007-12-20 18:03 . 2002-11-18 11:52 119,808 -ra------ C:\WINDOWS\system32\ITLIB32.DLL
2007-12-20 18:03 . 2002-11-18 11:52 118,784 -ra------ C:\WINDOWS\system32\MPIMGENH.DLL
2007-12-20 18:03 . 2002-11-18 11:52 45,056 -ra------ C:\WINDOWS\system32\CANOIT32.EXE
2007-12-18 21:57 . 2007-12-18 21:58 <DIR> d-------- C:\WINDOWS\nview
2007-12-18 21:31 . 2007-12-18 21:31 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-12-18 21:30 . 2007-12-09 20:17 <DIR> d--h----- C:\Documents and Settings\Administrator\Sjablonen
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> d--h----- C:\Documents and Settings\Administrator\Onlangs geopend
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> d-------- C:\Documents and Settings\Administrator\Mijn documenten
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2007-12-18 21:30 . 2007-12-09 21:12 <DIR> d-------- C:\Documents and Settings\Administrator\Favorieten
2007-12-18 21:30 . 2007-12-29 22:23 <DIR> d-------- C:\Documents and Settings\Administrator\Bureaublad
2007-12-14 21:32 . 2007-12-14 21:32 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-11 13:02 . 2007-12-11 13:02 <DIR> d-------- C:\Program Files\Microsoft.NET
2007-12-11 13:02 . 2007-12-11 13:02 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-12-11 13:00 . 2007-12-11 13:02 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-12-11 02:59 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-12-11 02:59 . 2007-12-11 13:03 379 --a------ C:\WINDOWS\ODBC.INI
2007-12-11 02:54 . 2007-12-11 02:54 <DIR> dr-h----- C:\MSOCache
2007-12-11 02:20 . 2007-12-11 02:51 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-11 02:20 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-12-11 02:20 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-12-11 02:18 . 2007-12-11 02:18 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\vlc
2007-12-11 02:17 . 2007-12-11 02:17 <DIR> d-------- C:\Program Files\VideoLAN
2007-12-11 02:16 . 2008-01-03 18:03 116 --a------ C:\WINDOWS\NeroDigital.ini
2007-12-11 02:14 . 2007-12-11 02:14 <DIR> d-------- C:\Program Files\Real
2007-12-11 02:14 . 2007-12-11 02:14 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-12-11 02:14 . 2007-12-11 02:14 <DIR> d-------- C:\Program Files\Common Files\Real
2007-12-11 02:06 . 2007-12-11 02:06 <DIR> d-------- C:\Program Files\WinAVIVideoConverter
2007-12-11 01:56 . 2007-12-11 01:56 <DIR> d-------- C:\Program Files\Codec Pack - All In 1
2007-12-11 01:56 . 2007-12-11 01:55 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-12-11 01:41 . 2007-12-11 01:41 <DIR> d-------- C:\Program Files\Common Files\NSV
2007-12-11 01:37 . 2007-12-11 01:37 <DIR> d-------- C:\Program Files\Winamp
2007-12-11 01:37 . 2007-12-11 01:40 <DIR> d-------- C:\Documents and Settings\Kendo\Application Data\Winamp
2007-12-10 00:20 . 2007-12-11 02:40 1,878 --a------ C:\WINDOWS\system32\PQ_BATCH.PQB
2007-12-10 00:17 . 2007-12-10 00:17 <DIR> d-------- C:\Program Files\PowerQuest
2007-12-10 00:17 . 2007-12-20 18:17 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-12-10 00:17 . 2001-08-10 07:00 1,262,956 --------- C:\WINDOWS\system32\XMNT2001.EXE
2007-12-10 00:17 . 2001-08-10 07:00 3,252 --------- C:\WINDOWS\system32\drivers\PQNTDRV.SYS
2007-12-10 00:16 . 2007-12-18 21:45 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-12-09 23:11 . 2007-12-09 23:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-09 23:00 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-12-09 23:00 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-12-09 23:00 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl
2007-12-09 23:00 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-12-09 23:00 . 2004-08-03 14:00 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-12-09 23:00 . 2004-08-03 14:04 169,240 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-12-09 23:00 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll
2007-12-09 22:55 . 2007-12-09 23:13 <DIR> d-------- C:\Documents and Settings\Kendo\Contacts
2007-12-09 22:54 . 2007-12-09 22:54 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-12-09 22:54 . 2008-01-03 17:44 <DIR> d-------- C:\Program Files\MSN Messenger
2007-12-09 22:15 . 2008-01-03 15:54 316,640 --a------ C:\WINDOWS\WMSysPr9.prx

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-04 12:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-03 13:18 913,408 ----a-w C:\WINDOWS\system32\xreglib.dll
2008-01-03 02:20 --------- d-----w C:\Documents and Settings\Kendo\Application Data\uTorrent
2007-12-11 00:53 --------- d-----w C:\Program Files\Google
2007-12-09 20:42 --------- d-----w C:\Program Files\uTorrent
2007-12-09 20:38 --------- d-----w C:\Program Files\BitComet
2007-12-09 20:11 --------- d-----w C:\Documents and Settings\Kendo\Application Data\Nexon
2007-12-09 19:20 558,142 ----a-w C:\WINDOWS\java\Packages\6ffflz9r.zip
2007-12-09 19:20 155,995 ----a-w C:\WINDOWS\java\Packages\4fxrdzd7.zip
2007-12-09 19:20 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((( [email protected]_17.35.51.89 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-04 15:17:24 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-05 14:26:06 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-01-04 15:17:24 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Geschiedenis\History.IE5\index.dat
+ 2008-01-05 14:26:06 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Geschiedenis\History.IE5\index.dat
- 2008-01-04 15:17:24 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-05 14:26:06 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-01-03 14:57:27 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-01-04 16:35:35 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-01-03 14:57:27 53,418 ----a-w C:\WINDOWS\system32\perfc013.dat
+ 2008-01-04 16:35:35 53,418 ----a-w C:\WINDOWS\system32\perfc013.dat
- 2008-01-03 14:57:27 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-01-04 16:35:35 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-01-03 14:57:27 364,330 ----a-w C:\WINDOWS\system32\perfh013.dat
+ 2008-01-04 16:35:35 364,330 ----a-w C:\WINDOWS\system32\perfh013.dat
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-11 13:00 13312]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-09 21:02 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-03-03 09:44 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl"
"NeroFilterCheck"="C:\WINDOWS\System32\NeroCheck.exe" [2001-07-09 11:50 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-11 02:14 185896]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-03-03 09:44 4595712]
"nwiz"="nwiz.exe" [2003-03-03 09:44 323584 C:\WINDOWS\system32\nwiz.exe]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2008-01-03 14:18 290816]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2008-01-03 14:18 69632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-11 13:00 13312]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-12-09 21:02:01]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=sockspy.dll

R2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\System32\DRIVERS\nvcap.sys [2002-12-17 12:54]
R2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\System32\DRIVERS\NVxbar.sys [2002-12-17 12:54]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\System32\DRIVERS\Cap7134.sys [2002-11-04 15:29]
R3 Intels51;Creatix V.9X DSP Data Fax Modem;C:\WINDOWS\System32\DRIVERS\ctxs51.sys [2002-07-01 15:10]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\System32\DRIVERS\PhTVTune.sys [2002-11-04 15:32]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 15:41:29
Windows 5.1.2600 Service Pack 1 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\System32\sockspy.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106]
-> C:\WINDOWS\system32\sockspy.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2800.1106]
-> C:\WINDOWS\System32\sockspy.dll
.
Voltooingstijd: 2008-01-05 15:43:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-05 14:43:03
ComboFix2.txt 2008-01-04 16:36:17
.
2008-01-03 03:02:11 --- E O F ---










Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:45:17, on 5-1-2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onlinesoccermanager.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1199328621828
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 5361 bytes

[Marckie]

Je logje ziet er goed uit.

Ga naar Start - Uitvoeren en tik in: ComboFix /u
Druk op Enter.

Update je antivirusprogramma en laat het de volledige computer controleren op aanwezigheid van malware.
Wordt er wat gevonden dan laat je dit verwijderen.

Scan de computer met een geupdate Ad-Aware 2007. Instructies vind je hier.
Deze scan doe je bij voorkeur in veilige modus.
Laat Ad-Aware 2007 verwijderen wat het vindt aan geïnfecteerde bestanden of malware gerelateerde registersleutels.

Herstart de computer en maak een nieuwe hijackthislog.
Meldt of er nog problemen zijn.

[kendoss]

op zich heb ik geen problemen meer met me pc.Maar ik soms wel ff een probleempje want soms als ik op een site surfen dan laad hij niet.Maar als ik nogmaals op enter druk dan weer wel.Dus hij laad dat pagina niet in 1 keer maar ik denk niet dat het door een virus komt maar denk dat het gewoon aan me verbinding ligt.Anders kan ik wel die IEfix gebruiken eventueel.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:59:49, on 7-1-2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onlinesoccermanager.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1199328621828
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 5584 bytes

[Marckie]

De scan met Ad-aware heb je niet uitgevoerd?

[kendoss]

scan heb ik al uitgevoerd ja Maarja op zich is dat niet zo'n groot probleem anders gebruik ik gewon die IEfix wel.

[Marckie]

Normaal zie je sleutels verschijnen van Ad-Aware in de hijackthislog, en die zie/zag ik niet.

Zijn er nog problemen?

[Marckie]

Ziet er goed uit.
Zijn er nog problemen?

[kendoss]

hmm tot nu toe gaat het goed ja geen echte lastige problemen meer.
Ik denk dat dit topic wel gesloten kan worden . Alsnog bedankt

[Marckie]

Graag gedaan.

Best dat je nog even alle bestaande systeemherstelpunten wist:
Schakel Systeemherstel uit. Herstart de computer. Schakel Systeemherstel weer in.
Systeemherstel uitschakelen.

Meer info over hoe je een nieuwe infectie kan voorkomen vind je hier en hier.

De status van deze thread zet ik op opgelost.
Indien er niet meer gereageerd wordt, zal binnen een 3-tal dagen deze thread automatisch verplaatst worden naar de sectie Opgeloste hijackthislogs en is een reactie niet meer mogelijk. Dit om het forum netjes en overzichtelijk te houden.
Blijkt dat er toch nog problemen zijn, en je wil weer reageren in dit topic, dan stuur je me een privé bericht met verzoek om heropening.