het zat vol met virussen...nu nog?

Oke,

Dat gekke sekeen is verwijderd. En hier het gevraagde logje na de superantispyware scan. Zoals je ziet heeft hij er weer een aantal uit gehaald.

Kun je hier iets mee?

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 12/10/2008 at 09:18 PM

Application Version : 4.23.1006

Core Rules Database Version : 3670

Trace Rules Database Version: 1649

Scan type : Complete Scan

Total Scan Time : 00:46:22

Memory items scanned : 520

Memory threats detected : 0

Registry items scanned : 6355

Registry threats detected : 5

File items scanned : 26007

File threats detected : 42

Unclassified.Unknown Origin

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-A0E8-F362B685FA7D}

HKU\S-1-5-21-1640954064-3434611976-1337692529-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4E7BD74F-2B8D-469E-A0E8-F362B685FA7D}

HKLM\Software\Microsoft\Internet Explorer\Toolbar#{4E7BD74F-2B8D-469E-A0E8-F362B685FA7D}

Adware.E404 Helper/Variant-AB

HKU\S-1-5-21-1640954064-3434611976-1337692529-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0cc6db27-243b-4450-96a7-7e868225858d}

Adware.Tracking Cookie

C:\Documents and Settings\Nik\Cookies\nik@www.googleadservices.txt

C:\Documents and Settings\Nik\Cookies\nik@serving-sys.txt

C:\Documents and Settings\Nik\Cookies\nik@pixel.ilsemedia.txt

C:\Documents and Settings\Nik\Cookies\nik@cms.trafficmp.txt

C:\Documents and Setting\Cookies\nik@www.googleadservices.txt

C:\Documents and Settings\Nik\Cookies\nik@msnportal.112.2o7.txt

C:\Documents and Settings\Nik\Cookies\nik@xiti.txt

C:\Documents and Settings\Nik\Cookies\@eas.apm.emediate.txt

C:\Documents and Settings\Nik\Cookies\nik@adserver.easyad.txt

C:\Documents and Settings\Nik\Cookies\nik@www.googleadservices.txt

C:\Documents and Settings\Nik\Cookies\nik@adserver.checkpoint-online.txt

C:\Documents and Settings\Nik\Cookies\nik@www.googleadservices.txt

C:\Documents and Settings\Nik\Cookies\nik@bluemango.solution.weborama.txt

C:\Documents and Settings\Nik\Cookies\nik@msnservices.112.2o7.txt

C:\Documents and Settings\Nik\Cookies\nik@www.googleadservices.txt

C:\Documents and Settings\Nik\Cookies\nik@rambler.txt

C:\Documents and Settings\Nik\Cookies\nik@adserver.adremedy.txt

C:\Documents and Settings\Nik\Cookies\nik@bs.serving-sys.txt

C:\Documents and Settings\Nik\Cookies\nik@checkstat.txt

C:\Documents and Settings\Nik\Cookies\nik@weborama.txt

C:\Documents and Settings\Nik\Cookies\nik@tripod.lycos.txt

C:\Documents and Settings\Nik\Cookies\nik@adserver.adremedy.txt

C:\Documents and Settings\Nik\Cookies\nik@2o7.txt

C:\Documents and Settings\Nik\Cookies\nik@stats.ilsemedia.txt

C:\Documents and Settings\Nik\Cookies\nik@adverteerders.manao.txt

C:\Documents and Settings\Nik\Cookies\nik@at.atwola.txt

C:\Documents and Settings\Nik\Cookies\nik@kassa.sexall.txt

C:\Documents and Settings\Nik\Cookies\nik@tacoda.txt

C:\Documents and Settings\Nik\Cookies\nik@ad.yieldmanager.txt

C:\Documents and Settings\Nik\Cookies\nik@bt.ilsemedia.txt

C:\Documents and Settings\Nik\Cookies\nik@ads.tripod.lycos.txt

C:\Documents and Settings\Nik\Cookies\nik@stats.ilsemedia.txt

C:\Documents and Settings\Nik\Cookies\nik@bt.ilsemedia.txt

Trojan.DNSChanger-Codec

HKU\S-1-5-21-1640954064-3434611976-1337692529-1006\Software\uninstall

Trojan.Seekeen

C:\SYSTEM VOLUME INFORMATION\_RESTORE{D786E0BB-1C34-4673-BCA6-1BB91F86BD21}\RP104\A0031765.EXE

C:\SYSTEM VOLUME INFORMATION\_RESTORE{D786E0BB-1C34-4673-BCA6-1BB91F86BD21}\RP104\A0031775.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{D786E0BB-1C34-4673-BCA6-1BB91F86BD21}\RP104\A0031776.EXE

C:\SYSTEM VOLUME INFORMATION\_RESTORE{D786E0BB-1C34-4673-BCA6-1BB91F86BD21}\RP111\A0036628.EXE

C:\SYSTEM VOLUME INFORMATION\_RESTORE{D786E0BB-1C34-4673-BCA6-1BB91F86BD21}\RP111\A0036632.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{D786E0BB-1C34-4673-BCA6-1BB91F86BD21}\RP111\A0036633.EXE

Oke het is gelukt!

Ik heb nu het volgende:

ComboFix 08-12-13.03 - Nik Landzaat 2008-12-14 14:37:58.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1043.18.1014.535

Gestart vanuit: c:\documents and settings\Nik Landzaat\Bureaublad\ComboFix.exe

* Nieuw herstelpunt werd aangemaakt

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

c:\windows\system32\cabine.dll . . . . konden niet verwijderd worden

(((((((((((((((((((( Bestanden Gemaakt van 2008-11-14 to 2008-12-14 ))))))))))))))))))))))))))))))

2008-12-10 20:28 . 2008-12-10 20:28 d——– c:\program files\SUPERAntiSpyware

2008-12-10 20:28 . 2008-12-10 20:28 d——– c:\documents and settings\Nik Landzaat\Application Data\SUPERAntiSpyware.com

2008-12-10 20:28 . 2008-12-10 20:28 d——– c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2008-12-10 19:33 . 2005-01-14 09:32 53,248 –a—— c:\windows\system32\PAStiSvc.exe

2008-12-10 19:30 . 2008-12-10 19:30 d——– c:\windows\PixArt

2008-12-10 19:30 . 2008-12-10 19:30 d——– c:\program files\PC Camera

2008-12-10 19:30 . 2008-12-10 19:30 d——– c:\program files\Common Files\PCCamera

2008-12-08 19:02 . 2008-12-08 19:02 d——– c:\program files\Programmabestanden

2008-12-08 19:01 . 2008-12-08 19:01 d——– c:\documents and settings\Nik Landzaat\Application Data\InstallShield

2008-12-08 19:01 . 2008-12-08 19:02 1,123 –a—— c:\windows\disney.ini

2008-12-08 19:01 . 2008-12-08 19:01 179 –a—— c:\windows\disneysy.ini

2008-12-03 19:56 . 2008-12-03 20:00 d——– c:\temp\cs120_XP

2008-12-03 19:47 . 2008-12-03 19:47 d——– c:\program files\iXi Tools

2008-12-03 19:39 . 2008-12-03 19:44 d——– c:\documents and settings\Nik Landzaat\Application Data\Uniblue

2008-12-03 19:39 . 2008-12-03 19:44 d——– c:\documents and settings\All Users\Application Data\DriverScanner

2008-12-02 17:56 . 2008-12-02 17:56 d——– c:\temp\cs120_98

2008-12-02 15:13 . 2008-12-02 15:13 d——– c:\documents and settings\All Users\Application Data\Winferno

2008-12-02 15:09 . 2008-12-02 15:09 d——– c:\program files\Freeze.com

2008-12-02 15:09 . 2005-05-27 12:51 520,192 –a—— c:\windows\Living 3D Fireplace 2.scr

2008-12-02 15:08 . 2008-12-02 15:08 d——– c:\program files\Free Offers from Freeze.com

2008-12-02 15:08 . 2006-07-24 08:56 212,240 –a—— c:\windows\system32\Richtx32.ocx

2008-12-02 10:53 . 2008-12-02 10:53 d——– c:\temp\cs120_2000

2008-12-02 10:44 . 2008-12-02 10:44 d——– c:\temp\cs331_XP

2008-12-02 10:44 . 2008-12-03 19:56 d——– C:\temp

2008-12-01 16:45 . 2008-12-01 16:45 5,242,880 –a—— C:\CAPTURE.AVI

2008-12-01 16:37 . 2008-12-01 16:38 d–h—– c:\windows\msdownld.tmp

2008-12-01 16:37 . 2008-12-01 16:37 d——– c:\program files\Windows Media Components

2008-12-01 16:37 . 2008-12-01 16:59 d——– c:\program files\Mingjong

2008-12-01 16:13 . 2008-12-01 16:13 d——– C:\Intel

2008-12-01 16:13 . 2006-11-10 08:25 319,456 –a—— c:\windows\system32\difxapi.dll

2008-12-01 16:13 . 2006-01-23 10:29 121,232 –a—— c:\windows\system32\IScrNBR.bmp

2008-12-01 16:13 . 2006-01-23 10:29 121,232 –a—— c:\windows\system32\IScrNB.bmp

2008-12-01 16:12 . 2008-12-01 16:12 d——– c:\program files\SystemRequirementsLab

2008-12-01 13:21 . 2004-06-11 00:31 135,168 -ra—— c:\windows\UNDPX2A.exe

2008-12-01 13:21 . 2004-06-11 00:34 53,693 -ra—— c:\windows\UNDPX2A.sys

2008-12-01 13:21 . 2004-06-10 09:42 15,429 -ra—— c:\windows\system32\drivers\Sacm2A.sys

2008-12-01 13:12 . 2008-12-01 12:54 81,081 –a—— c:\windows\_detmp.1

2008-12-01 13:12 . 2001-07-24 14:56 65,536 –a—— c:\windows\_detmp.2

2008-12-01 12:14 . 2008-12-01 13:12 17 –a—— c:\windows\ntsautodial.ini

2008-12-01 12:13 . 2008-12-01 12:13 d——– c:\program files\Kabelfoon

2008-11-30 21:07 . 2008-11-30 21:07 d——– c:\documents and settings\All Users\Application Data\NortonInstaller

2008-11-30 20:43 . 2008-12-14 14:04 d——– c:\documents and settings\Nik Landzaat\Application Data\skypePM

2008-11-30 20:43 . 2008-11-30 20:43 56 –ah—– c:\windows\system32\ezsidmv.dat

2008-11-30 20:39 . 2008-11-30 20:39 d——– c:\program files\Common Files\Skype

2008-11-30 18:01 . 2008-11-30 18:03 d——– c:\program files\Windows Live Safety Center

2008-11-30 14:14 . 2008-11-10 05:43 410,984 –a—— c:\windows\system32\deploytk.dll

2008-11-30 14:14 . 2008-11-10 03:39 73,728 –a—— c:\windows\system32\javacpl.cpl

2008-11-30 11:07 . 2008-11-30 11:07 d——– c:\program files\Trend Micro

2008-11-30 10:18 . 2008-12-06 15:23 d——– c:\program files\Malwarebytes' Anti-Malware

2008-11-30 10:18 . 2008-11-30 10:18 d——– c:\documents and settings\Nik Landzaat\Application Data\Malwarebytes

2008-11-30 10:18 . 2008-11-30 10:18 d——– c:\documents and settings\All Users\Application Data\Malwarebytes

2008-11-30 10:18 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys

2008-11-30 10:18 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys

2008-11-30 10:15 . 2008-11-30 10:15 d——– c:\program files\CleanUp!

2008-11-30 09:06 . 2008-11-30 09:06 d——– c:\program files\Lavasoft

2008-11-30 09:06 . 2008-11-30 09:07 d——– c:\documents and settings\All Users\Application Data\Lavasoft

2008-11-30 08:51 . 2008-11-30 12:54 d——– C:\savtemp

2008-11-29 19:23 . 2008-11-29 19:23 d——– c:\windows\system32\nl

2008-11-29 19:23 . 2008-11-29 19:23 d——– c:\windows\system32\bits

2008-11-29 19:23 . 2008-11-29 19:23 d——– c:\windows\l2schemas

2008-11-29 19:20 . 2008-11-29 19:23 d——– c:\windows\ServicePackFiles

2008-11-29 19:08 . 2008-11-29 19:08 d——– c:\windows\EHome

2008-11-29 17:55 . 2008-11-29 17:55 d——– c:\program files\Alwil Software

2008-11-29 15:22 . 2008-11-30 08:34 d——– c:\program files\Spybot - Search & Destroy

2008-11-29 15:22 . 2008-11-29 15:28 d——– c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-12-14 13:34 ——— d—–w c:\documents and settings\Nik Landzaat\Application Data\Skype

2008-12-10 19:27 ——— d—–w c:\program files\Common Files\Wise Installation Wizard

2008-12-10 18:30 ——— d–h–w c:\program files\InstallShield Installation Information

2008-12-06 14:02 ——— d—–w c:\program files\Easy MP3 Cutter

2008-12-03 18:04 ——— d—–w c:\program files\Java

2008-11-30 19:40 ——— d—–w c:\program files\Google

2008-11-30 19:39 ——— d—–w c:\documents and settings\All Users\Application Data\Skype

2008-11-30 08:02 ——— d—–w c:\program files\PartyGaming

2008-11-29 17:28 ——— d—–w c:\program files\owhmgv

2008-11-29 16:59 ——— d—–w c:\documents and settings\All Users\Application Data\qzcdofaj

2008-11-29 14:14 ——— d—–w c:\program files\Gamenext

2008-11-29 14:12 ——— d—–w c:\program files\Windows Live Toolbar

2008-11-12 21:36 ——— d—–w c:\documents and settings\Nik Landzaat\Application Data\Samsung

2008-11-12 21:32 ——— d—–w c:\program files\Samsung

2008-11-12 21:29 ——— d—–w c:\program files\Common Files\Adobe

2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys

2008-08-07 17:14 24 —-a-w c:\documents and settings\Nik Landzaat\jagex_runescape_preferences.dat

2007-02-04 12:13 4,213 —-a-w c:\program files\readme.txt

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

2008-11-12 16:47 104704 –a—— c:\windows\system32\cabine.dll

“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe”

“SmpcSys”=“c:\apps\SMP\SmpSys.exe”

“MsnMsgr”=“c:\program files\Windows Live\Messenger\MsnMsgr.Exe”

“swg”=“c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

“SUPERAntiSpyware”=“c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe”

“PHIME2002ASync”=“c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE”

“PHIME2002A”=“c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE”

“SynTPEnh”=“c:\program files\Synaptics\SynTP\SynTPEnh.exe”

“PCMService”=“c:\apps\Powercinema\PCMService.exe”

“HP Software Update”=“c:\program files\HP\HP Software Update\HPWuSchd2.exe”

“iTunesHelper”=“c:\program files\iTunes\iTunesHelper.exe”

“LogitechVideoRepair”=“c:\program files\Logitech\Video\ISStart.exe”

“LogitechVideoTray”=“c:\program files\Logitech\Video\LogiTray.exe”

“LogitechGalleryRepair”=“c:\program files\Logitech\Video\ISStart.exe”

“SunJavaUpdateSched”=“c:\program files\Java\jre6\bin\jusched.exe”

“Snelkoppeling naar eigenschappenvenster voor High Definition Audio”=“HDAShCut.exe”

“RTHDCPL”=“RTHDCPL.EXE”

“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE”

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe

Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

Snelstart HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe

“{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”= “c:\program files\SUPERAntiSpyware\SASSEH.DLL”

2008-12-03 14:56 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

“vidc.3ivx”= 3ivxVfWCodec.dll

“vidc.3iv2”= 3ivxVfWCodec.dll

“msacm.divxa32”= divxa32.acm

“VIDC.HFYU”= huffyuv.dll

“VIDC.i263”= i263_32.drv

“msacm.imc”= imc32.acm

“VIDC.VP31”= vp31vfw.dll

“msacm.enc”= ITIG726.acm

@=“Driver”

“DisableMonitoring”=dword:00000001

“%windir%\\system32\\sessmgr.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe”=

“c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe”=

“c:\\Program Files\\iTunes\\iTunes.exe”=

“c:\\Program Files\\Messenger\\msmsgs.exe”=

“%windir%\\Network Diagnostic\\xpnetdiag.exe”=

“c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe”=

“c:\\Program Files\\Windows Live\\Messenger\\livecall.exe”=

“c:\\WINDOWS\\system32\\dpvsetup.exe”=

“c:\\APPS\\skype\\Phone\\Skype.exe”=

R0 wicjjote;wicjjote;c:\windows\system32\drivers\wicjjote.sys

R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS

R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys

R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS

S0 Pvc52;Pvc52;c:\windows\system32\Drivers\Pvc52.sys

S0 Winxf06;Winxf06;c:\windows\system32\Drivers\Winxf06.sys

S1 2e5f561a;2e5f561a;c:\windows\system32\drivers\2e5f561a.sys

S3 PAC207;USB PC Cam Plus;c:\windows\system32\DRIVERS\pfc027.sys

Inhoud van de ‘Gedeelde Taken’ map

2008-11-30 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe

2006-10-28 c:\windows\Tasks\HDReg.job

- c:\apps\HDReg\HDRegRem.exe

2006-10-05 c:\windows\Tasks\Herinnering voor registratie 1.job

- c:\windows\system32\OOBE\oobebaln.exe

2006-10-04 c:\windows\Tasks\Herinnering voor registratie 2.job

- c:\windows\system32\OOBE\oobebaln.exe

2006-10-04 c:\windows\Tasks\Herinnering voor registratie 3.job

- c:\windows\system32\OOBE\oobebaln.exe

2008-12-12 c:\windows\Tasks\HPpromotions journeysoftware.job

- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe

2008-12-14 c:\windows\Tasks\Master CD_DVD Creator.job

- c:\apps\SMP\MCDCHECK.EXE

2008-12-14 c:\windows\Tasks\PCConfidential.job

- c:\program files\Winferno\PC Confidential\PCConfidential.exe

2008-12-14 c:\windows\Tasks\Uitgebreide garantie.job

- c:\apps\SMP\PBCARNOT.EXE

- - - - ORPHANS VERWIJDERD - - - -

HKCU-Run-DriverUpdaterPro - c:\program files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe

HKLM-Run-IMJPMIG8.1 - RBc:\windows\IME\imjp8_1\IMJPMIG.EXE

HKLM-Run-igfxtray - c:\windows\system32\igfxtray.exe

HKLM-Run-igfxhkcmd - c:\windows\system32\hkcmd.exe

HKLM-Run-igfxpers - c:\windows\system32\igfxpers.exe

HKLM-Explorer_Run-Kv33np8U5n - c:\documents and settings\All Users\Application Data\qzcdofaj\ifetmhgr.exe

SSODL-DscEn-{4D7EE931-899F-AAE2-A0C8-03AD82359139} - (no file)

SSODL-oBHAplf-{C019DC68-6AB3-76C2-95DF-9D50A9A2F106} - (no file)

SafeBoot-Winho63.sys

——- Bijkomende Scan ——-

uStart Page = hxxp://google.nl/

uDefault_Search_URL = hxxp://www.google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/

mSearch Bar = hxxp://www.google.com/

mSearchMigratedDefaultURL = hxxp://www.google.com/

mSearchURL = hxxp://www.google.com/

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {FE8FFD18-201F-4B29-A5B0-25C145BA002E} = 62.45.45.45 62.45.46.46

c:\windows\Downloaded Program Files\sysreqlab_ind.dll - O16 -: {5727FF4C-EF4E-4d96-A96C-03AD91910448}

hxxp://www.srtest.com/srl_bin/sysreqlab_ind.cab

c:\windows\Downloaded Program Files\sysreqlab.osd

c:\windows\Downloaded Program Files\instwact.dll - O16 -: {91F52A42-C10D-49A7-B941-882C657C604F}

hxxp://kitcentral.wanadoo.nl/download/install/win32/nl/instwact/instwact.dll

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-14 14:50:55

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen …

scannen van verborgen autostart items …

scannen van verborgen bestanden …

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

——————— DLLs Geladen Onder Lopende Processen ———————

- - - - - - - > ‘winlogon.exe’(632)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

———————— Andere Aktieve Processen ————————

c:\program files\Lavasoft\Ad-Aware\aawservice.exe

c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe

c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

c:\apps\HIDSERVICE\HidService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\HPZipm12.exe

c:\windows\system32\PAStiSvc.exe

c:\windows\system32\wdfmgr.exe

c:\apps\Powercinema\Kernel\TV\CLSched.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\LVComS.exe

c:\program files\HP\Digital Imaging\bin\hpqimzone.exe

c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

**************************************************************************

Voltooingstijd: 2008-12-14 14:54:13 - machine werd herstart

ComboFix-quarantined-files.txt 2008-12-14 13:53:49

Pre-Run: 33.150.468.096 bytes beschikbaar

Post-Run: 33,446,907,904 bytes beschikbaar

268 — E O F — 2008-12-11 08:57:10

En de hijack log ziet er als volgt uit:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:59:21, on 14-12-2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

c:\APPS\HIDSERVICE\HIDSERVICE.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

c:\APPS\Powercinema\Kernel\TV\CLSched.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Apps\Powercinema\PCMService.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\APPS\SMP\SmpSys.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\system32\LVComS.exe

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.nl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: (no name) - {026B7AE5-9319-4CE5-97DD-9FBCFC931134} - C:\WINDOWS\system32\cabine.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: MSTBR - {10CA15EA-C0A5-7CAF-B9E9-B8B2A87EFE11} - C:\PROGRA~1\Wanadoo\GLOBAL\Mstbr\mstbr.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: MSTBR - {10CA15EA-C0A5-7CAF-B9E9-B8B2A87EFE11} - C:\PROGRA~1\Wanadoo\GLOBAL\Mstbr\mstbr.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: HDAShCut.exe

O4 - HKLM\..\Run: RTHDCPL.EXE

O4 - HKLM\..\Run: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: “c:\Apps\Powercinema\PCMService.exe”

O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: C:\APPS\SMP\SmpSys.exe

O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe” /background

O4 - HKCU\..\Run: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Snelstart HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)

O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra ‘Tools’ menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\nl.htm

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by117w.bay117.mail.live.com/mail/resources/MsnPUpld.cab

O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_ind.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab

O16 - DPF: {91F52A42-C10D-49A7-B941-882C657C604F} (Installation Helper Object) - http://kitcentral.wanadoo.nl/download/install/win32/nl/instwact/instwact.dll

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{FE8FFD18-201F-4B29-A5B0-25C145BA002E}: NameServer = 62.45.45.45 62.45.46.46

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)

O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

–

End of file - 9700 bytes

sandra

Argus

sandra

Argus

sandra

Argus

sandra

Argus

sandra

fazantje