Worm/Virus; Zeer langzaam internet + popups

[Sseb]

Hallo Nucia,
Tot mijn verbazing heb ik waarschijnlijk een worm op mijn computer, die al door een Firewall is gedetecteert en verwijdert is maar dat betwijfel ik want:
ik krijg steeds popups zomaar en deze zijn niet tegen te houden
Internet is Ongelofelijk langzaam
Computer is ook wat langzamer
en Coockies doen het grotendeels niet (blijf niet ingelogd op sites ook al vink ik het aan)

dit is erg vervelend, Me Spyware en Virus scanners hebben niets gevonden maar het is toch wle heel vreemd!

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:04:31, on 21-4-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tribalwars.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "C:\Program Files\Hitman Pro\xphelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [fcfb9466] rundll32.exe "C:\WINDOWS\system32\apxiarsf.dll",b
O4 - HKLM\..\Run: [BMffc8a7fa] Rundll32.exe "C:\WINDOWS\system32\opqnxnre.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = D:\Documenten en settings\Eigenaar\Local Settings\Temp\{D37AEFA6-B2D3-46E2-94C4-BB6CB8DB1433}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Startup: RollerCoaster Tycoon 3_ Wild Registration.lnk = D:\Documenten en settings\Eigenaar\Local Settings\Temp\{743D43D9-6A6F-4B4A-AF0B-1619627076C0}\{45653847-497F-47BB-A878-46FBDE34A3E0}\ATR1.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070711/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1166921446718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168499889015
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyves.nl/statics/Aurigma/ImageUploader4.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F551} (Flatcast Viewer 4.15) - http://www.flatcast.com/de/download/NpFv415.dll
O21 - SSODL:
O21 - SSODL:
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

--
End of file - 8627 bytes

[Blackbird]

Hoi,

Ik ga even voor je kijken.

Met vriendelijke groet,
Blackbird

[Blackbird]

Hoi Sseb,

Er zijn inderdaad wat problemen te zien. Doe het volgende stapsgewijs. Sla geen enkele stap over!!!
Meld het als je een stap niet kunt uitvoeren.

1. Start HijackThis opnieuw en kies voor Do a system scan only.
Vink de volgende regels, indien aanwezig, aan:

O4 - HKLM\..\Run: [fcfb9466] rundll32.exe "C:\WINDOWS\system32\apxiarsf.dll",b
O4 - HKLM\..\Run: [BMffc8a7fa] Rundll32.exe "C:\WINDOWS\system32\opqnxnre.dll",s
O21 - SSODL:
O21 - SSODL:

Sluit nu eerst alle vensters!
Klik hierna onderin op Fix Checked.
Sluit HijackThis hierna af.
Start de computer opnieuw op.

2. Open een kladblokbestand.
Kopieer onderstaande (alles wat vetgedrukt is) in dit kladblokbestand.

@ECHO OFF
del "C:\WINDOWS\system32\apxiarsf.dll"
del "C:\WINDOWS\system32\opqnxnre.dll"
sc config "Adobe LM Service" start= disabled
EXIT

Ga naar Bestand - Opslaan als.
Bij "Opslaan in" kies je: Bureaublad
Bij "Bestandsnaam" zet je: del.bat
Bij "Opslaan als type" selecteer je: Alle bestanden (*.*).
Klik op de knop Opslaan.
Dubbelklik op del.bat en post de inhoud van de logfile die opent.


4. Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.


Met vriendelijke groet,
Blackbird

[Sseb]

[img][url=http://img398.imageshack.us/my.php?image=probleemmethijackhz6.png][img=http://img398.imageshack.us/img398/3306/probleemmethijackhz6.th.png][/img]
hmmm ik kan SSODL niet verwijderen dan krijg ik deze


..en Del.dat kan ik niet openen..
dat schijnt dn een beschadigd media bestand te zijn (NERO showtime opent)

[Sseb]

oh ik zie nu pas dat het plaatje erg klein is dus je moet even inzoomen dan kan je het wel lezen (inzoemen = CTRL+SCROLL)
en ik zie nu ook pas dat het niet DAT is maar BAT , dus heb ik ff nieuw kladblok .bat gemaakt,
en in het CMD scherpje dat dan opent staat er dat het de bestanden niet kan vinden

[Blackbird]

Hoi,

Kun je nog even de nieuwe logjes van HijackThis en ComboFix hier neerzetten?

Met vriendelijke groet,
Blackbird

[Sseb]

Dat is geen natuurlijk geen probleem

Hijackthis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:11:04, on 23-4-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tribalwars.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "C:\Program Files\Hitman Pro\xphelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = D:\Documenten en settings\Eigenaar\Local Settings\Temp\{D37AEFA6-B2D3-46E2-94C4-BB6CB8DB1433}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Startup: RollerCoaster Tycoon 3_ Wild Registration.lnk = D:\Documenten en settings\Eigenaar\Local Settings\Temp\{743D43D9-6A6F-4B4A-AF0B-1619627076C0}\{45653847-497F-47BB-A878-46FBDE34A3E0}\ATR1.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070711/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1166921446718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168499889015
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyves.nl/statics/Aurigma/ImageUploader4.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F551} (Flatcast Viewer 4.15) - http://www.flatcast.com/de/download/NpFv415.dll
O20 - Winlogon Notify: xxyyxyVl - xxyyxyVl.dll (file missing)
O21 - SSODL:
O21 - SSODL:
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

--
End of file - 9395 bytes


____________________________________________________________________________________________________ ____________

Combofix Log:

ComboFix 08-04-22.5 - Eigenaar 2008-04-23 17:00:27.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.469 [GMT 2:00]
Gestart vanuit: D:\Documenten en settings\Eigenaar\Mijn documenten\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\kmd.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\caxwadhq.dll
C:\WINDOWS\system32\cbXQgebC.dll
C:\WINDOWS\system32\ccolaasg.dll
C:\WINDOWS\system32\DghNWGgh.ini
C:\WINDOWS\system32\DghNWGgh.ini2
C:\WINDOWS\system32\eqtuncti.dll
C:\WINDOWS\system32\fevpeljn.ini
C:\WINDOWS\system32\hgGWNhgD.dll
C:\WINDOWS\system32\hjhrxghy.dll
C:\WINDOWS\system32\ianxppjc.dll
C:\WINDOWS\system32\moccmuqt.dll
C:\WINDOWS\system32\njlepvef.dll
C:\WINDOWS\system32\rqaikslf.dll
C:\WINDOWS\system32\trbjcdmc.dll
C:\WINDOWS\system32\xxyyxyVl.dll
C:\WINDOWS\system32\yhgxrhjh.ini

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-03-23 to 2008-04-23 ))))))))))))))))))))))))))))))
.

2008-04-21 02:07 . 2008-04-21 16:42 1,540,977 ---hs---- C:\WINDOWS\system32\fsraixpa.ini
2008-04-20 15:17 . 2008-04-20 15:17 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-04-20 02:49 . 2008-04-23 00:29 <DIR> dr-h----- D:\Documenten en settings\Eigenaar\Onlangs geopend
2008-04-20 02:00 . 2008-04-21 02:00 1,540,797 ---hs---- C:\WINDOWS\system32\bkltdhgc.ini
2008-04-20 01:59 . 2008-04-23 15:35 109,752 --a------ C:\WINDOWS\BMffc8a7fa.xml
2008-04-20 01:54 . 2008-04-20 01:54 <DIR> d-------- C:\Program Files\VstPlugins
2008-04-20 01:53 . 2003-06-20 13:28 1,777,664 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-04-19 22:26 . 2008-04-19 22:26 25 --a------ C:\WINDOWS\TDH_Launcher.ini
2008-04-19 13:39 . 2008-04-19 13:39 <DIR> d-------- C:\Mgame
2008-04-18 23:19 . 2008-04-20 01:55 <DIR> d-------- C:\Program Files\Image-Line
2008-04-18 15:10 . 2008-04-18 15:10 65,536 --a------ C:\WINDOWS\IFinst27.exe
2008-04-15 16:50 . 2008-04-15 16:50 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-04-10 20:22 . 2008-04-10 20:23 <DIR> d-------- D:\Documenten en settings\Eigenaar\Application Data\InfraRecorder
2008-04-05 21:21 . 1996-01-09 12:38 283,648 --a------ C:\WINDOWS\uninst.exe
2008-04-03 01:26 . 2008-04-03 01:26 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-03-28 22:13 . 2008-03-28 22:13 <DIR> d-------- D:\Documenten en settings\NetworkService.NT AUTHORITY.000\Application Data\Xfire
2008-03-28 18:00 . 2008-03-28 18:00 <DIR> d-------- C:\NES_
2008-03-27 13:45 . 2008-03-27 13:45 <DIR> d-------- D:\Documenten en settings\LocalService.NT AUTHORITY\Application Data\Xfire
2008-03-26 21:06 . 2008-04-20 01:09 4,299 --a------ C:\WINDOWS\system32\NvApps.xml
2008-03-26 20:38 . 2008-03-26 20:38 <DIR> d-------- D:\Documenten en settings\LocalService.NT AUTHORITY\Application Data\Webroot
2008-03-26 20:37 . 2008-03-26 20:37 <DIR> d--hs---- D:\Documenten en settings\NetworkService.NT AUTHORITY.000
2008-03-26 20:37 . 2008-03-26 20:37 <DIR> d--hs---- D:\Documenten en settings\LocalService.NT AUTHORITY
2008-03-26 20:37 . 2008-04-23 17:07 1,024 --ah----- D:\Documenten en settings\NetworkService.NT AUTHORITY.000\NtUser.dat.LOG
2008-03-26 20:37 . 2008-04-23 17:07 1,024 --ah----- D:\Documenten en settings\LocalService.NT AUTHORITY\NtUser.dat.LOG
2008-03-26 20:28 . 2008-03-26 20:28 552 --a------ C:\WINDOWS\system32\d3d8caps.dat

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-23 15:06 --------- d-----w C:\Program Files\Hitman Pro
2008-04-23 15:03 --------- d-----w D:\Documenten en settings\Eigenaar\Application Data\DNA
2008-04-23 14:09 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-23 14:09 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-22 21:53 --------- d-----w D:\Documenten en settings\All Users\Application Data\Google Updater
2008-04-21 19:08 --------- d-----w D:\Documenten en settings\Eigenaar\Application Data\Xfire
2008-04-21 18:19 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-20 15:59 --------- d-----w C:\Program Files\Fraps
2008-04-20 13:17 --------- d---a-w D:\Documenten en settings\All Users\Application Data\TEMP
2008-04-20 10:53 --------- d-----w D:\Documenten en settings\Eigenaar\Application Data\BitTorrent
2008-04-20 00:43 --------- d-----w D:\Documenten en settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-20 00:39 --------- d-----w C:\Program Files\Norton Security Scan
2008-04-19 13:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-19 01:17 --------- d-s---w C:\Program Files\Xfire
2008-04-03 14:27 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-28 20:12 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-28 19:52 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2008-03-28 12:13 --------- d-----w C:\Program Files\Java
2008-03-27 12:14 --------- d-----w C:\Program Files\Spyware Doctor
2008-03-21 10:49 --------- d-----w C:\Program Files\FDRLab
2008-03-20 08:10 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:10 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-14 19:42 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-03-13 16:59 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-11 20:35 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-01 16:35 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 18:06 --------- d-----w C:\Program Files\Common Files\PocketSoft
2008-02-29 08:58 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:58 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-26 19:14 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-26 19:10 --------- d-----w D:\Documenten en settings\All Users\Application Data\WLInstaller
2008-02-26 19:10 --------- d-----w C:\Program Files\Windows Live
2008-02-25 15:36 --------- d-----w C:\Program Files\Teach2000
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:39 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:39 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:39 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-02 19:17 88 --sh--r C:\WINDOWS\system32\11AAD81EEC.sys
2007-06-02 19:35 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-18 10:22 10,440,224 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-06-18 10:22 248,352 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-11-07 16:34 3739672]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 14:21 68856]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-09-08 01:01 43008]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 16:16 171464]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-04-11 16:39 288576]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:53 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-07 21:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-10-31 22:15 163840 C:\WINDOWS\system32\VTTrayp.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-28 01:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
"NWEReboot"=""
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-13 02:40 155648]
"Hitman Pro Expiration Helper"="C:\Program Files\Hitman Pro\xphelper.exe" [2007-02-21 11:37 596760]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-08-13 04:16 286720]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-26 02:55 185896]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]

D:\Documenten en settings\All Users\Menu Start\Programma's\Opstarten\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-05-24 14:21:16 125624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyyxyVl]
xxyyxyVl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 15:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009

R0 SSI;SSI;C:\WINDOWS\system32\Drivers\SSI.SYS [2005-12-15 05:06]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39]
S3 SndTDriverV32;SndTDriverV32;C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2007-06-04 13:18]
S3 XDva076;XDva076;C:\WINDOWS\system32\XDva076.sys

.
Inhoud van de 'Gedeelde Taken' map
"2008-04-20 20:58:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-18 13:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-23 17:06:20
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 67

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Voltooingstijd: 2008-04-23 17:09:50 - machine was rebooted [Eigenaar]
ComboFix-quarantined-files.txt 2008-04-23 15:09:47

Pre-Run: 9,828,614,144 bytes beschikbaar
Post-Run: 9,776,824,320 bytes beschikbaar

197 --- E O F --- 2008-04-11 14:51:31

[Blackbird]

Hoi,

1. Start HijackThis opnieuw en kies voor Do a system scan only.
Vink de volgende regels, indien aanwezig, aan:

O20 - Winlogon Notify: xxyyxyVl - xxyyxyVl.dll (file missing)

Sluit nu eerst alle vensters!
Klik hierna onderin op Fix Checked.
Sluit HijackThis hierna af.
Start de computer opnieuw op.

2. Laat verborgen bestanden zien.
Ga naar Deze Computer (te vinden in het startmenu en op het bureaublad).
Ga naar Extra > Mapopties.
Klik op tabblad Weergave.
Selecteer onderaan de lijst Verborgen bestanden en mappen weeregeven.

3. Ga naar Virustotal.
Kopieer/plak het volgende in het vak: C:\WINDOWS\system32\fsraixpa.ini.
Klik op de knop Bestand versturen.
Post de resultaten in je volgende reactie.

Doe dit ook voor de volgende bestanden:

C:\WINDOWS\system32\bkltdhgc.ini
C:\WINDOWS\BMffc8a7fa.xml
C:\WINDOWS\system32\d3d8caps.dat
C:\WINDOWS\system32\11AAD81EEC.sys
C:\WINDOWS\system32\KGyGaAvL.sys

Post ook deze resultaten in je volgende reactie.


Met vriendelijke groeten,
Blackbird

[Sseb]

hey, hier krijg je eerst de VirusTotal logjes van de site..
dit doe ik eerst want ik heb ook een vraag
ze zijn allemaal niet schadelijk en niet geinfecteerd...
Wat ik echt ook nog moet vragen is:
Ik heb altijd al de Verstopte en alle Geheime mappen openstaan en ik kan overal in maar
System32 ben ik nog NOOIT tegengekomen, niet in WINDOWS map niet in DATA map...
de map die er het dichtsbij komt heeft de naam C:\Windows\system en daar zit niets in van een system32
ik kan er alleen inkomen door via bijvoorbeeld VirusTool er in C:\Windows te gaan en dan bij bestanden System32 te typen.
en dan OK te klikken kom ik in de map System32.. wat dan ook opvalt:
al deze bestanden stonden er niet in!
het enige bestand dat ik heb kunnen vinden is C:\WINDOWS\BMffc8a7fa.xml en dat is een Kladblok. txt bestand en een
Kladblok. html bestand (uitverstand niet geopend )



C:\WINDOWS\system32\fsraixpa.ini. :




Bestand fsraixpa.ini. ontvangen op 2008.04.23 22:52:57 (CET)
Huidig status: Laden ... In wachtrij Wachtende Aan het scannen Einde NIET GEVONDEN GESTOPT


Resultaat: 0/32 (0%)
Server informatie laden...
Je bestand is in de wachtrij geplaatst, plaats: ___.
De gemiddelde starttijd ligt tussen ___ en ___ .
Laat dit venster open tijdens het scannen.
De scanner die je bestand aan het verwerken was is gestopt, gelieve enkele seconden te wachten terwijl we proberen je resultaat te herstellen.
Indien u meer dan 5 minuten wachten dient U uw bestand opnieuw in te sturen.
Je bestand word op dit moment gescand door VirusTotal,
De resultaten worden weergegeven zodra ze beschikbaar zijn.
Geformatteerd Resultaten afdrukken
Je bestand is vervallen of bestaat niet.
De dienst is momenteel gestopt, je bestand staat in de wachtrij (plaats: ) voor een onbekende tijd.

Je kan deze pagina open houden en wachten (automatische refresh) of je kan je e-mailadres hieronder invullen en op "Aanvraag verzenden" klikken zodat je de resultaten per mail ontvangt.
E-mail:


Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2008.4.23.0 2008.04.23 -
AntiVir 7.8.0.8 2008.04.23 -
Authentium 4.93.8 2008.04.22 -
Avast 4.8.1169.0 2008.04.23 -
AVG 7.5.0.516 2008.04.23 -
BitDefender 7.2 2008.04.23 -
CAT-QuickHeal 9.50 2008.04.23 -
ClamAV 0.92.1 2008.04.23 -
DrWeb 4.44.0.09170 2008.04.23 -
eSafe 7.0.15.0 2008.04.21 -
eTrust-Vet 31.3.5728 2008.04.23 -
Ewido 4.0 2008.04.23 -
F-Prot 4.4.2.54 2008.04.23 -
F-Secure 6.70.13260.0 2008.04.23 -
FileAdvisor 1 2008.04.23 -
Fortinet 3.14.0.0 2008.04.23 -
Ikarus T3.1.1.26 2008.04.23 -
Kaspersky 7.0.0.125 2008.04.23 -
McAfee 5279 2008.04.23 -
Microsoft 1.3408 2008.04.22 -
NOD32v2 3050 2008.04.23 -
Norman 5.80.02 2008.04.23 -
Panda 9.0.0.4 2008.04.23 -
Prevx1 V2 2008.04.23 -
Rising 20.41.22.00 2008.04.23 -
Sophos 4.28.0 2008.04.23 -
Sunbelt 3.0.1056.0 2008.04.17 -
Symantec 10 2008.04.23 -
TheHacker 6.2.92.289 2008.04.23 -
VBA32 3.12.6.4 2008.04.16 -
VirusBuster 4.3.26:9 2008.04.23 -
Webwasher-Gateway 6.6.2 2008.04.23 -
Extra informatie
File size: 1540977 bytes
MD5...: 77097cba21b7a1fb2ed487f5d4c280c8
SHA1..: 0773de4ab7caac354b65ab347756bf0dc397a237
SHA256: bec475475e4dc30a0f39e5ddefc10ba7e0c04840511d0a4c8293ff53d33f0dce
SHA512: f21415ee30bf45d0d19a457ba950af41d8106dc54f8cf49afaae9e2df0c04feb
af011ca9228ecb8a9c93f621378334e8034cccf7ec9f45207a18cb5d2e4b0ac9
PEiD..: -
PEInfo: -




C:\WINDOWS\system32\bkltdhgc.ini



Bestand bkltdhgc.ini ontvangen op 2008.04.23 23:01:05 (CET)
Huidig status: Einde

Resultaat: 0/32 (0.00%)
Geformatteerd Resultaten afdrukken
Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2008.4.23.0 2008.04.23 -
AntiVir 7.8.0.8 2008.04.23 -
Authentium 4.93.8 2008.04.22 -
Avast 4.8.1169.0 2008.04.23 -
AVG 7.5.0.516 2008.04.23 -
BitDefender 7.2 2008.04.23 -
CAT-QuickHeal 9.50 2008.04.23 -
ClamAV 0.92.1 2008.04.23 -
DrWeb 4.44.0.09170 2008.04.23 -
eSafe 7.0.15.0 2008.04.21 -
eTrust-Vet 31.3.5728 2008.04.23 -
Ewido 4.0 2008.04.23 -
F-Prot 4.4.2.54 2008.04.23 -
F-Secure 6.70.13260.0 2008.04.23 -
FileAdvisor 1 2008.04.23 -
Fortinet 3.14.0.0 2008.04.23 -
Ikarus T3.1.1.26 2008.04.23 -
Kaspersky 7.0.0.125 2008.04.23 -
McAfee 5279 2008.04.23 -
Microsoft None 2008.04.22 -
NOD32v2 3050 2008.04.23 -
Norman 5.80.02 2008.04.23 -
Panda 9.0.0.4 2008.04.23 -
Prevx1 V2 2008.04.23 -
Rising 20.41.22.00 2008.04.23 -
Sophos 4.28.0 2008.04.23 -
Sunbelt 3.0.1056.0 2008.04.17 -
Symantec 10 2008.04.23 -
TheHacker 6.2.92.289 2008.04.23 -
VBA32 3.12.6.5 2008.04.16 -
VirusBuster 4.3.26:9 2008.04.23 -
Webwasher-Gateway 6.6.2 2008.04.23 -
Extra informatie
File size: 1540797 bytes
MD5...: e2110f768daa2c1969ae1903fb4afebc
SHA1..: 07da9f3115cff0e6f0993744f8991969b122ba46
SHA256: 18c554bad450c01919fbdc6c40a0286b7af9ff883a4c2ea718c571b663fb37ab
SHA512: 95aecd4a225356b3a603da762e4108a52f22902166f163d01f45d570addc8a3b
8768f194d7095026897c568f9c3621ac11be4f0adfb3ca9782b0f813dbc8caa7
PEiD..: -
PEInfo: -








C:\WINDOWS\BMffc8a7fa.xml (een Kladblok Text bestand en een HTML bestand enige bestand dat te vinden is)


Bestand BMffc8a7fa.xml ontvangen op 2008.04.23 23:08:28 (CET)
Huidig status: Laden ... In wachtrij Wachtende Aan het scannen Einde NIET GEVONDEN GESTOPT


Resultaat: 0/32 (0%)
Server informatie laden...
Je bestand is in de wachtrij geplaatst, plaats: ___.
De gemiddelde starttijd ligt tussen ___ en ___ .
Laat dit venster open tijdens het scannen.
De scanner die je bestand aan het verwerken was is gestopt, gelieve enkele seconden te wachten terwijl we proberen je resultaat te herstellen.
Indien u meer dan 5 minuten wachten dient U uw bestand opnieuw in te sturen.
Je bestand word op dit moment gescand door VirusTotal,
De resultaten worden weergegeven zodra ze beschikbaar zijn.
Geformatteerd Resultaten afdrukken
Je bestand is vervallen of bestaat niet.
De dienst is momenteel gestopt, je bestand staat in de wachtrij (plaats: ) voor een onbekende tijd.

Je kan deze pagina open houden en wachten (automatische refresh) of je kan je e-mailadres hieronder invullen en op "Aanvraag verzenden" klikken zodat je de resultaten per mail ontvangt.
E-mail:


Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2008.4.23.0 2008.04.23 -
AntiVir 7.8.0.8 2008.04.23 -
Authentium 4.93.8 2008.04.22 -
Avast 4.8.1169.0 2008.04.23 -
AVG 7.5.0.516 2008.04.23 -
BitDefender 7.2 2008.04.23 -
CAT-QuickHeal 9.50 2008.04.23 -
ClamAV 0.92.1 2008.04.23 -
DrWeb 4.44.0.09170 2008.04.23 -
eSafe 7.0.15.0 2008.04.21 -
eTrust-Vet 31.3.5728 2008.04.23 -
Ewido 4.0 2008.04.23 -
F-Prot 4.4.2.54 2008.04.23 -
F-Secure 6.70.13260.0 2008.04.23 -
FileAdvisor 1 2008.04.23 -
Fortinet 3.14.0.0 2008.04.23 -
Ikarus T3.1.1.26 2008.04.23 -
Kaspersky 7.0.0.125 2008.04.23 -
McAfee 5279 2008.04.23 -
Microsoft 1.3408 2008.04.22 -
NOD32v2 3050 2008.04.23 -
Norman 5.80.02 2008.04.23 -
Panda 9.0.0.4 2008.04.23 -
Prevx1 V2 2008.04.23 -
Rising 20.41.22.00 2008.04.23 -
Sophos 4.28.0 2008.04.23 -
Sunbelt 3.0.1056.0 2008.04.17 -
Symantec 10 2008.04.23 -
TheHacker 6.2.92.289 2008.04.23 -
VBA32 3.12.6.4 2008.04.16 -
VirusBuster 4.3.26:9 2008.04.23 -
Webwasher-Gateway 6.6.2 2008.04.23 -
Extra informatie
File size: 109752 bytes
MD5...: 8226537b37a7db2004723eb551ec8701
SHA1..: e3c42d1540ce651904a681fd35462e602e48bcc8
SHA256: b815e4952f7435d82fcd5e5a32844cd97ae3ff449cfb086784ef336c9f0cff6e
SHA512: cd7d221aedd79566d81124e23f7f5d5ee0e1b4af77a4b9624a24c0eb908a429b
032c127a0819832e6a7e35259b845bb182170572cb93c2667b4ac416e687dc32
PEiD..: -
PEInfo: -





C:\WINDOWS\system32\d3d8caps.dat


Bestand d3d8caps.dat ontvangen op 2008.04.23 23:19:00 (CET)
Huidig status: Laden ... In wachtrij Wachtende Aan het scannen Einde NIET GEVONDEN GESTOPT


Resultaat: 0/32 (0%)
Server informatie laden...
Je bestand is in de wachtrij geplaatst, plaats: ___.
De gemiddelde starttijd ligt tussen ___ en ___ .
Laat dit venster open tijdens het scannen.
De scanner die je bestand aan het verwerken was is gestopt, gelieve enkele seconden te wachten terwijl we proberen je resultaat te herstellen.
Indien u meer dan 5 minuten wachten dient U uw bestand opnieuw in te sturen.
Je bestand word op dit moment gescand door VirusTotal,
De resultaten worden weergegeven zodra ze beschikbaar zijn.
Geformatteerd Resultaten afdrukken
Je bestand is vervallen of bestaat niet.
De dienst is momenteel gestopt, je bestand staat in de wachtrij (plaats: ) voor een onbekende tijd.

Je kan deze pagina open houden en wachten (automatische refresh) of je kan je e-mailadres hieronder invullen en op "Aanvraag verzenden" klikken zodat je de resultaten per mail ontvangt.
E-mail:


Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2008.4.23.0 2008.04.23 -
AntiVir 7.8.0.8 2008.04.23 -
Authentium 4.93.8 2008.04.22 -
Avast 4.8.1169.0 2008.04.23 -
AVG 7.5.0.516 2008.04.23 -
BitDefender 7.2 2008.04.23 -
CAT-QuickHeal 9.50 2008.04.23 -
ClamAV 0.92.1 2008.04.23 -
DrWeb 4.44.0.09170 2008.04.23 -
eSafe 7.0.15.0 2008.04.21 -
eTrust-Vet 31.3.5728 2008.04.23 -
Ewido 4.0 2008.04.23 -
F-Prot 4.4.2.54 2008.04.23 -
F-Secure 6.70.13260.0 2008.04.23 -
FileAdvisor 1 2008.04.23 -
Fortinet 3.14.0.0 2008.04.23 -
Ikarus T3.1.1.26 2008.04.23 -
Kaspersky 7.0.0.125 2008.04.23 -
McAfee 5279 2008.04.23 -
Microsoft 1.3408 2008.04.22 -
NOD32v2 3050 2008.04.23 -
Norman 5.80.02 2008.04.23 -
Panda 9.0.0.4 2008.04.23 -
Prevx1 V2 2008.04.23 -
Rising 20.41.22.00 2008.04.23 -
Sophos 4.28.0 2008.04.23 -
Sunbelt 3.0.1056.0 2008.04.17 -
Symantec 10 2008.04.23 -
TheHacker 6.2.92.289 2008.04.23 -
VBA32 3.12.6.4 2008.04.16 -
VirusBuster 4.3.26:9 2008.04.23 -
Webwasher-Gateway 6.6.2 2008.04.23 -
Extra informatie
File size: 552 bytes
MD5...: caed7967d11d24486dc7c8c13bf5db98
SHA1..: 900f9efbcb0da0ecdeb85bc813ba6e70ff645ded
SHA256: 3d72859bdb40fe346baa878be95bcd34b0d080cd06f463a74f00a2b986801421
SHA512: ed0bd0f62a7518bb53ed51c89977e9ff32a5c40609a827f66d161fa52010efe8
f170d541a0b8b44640d60f75762ee8b44e2c65d940acf1d1ac385a9bf1ee3f62
PEiD..: -
PEInfo: -





C:\WINDOWS\system32\11AAD81EEC.sys


Bestand 11AAD81EEC.sys ontvangen op 2008.04.23 23:22:37 (CET)
Huidig status: Laden ... In wachtrij Wachtende Aan het scannen Einde NIET GEVONDEN GESTOPT


Resultaat: 0/32 (0%)
Server informatie laden...
Je bestand is in de wachtrij geplaatst, plaats: 3.
De gemiddelde starttijd ligt tussen 43 en 61 seconden.
Laat dit venster open tijdens het scannen.
De scanner die je bestand aan het verwerken was is gestopt, gelieve enkele seconden te wachten terwijl we proberen je resultaat te herstellen.
Indien u meer dan 5 minuten wachten dient U uw bestand opnieuw in te sturen.
Je bestand word op dit moment gescand door VirusTotal,
De resultaten worden weergegeven zodra ze beschikbaar zijn.
Geformatteerd Resultaten afdrukken
Je bestand is vervallen of bestaat niet.
De dienst is momenteel gestopt, je bestand staat in de wachtrij (plaats: ) voor een onbekende tijd.

Je kan deze pagina open houden en wachten (automatische refresh) of je kan je e-mailadres hieronder invullen en op "Aanvraag verzenden" klikken zodat je de resultaten per mail ontvangt.
E-mail:


Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2008.4.23.0 2008.04.23 -
AntiVir 7.8.0.8 2008.04.23 -
Authentium 4.93.8 2008.04.22 -
Avast 4.8.1169.0 2008.04.23 -
AVG 7.5.0.516 2008.04.23 -
BitDefender 7.2 2008.04.23 -
CAT-QuickHeal 9.50 2008.04.23 -
ClamAV None 2008.04.23 -
DrWeb 4.44.0.09170 2008.04.23 -
eSafe 7.0.15.0 2008.04.21 -
eTrust-Vet 31.3.5728 2008.04.23 -
Ewido 4.0 2008.04.23 -
F-Prot 4.4.2.54 2008.04.23 -
F-Secure 6.70.13260.0 2008.04.23 -
FileAdvisor 1 2008.04.23 -
Fortinet 3.14.0.0 2008.04.23 -
Ikarus T3.1.1.26.0 2008.04.23 -
Kaspersky 7.0.0.125 2008.04.23 -
McAfee 5279 2008.04.23 -
Microsoft 1.3408 2008.04.22 -
NOD32v2 3050 2008.04.23 -
Norman 5.80.02 2008.04.23 -
Panda 9.0.0.4 2008.04.23 -
Prevx1 V2 2008.04.23 -
Rising 20.41.22.00 2008.04.23 -
Sophos 4.28.0 2008.04.23 -
Sunbelt 3.0.1056.0 2008.04.17 -
Symantec 10 2008.04.23 -
TheHacker 6.2.92.289 2008.04.23 -
VBA32 3.12.6.4 2008.04.16 -
VirusBuster 4.3.26:9 2008.04.23 -
Webwasher-Gateway 6.6.2 2008.04.23 -
Extra informatie
File size: 88 bytes
MD5...: 553b6fdee1a92ad7acef059bedbeaef3
SHA1..: f5eb8b76d407294ded0a4c5718aa3aededf9129a
SHA256: 6fa8d73bbe1bde02647e1aba58b7e6990bb2fb412d6be781ce54335f83069ebf
SHA512: 14682cb45fa2e9052e0e84f42c2b396c832a510b104f422238e3d3e508ec011f
8ac99fabf35edb13635941d12b35691269c24e37bf26164bfad600dc0ce7d026
PEiD..: -
PEInfo: -








C:\WINDOWS\system32\KGyGaAvL.sys


Bestand KGyGaAvL.sys ontvangen op 2008.04.23 23:24:28 (CET)
Huidig status: Laden ... In wachtrij Wachtende Aan het scannen Einde NIET GEVONDEN GESTOPT


Resultaat: 0/32 (0%)
Server informatie laden...
Je bestand is in de wachtrij geplaatst, plaats: 1.
De gemiddelde starttijd ligt tussen 36 en 52 seconden.
Laat dit venster open tijdens het scannen.
De scanner die je bestand aan het verwerken was is gestopt, gelieve enkele seconden te wachten terwijl we proberen je resultaat te herstellen.
Indien u meer dan 5 minuten wachten dient U uw bestand opnieuw in te sturen.
Je bestand word op dit moment gescand door VirusTotal,
De resultaten worden weergegeven zodra ze beschikbaar zijn.
Geformatteerd Resultaten afdrukken
Je bestand is vervallen of bestaat niet.
De dienst is momenteel gestopt, je bestand staat in de wachtrij (plaats: ) voor een onbekende tijd.

Je kan deze pagina open houden en wachten (automatische refresh) of je kan je e-mailadres hieronder invullen en op "Aanvraag verzenden" klikken zodat je de resultaten per mail ontvangt.
E-mail:


Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2008.4.23.0 2008.04.23 -
AntiVir 7.8.0.8 2008.04.23 -
Authentium 4.93.8 2008.04.22 -
Avast 4.8.1169.0 2008.04.23 -
AVG 7.5.0.516 2008.04.23 -
BitDefender 7.2 2008.04.23 -
CAT-QuickHeal 9.50 2008.04.23 -
ClamAV 0.92.1 2008.04.23 -
DrWeb 4.44.0.09170 2008.04.23 -
eSafe 7.0.15.0 2008.04.21 -
eTrust-Vet 31.3.5728 2008.04.23 -
Ewido 4.0 2008.04.23 -
F-Prot 4.4.2.54 2008.04.23 -
F-Secure 6.70.13260.0 2008.04.23 -
FileAdvisor 1 2008.04.23 -
Fortinet 3.14.0.0 2008.04.23 -
Ikarus T3.1.1.26.0 2008.04.23 -
Kaspersky 7.0.0.125 2008.04.23 -
McAfee 5279 2008.04.23 -
Microsoft 1.3408 2008.04.22 -
NOD32v2 3050 2008.04.23 -
Norman 5.80.02 2008.04.23 -
Panda 9.0.0.4 2008.04.23 -
Prevx1 V2 2008.04.23 -
Rising 20.41.22.00 2008.04.23 -
Sophos 4.28.0 2008.04.23 -
Sunbelt 3.0.1056.0 2008.04.17 -
Symantec 10 2008.04.23 -
TheHacker 6.2.92.289 2008.04.23 -
VBA32 3.12.6.4 2008.04.16 -
VirusBuster 4.3.26:9 2008.04.23 -
Webwasher-Gateway 6.6.2 2008.04.23 -
Extra informatie
File size: 3350 bytes
MD5...: 2507c7004ed60f44063cd52b55636355
SHA1..: 152eb2811209b4fb03babe15468e99df1916958c
SHA256: 09abadc13f452cd336c5579b628d8dce36e5a96615feb7118e689c36cd43b5e7
SHA512: 9ead22f2dc62ad78d6a937eee56e03ce4b7903a95cb79eec497b1cfa25424d10
56a6a71f5dbf88e7934378c8871f74a88efeaa1f1b8688fb69e3e8f56cdbfae6
PEiD..: -
PEInfo: -


Dit waren ze ik hoop dat je er wat in kan vinden dat toch weg moet

[Sseb]

hier is hijack
ik kan SSODL: niet verwijderen! het is ook niet bekent bij Hijackthis heb ik uitgevonden

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:35:40, on 23-4-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tribalwars.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "C:\Program Files\Hitman Pro\xphelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = D:\Documenten en settings\Eigenaar\Local Settings\Temp\{D37AEFA6-B2D3-46E2-94C4-BB6CB8DB1433}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Startup: RollerCoaster Tycoon 3_ Wild Registration.lnk = D:\Documenten en settings\Eigenaar\Local Settings\Temp\{743D43D9-6A6F-4B4A-AF0B-1619627076C0}\{45653847-497F-47BB-A878-46FBDE34A3E0}\ATR1.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070711/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1166921446718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168499889015
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyves.nl/statics/Aurigma/ImageUploader4.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F551} (Flatcast Viewer 4.15) - http://www.flatcast.com/de/download/NpFv415.dll
O21 - SSODL:
O21 - SSODL:
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

--
End of file - 9321 bytes

[Blackbird]

Hoi,

Open een kladblokbestand.
Kopieer onderstaande (alles wat vetgedrukt is) in dit kladblokbestand.

@ECHO OFF
IF EXIST log.txt DEL log.txt
ECHO Deleting files>>log.txt
FOR %%g in (
C:\WINDOWS\system32\fsraixpa.ini
C:\WINDOWS\system32\bkltdhgc.ini
C:\WINDOWS\BMffc8a7fa.xml
C:\WINDOWS\BMffc8a7fa.txt) DO (
IF EXIST %%g (
ATTRIB -r -s -h %%g
DEL %%g
IF EXIST %%g (
ECHO %%g not deleted>>log.txt
) ELSE (
ECHO %%g deleted>>log.txt)
) ELSE (
ECHO %%g not found>>log.txt))
START NOTEPAD.EXE log.txt

Ga naar Bestand - Opslaan als.
Bij "Opslaan in" kies je: Bureaublad
Bij "Bestandsnaam" zet je: del.bat
Bij "Opslaan als type" selecteer je: Alle bestanden (*.*).
Klik op de knop Opslaan.
Dubbelklik op del.bat en post de inhoud van de logfile die opent.


Met vriendelijke groet,
Blackbird

[Sseb]

Deleting files
C:\WINDOWS\system32\fsraixpa.ini deleted
C:\WINDOWS\system32\bkltdhgc.ini deleted
C:\WINDOWS\BMffc8a7fa.xml deleted
C:\WINDOWS\BMffc8a7fa.txt deleted

[Blackbird]

Hoi,

Kun je even nieuwe logs van HijackThis en ComboFix posten?

Met vriendelijke groet,
Blackbird

[Sseb]

geen probleem

ComboFix 08-04-22.5 - Eigenaar 2008-04-25 22:57:56.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.513 [GMT 2:00]
Gestart vanuit: D:\Documenten en settings\Eigenaar\Mijn documenten\ComboFix.exe

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((( Bestanden Gemaakt van 2008-03-25 to 2008-04-25 ))))))))))))))))))))))))))))))
.

2008-04-25 17:41 . 2008-04-25 17:41 <DIR> d-------- C:\Program Files\BitTorrent
2008-04-20 15:17 . 2008-04-20 15:17 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-04-20 02:49 . 2008-04-25 20:02 <DIR> dr-h----- D:\Documenten en settings\Eigenaar\Onlangs geopend
2008-04-20 01:54 . 2008-04-20 01:54 <DIR> d-------- C:\Program Files\VstPlugins
2008-04-20 01:53 . 2003-06-20 13:28 1,777,664 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-04-19 22:26 . 2008-04-19 22:26 25 --a------ C:\WINDOWS\TDH_Launcher.ini
2008-04-19 13:39 . 2008-04-19 13:39 <DIR> d-------- C:\Mgame
2008-04-18 23:19 . 2008-04-20 01:55 <DIR> d-------- C:\Program Files\Image-Line
2008-04-18 15:10 . 2008-04-18 15:10 65,536 --a------ C:\WINDOWS\IFinst27.exe
2008-04-15 16:50 . 2008-04-24 22:50 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-04-10 20:22 . 2008-04-10 20:23 <DIR> d-------- D:\Documenten en settings\Eigenaar\Application Data\InfraRecorder
2008-04-05 21:21 . 1996-01-09 12:38 283,648 --a------ C:\WINDOWS\uninst.exe
2008-04-03 01:26 . 2008-04-03 01:26 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-03-28 22:13 . 2008-03-28 22:13 <DIR> d-------- D:\Documenten en settings\NetworkService.NT AUTHORITY.000\Application Data\Xfire
2008-03-28 18:00 . 2008-03-28 18:00 <DIR> d-------- C:\NES_
2008-03-27 13:45 . 2008-03-27 13:45 <DIR> d-------- D:\Documenten en settings\LocalService.NT AUTHORITY\Application Data\Xfire
2008-03-26 21:06 . 2008-04-20 01:09 4,299 --a------ C:\WINDOWS\system32\NvApps.xml
2008-03-26 20:38 . 2008-03-26 20:38 <DIR> d-------- D:\Documenten en settings\LocalService.NT AUTHORITY\Application Data\Webroot
2008-03-26 20:37 . 2008-03-26 20:37 <DIR> d--hs---- D:\Documenten en settings\NetworkService.NT AUTHORITY.000
2008-03-26 20:37 . 2008-03-26 20:37 <DIR> d--hs---- D:\Documenten en settings\LocalService.NT AUTHORITY
2008-03-26 20:37 . 2008-04-25 16:42 1,024 --ah----- D:\Documenten en settings\NetworkService.NT AUTHORITY.000\NtUser.dat.LOG
2008-03-26 20:37 . 2008-04-25 16:42 1,024 --ah----- D:\Documenten en settings\LocalService.NT AUTHORITY\NtUser.dat.LOG
2008-03-26 20:28 . 2008-03-26 20:28 552 --a------ C:\WINDOWS\system32\d3d8caps.dat

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-25 20:52 --------- d-----w D:\Documenten en settings\Eigenaar\Application Data\DNA
2008-04-25 20:52 --------- d-----w D:\Documenten en settings\Eigenaar\Application Data\BitTorrent
2008-04-25 14:42 --------- d-----w C:\Program Files\Hitman Pro
2008-04-24 19:14 --------- d-----w C:\Program Files\Norton Security Scan
2008-04-24 13:19 --------- d-----w D:\Documenten en settings\All Users\Application Data\Google Updater
2008-04-23 18:23 --------- d-----w D:\Documenten en settings\Eigenaar\Application Data\Xfire
2008-04-23 14:09 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-04-23 14:09 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-04-21 18:19 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-20 15:59 --------- d-----w C:\Program Files\Fraps
2008-04-20 13:17 --------- d---a-w D:\Documenten en settings\All Users\Application Data\TEMP
2008-04-20 00:43 --------- d-----w D:\Documenten en settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-19 13:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-19 01:17 --------- d-s---w C:\Program Files\Xfire
2008-04-03 14:27 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-28 20:12 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2008-03-28 19:52 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2008-03-28 12:13 --------- d-----w C:\Program Files\Java
2008-03-27 12:14 --------- d-----w C:\Program Files\Spyware Doctor
2008-03-21 10:49 --------- d-----w C:\Program Files\FDRLab
2008-03-20 08:10 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:10 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-14 19:42 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-03-13 16:59 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-11 20:35 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-01 16:35 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 18:06 --------- d-----w C:\Program Files\Common Files\PocketSoft
2008-02-29 08:58 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:58 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-26 19:14 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-26 19:10 --------- d-----w D:\Documenten en settings\All Users\Application Data\WLInstaller
2008-02-26 19:10 --------- d-----w C:\Program Files\Windows Live
2008-02-25 15:36 --------- d-----w C:\Program Files\Teach2000
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:39 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:39 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:39 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-02 19:17 88 --sh--r C:\WINDOWS\system32\11AAD81EEC.sys
2007-06-02 19:35 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-18 10:22 10,440,224 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-06-18 10:22 248,352 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
.

((((((((((((((((((((((((((((( [email protected]_17.09.36.28 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-23 15:05:19 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-25 14:41:54 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-11-07 16:34 3739672]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 14:21 68856]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 16:16 171464]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-04-11 16:39 288576]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 08:53 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-07 21:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-10-31 22:15 163840 C:\WINDOWS\system32\VTTrayp.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-28 01:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
"NWEReboot"=""
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-13 02:40 155648]
"Hitman Pro Expiration Helper"="C:\Program Files\Hitman Pro\xphelper.exe" [2007-02-21 11:37 596760]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-08-13 04:16 286720]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-26 02:55 185896]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]

D:\Documenten en settings\All Users\Menu Start\Programma's\Opstarten\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-05-24 14:21:16 125624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 15:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009

R0 SSI;SSI;C:\WINDOWS\system32\Drivers\SSI.SYS [2005-12-15 05:06]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 05:38]
R0 xfilt;VIA SATA IDE Hot-plug Driver;C:\WINDOWS\system32\DRIVERS\xfilt.sys [2006-02-23 05:39]
S3 SndTDriverV32;SndTDriverV32;C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2007-06-04 13:18]
S3 XDva076;XDva076;C:\WINDOWS\system32\XDva076.sys

*Newly Created Service* - CATCHME
.
Inhoud van de 'Gedeelde Taken' map
"2008-04-20 20:58:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-18 13:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-25 23:00:13
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Voltooingstijd: 2008-04-25 23:01:31
ComboFix-quarantined-files.txt 2008-04-25 21:01:05
ComboFix2.txt 2008-04-23 15:09:51

Pre-Run: 9,765,261,312 bytes beschikbaar
Post-Run: 9,753,522,176 bytes beschikbaar

162 --- E O F --- 2008-04-11 14:51:31

</tr>


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:03:34, on 25-4-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Windows Live\Messenger\wlcsdk.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tribalwars.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "C:\Program Files\Hitman Pro\xphelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = D:\Documenten en settings\Eigenaar\Local Settings\Temp\{D37AEFA6-B2D3-46E2-94C4-BB6CB8DB1433}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
O4 - Startup: RollerCoaster Tycoon 3_ Wild Registration.lnk = D:\Documenten en settings\Eigenaar\Local Settings\Temp\{743D43D9-6A6F-4B4A-AF0B-1619627076C0}\{45653847-497F-47BB-A878-46FBDE34A3E0}\ATR1.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070711/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1166921446718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168499889015
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyves.nl/statics/Aurigma/ImageUploader4.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F551} (Flatcast Viewer 4.15) - http://www.flatcast.com/de/download/NpFv415.dll
O21 - SSODL:
O21 - SSODL:
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

--
End of file - 9488 bytes

[Blackbird]

Hoi,

Dat ziet er weer schoon uit.

Verwijder ComboFix op de volgende manier:
Ga naar Start > Uitvoeren, en typ daar in: combofix /U.


Je Java software is verouderd.
Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.
Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

Download Java Runtime Environment (JRE) 6u6.

• Scroll omlaag naar : "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Klik op de "Download" knop aan de rechterkant.
• Vink aan: "Accept License Agreement".
• De pagina zal herladen.
• Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen, en bewaar het naar je Bureaublad.
• Sluit alle programma's die eventueel open zijn - Zeker je web browser!
• Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.
• Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
• Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
• Herhaal dit tot alle oudere versies verdwenen zijn.
• Na het verwijderen van alle oudere versies, herstart je pc.
• Dubbelklik vervolgens op jre-6u6-windows-i586-p.exe op je Bureaublad om de nieuwste versie van Java te installeren.

Met vriendelijke groet,
Blackbird