contole logjes aub?

• 

  pejola

  06-04-2009 19:40

  Hallo,

  Zouden jullie mijn logjes kunnen nakijken op ongerechtigheden?

  Pc blijft nogal eens hangen en is soms nogal traag.

  Heb windows xp home sp3,en gebruik AVG-Free en verder Adaware,Spybot,Spamfighter.

  Heb het stappenplan uitgevoerd zoals jullie beschreven.

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 19:33:29, on 6-4-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16791)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\htpatch.exe

  C:\PROGRA~1\AVG\AVG8\avgtray.exe

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

  C:\Program Files\SPAMfighter\SFAgent.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  C:\Program Files\SPAMfighter\sfus.exe

  C:\WINDOWS\System32\svchost.exe

  C:\PROGRA~1\AVG\AVG8\avgemc.exe

  C:\PROGRA~1\AVG\AVG8\avgrsx.exe

  C:\PROGRA~1\AVG\AVG8\avgnsx.exe

  C:\Program Files\AVG\AVG8\avgcsrvx.exe

  C:\WINDOWS\system32\msiexec.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\htpatch.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG8\avgtray.exe

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: “D:\speed\PCCheckup\PCCheckUp.exe” -mini

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\SPAMfighter\SFAgent.exe” update delay 60

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: D:\speed\SpeedItUp.exe -MINI

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O9 - Extra button: HP Clipboek - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

  O9 - Extra button: HP Slim selecteren - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB

  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

  O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - http://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab

  O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

  O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab

  O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219949313125

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/sj/en/check/xp/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

  O20 - AppInit_DLLs: C:\WINDOWS\System32\dgnet32.dll

  O20 - Winlogon Notify: 20f3d7fd573 - C:\WINDOWS\System32\dgnet32.dll (file missing)

  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

  O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

  O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\FAM~1.HOO\LOCALS~1\Temp\hpdj.exe (file missing)

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe

  –

  End of file - 10447 bytes

  ————————————————————–

  Malwarebytes' Anti-Malware 1.35

  Database versie: 1945

  Windows 5.1.2600 Service Pack 3

  6-4-2009 19:13:17

  mbam-log-2009-04-06 (19-13-17).txt

  Scan type: Snelle Scan

  Objecten gescand: 71557

  Verstreken tijd: 9 minute(s), 10 second(s)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 3

  Registerwaarden geïnfecteerd: 0

  Registerdata bestanden geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registersleutels geïnfecteerd:

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registerdata bestanden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Mappen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  ———————————————————————

  Alvast bedankt voor de moeite!

  Rapporteren
• 

  Jos H

  06-04-2009 21:11

  Mogelijk de oorzaak van de traagheid.?

  http://antivirus.startpagina.nl/prikbord/5046690/5048201/re-laptop-die-amper-een-site-wil-openen#msg-5048201

  Anders wachten op de loglezers.

  Rapporteren
• 

  Huib

  06-04-2009 21:25

  Hoi Pejola,

  Download Combofix naar je Bureaublad.

  http://download.bleepingcomputer.com/sUBs/ComboFix.exe

  Indien je Combofix al eerder hebt gebruikt, gelieve die versie te verwijderen en Combofix opnieuw te downloaden via bovenstaande link,

  want Combofix wordt dagelijks geupdate.

  OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt

  van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.

  Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

  Dubbelklik op Combofix.exe

  Volg de instructies, aanvaard de disclaimer.

  Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

  Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.

  Plaats deze log in je volgende post samen met een nieuw HijackThis log.

  Een andere loglezer zal je dan verder helpen;)

  Succes,

  Huib:)

  

  Rapporteren
• 

  pejola

  07-04-2009 16:35

  Hallo,

  bedankt alvast tot zover.

  ga er morgen mee aan de slag!

  Gr.Pejola

  Rapporteren
• 

  pejola

  08-04-2009 11:30

  Hallo,

  Hierbij de 2 logjes:

  ComboFix 09-04-04.01 - fam.hoogeveen 2009-04-08 11:19:56.1 - NTFSx86

  Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1043.18.480.163

  Gestart vanuit: c:\documents and settings\fam.hoogeveen\Bureaublad\ComboFix.exe

  * Nieuw herstelpunt werd aangemaakt

  .

  (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

  .

  c:\documents and settings\fam.hoogeveen\Application Data\0200000024331c3a573C.manifest

  c:\documents and settings\fam.hoogeveen\Application Data\0200000024331c3a573O.manifest

  c:\documents and settings\fam.hoogeveen\Application Data\0200000024331c3a573P.manifest

  c:\documents and settings\fam.hoogeveen\Application Data\0200000024331c3a573S.manifest

  c:\windows\GnuHashes.ini

  c:\windows\system32\AutoRun.inf

  c:\windows\system32\GroupPolicy000.dat

  .

  (((((((((((((((((((( Bestanden Gemaakt van 2009-03-08 to 2009-04-08 ))))))))))))))))))))))))))))))

  .

  2009-04-06 20:06 . 2009-04-06 20:06 d——– c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

  2009-04-06 20:05 . 2009-04-06 20:05 d——– c:\program files\SUPERAntiSpyware

  2009-04-06 20:05 . 2009-04-06 20:05 d——– c:\documents and settings\fam.hoogeveen\Application Data\SUPERAntiSpyware.com

  2009-04-06 19:56 . 2009-04-06 19:56 dr-h—– c:\documents and settings\fam.hoogeveen\Onlangs geopend

  2009-04-06 19:49 . 2009-04-06 19:54 d——– c:\program files\CCleaner

  2009-04-06 19:03 . 2009-04-06 19:03 d——– c:\program files\Malwarebytes' Anti-Malware

  2009-04-06 19:03 . 2009-04-06 19:03 d——– c:\documents and settings\fam.hoogeveen\Application Data\Malwarebytes

  2009-04-06 19:03 . 2009-04-06 19:03 d——– c:\documents and settings\All Users\Application Data\Malwarebytes

  2009-04-06 19:03 . 2009-03-26 16:49 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys

  2009-04-06 19:03 . 2009-03-26 16:49 15,504 –a—— c:\windows\system32\drivers\mbam.sys

  2009-04-06 16:33 . 2009-04-06 16:34 d——– c:\program files\CleanUp!

  2009-04-06 16:32 . 2009-04-06 16:32 339,257 –a—— c:\program files\CleanUp452.exe

  2009-04-06 07:48 . 2009-01-09 21:19 1,089,883 —–c— c:\windows\system32\dllcache\ntprint.cat

  2009-04-05 18:31 . 2009-04-05 18:31 615 –a—— c:\windows\system32\OO9vQ9z9jpmlUao.vbs

  2009-04-05 11:03 . 2009-04-05 11:03 d——– c:\windows\system32\XPSViewer

  2009-04-05 11:03 . 2009-04-05 11:03 d——– c:\program files\MSBuild

  2009-04-05 11:02 . 2009-04-05 11:02 d——– c:\program files\Reference Assemblies

  2009-04-05 10:56 . 2008-07-06 14:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll

  2009-04-05 10:56 . 2008-07-06 14:06 1,676,288 —–c— c:\windows\system32\dllcache\xpssvcs.dll

  2009-04-05 10:56 . 2008-07-06 12:50 597,504 —–c— c:\windows\system32\dllcache\printfilterpipelinesvc.exe

  2009-04-05 10:56 . 2008-07-06 14:06 575,488 ——— c:\windows\system32\xpsshhdr.dll

  2009-04-05 10:56 . 2008-07-06 14:06 575,488 —–c— c:\windows\system32\dllcache\xpsshhdr.dll

  2009-04-05 10:56 . 2008-07-06 14:06 117,760 ——— c:\windows\system32\prntvpt.dll

  2009-04-05 10:56 . 2008-07-06 14:06 89,088 —–c— c:\windows\system32\dllcache\filterpipelineprintproc.dll

  2009-04-05 10:51 . 2009-04-05 11:32 d——– c:\windows\SxsCaPendDel

  .

  ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  2009-04-08 09:15 ——— d—–w c:\program files\SPAMfighter

  2009-04-08 09:10 ——— d—–w c:\documents and settings\All Users\Application Data\avg8

  2009-04-07 13:20 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater

  2009-04-06 18:05 ——— d—–w c:\program files\Common Files\Wise Installation Wizard

  2009-04-06 17:53 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

  2009-04-05 16:30 ——— d—–w c:\documents and settings\fam.hoogeveen\Application Data\LimeWire

  2009-03-30 12:15 ——— d—–w c:\program files\Spybot - Search & Destroy

  2009-03-19 16:17 410,984 —-a-w c:\windows\system32\deploytk.dll

  2009-02-10 17:22 ——— d—–w c:\documents and settings\All Users\Application Data\Hitman Pro

  2009-02-09 14:08 1,846,912 —-a-w c:\windows\system32\win32k.sys

  2009-02-06 17:52 49,504 —-a-w c:\windows\system32\sirenacm.dll

  2008-11-07 08:32 22,392 -c–a-w c:\documents and settings\fam.hoogeveen\Application Data\GDIPFONTCACHEV1.DAT

  2008-08-23 14:53 1,018,584 -c–a-w c:\program files\Google_Updater.exe

  2008-05-01 13:51 532,480 —-a-w c:\program files\cwshredder.exe

  2008-04-14 18:14 23,700,784 -c–a-w c:\program files\QuickTimeInstaller.exe

  2008-04-14 13:30 17,874,288 -c–a-w c:\program files\Install_Messenger.exe

  2008-04-14 12:31 35,960,792 -c–a-w c:\program files\avg75free_519a1276.exe

  2008-07-20 10:55 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\Geschiedenis\History.IE5\MSHist012008072020080721\index.dat

  .

  ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

  REGEDIT4

  “CTFMON.EXE”=“c:\windows\system32\ctfmon.exe”

  “SpeedItUpEX”=“d:\speed\SpeedItUp.exe”

  “SUPERAntiSpyware”=“c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe”

  “HTpatch”=“c:\windows\htpatch.exe”

  “NeroFilterCheck”=“c:\windows\system32\NeroCheck.exe”

  “HP Software Update”=“c:\program files\HP\HP Software Update\HPWuSchd2.exe”

  “Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  “SPAMfighter Agent”=“c:\program files\SPAMfighter\SFAgent.exe”

  “QuickTime Task”=“c:\program files\QuickTime\qttask.exe”

  “SunJavaUpdateSched”=“c:\program files\Java\jre6\bin\jusched.exe”

  “CTFMON.EXE”=“c:\windows\System32\CTFMON.EXE”

  c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

  HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe

  “NoResolveTrack”= 1 (0x1)

  “NoResolveTrack”= 1 (0x1)

  “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”= “c:\program files\SUPERAntiSpyware\SASSEH.DLL”

  2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

  “AppInit_DLLs”=c:\windows\System32\dgnet32.dll

  path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Microsoft Office.lnk

  backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

  –a–c— 2008-10-01 13:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

  –a–c— 2008-11-20 14:20 290088 c:\program files\iTunes\iTunesHelper.exe

  –a—— 2008-11-04 11:30 413696 c:\program files\QuickTime\QTTask.exe

  “%windir%\\system32\\sessmgr.exe”=

  “%windir%\\Network Diagnostic\\xpnetdiag.exe”=

  “c:\\Program Files\\LimeWire\\LimeWire.exe”=

  “c:\\WINDOWS\\system32\\mshta.exe”=

  “c:\\Program Files\\Messenger\\msmsgs.exe”=

  “c:\\Program Files\\iTunes\\iTunes.exe”=

  “c:\\Program Files\\Bonjour\\mDNSResponder.exe”=

  “c:\\Program Files\\Windows Live\\Mail\\wlmail.exe”=

  “c:\\Program Files\\Lavasoft\\Ad-Aware\\Ad-Aware.exe”=

  “c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe”=

  R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys

  R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS

  R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\SPAMfighter\sfus.exe

  R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS

  S3 hitmanpro3;Hitman Pro 3 Support Driver;\??\c:\windows\system32\drivers\hitmanpro3.sys –> c:\windows\system32\drivers\hitmanpro3.sys

  HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

  hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

  .

  Inhoud van de ‘Gedeelde Taken’ map

  2009-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job

  - c:\program files\Apple Software Update\SoftwareUpdate.exe

  2009-04-08 c:\windows\Tasks\Google Software Updater.job

  - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe

  .

  - - - - ORPHANS VERWIJDERD - - - -

  Notify-20f3d7fd573 - c:\windows\System32\dgnet32.dll

  Notify-avgrsstarter - avgrsstx.dll

  .

  ——- Bijkomende Scan ——-

  .

  uStart Page = hxxp://www.startpagina.nl/

  uInternet Settings,ProxyOverride = *.local

  IE: E&xporteren naar Microsoft Excel

  DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab

  DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game13.zylom.com/activex/zylomgamesplayer.cab

  DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} - hxxp://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  .

  **************************************************************************

  catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

  Rootkit scan 2009-04-08 11:21:58

  Windows 5.1.2600 Service Pack 3 NTFS

  scannen van verborgen processen …

  scannen van verborgen autostart items …

  HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\??????[????`??[???[`??[???????????????[???[???[???[$??????[???????????????[???????????[???w????(????3?w???w?????3?w ??w???[??????d???r??[1??[???[d??????[?-?[????z??w8h?[\2?[?1?[htinst.INI?[?u?[????d???????HG?

  scannen van verborgen bestanden …

  Scan succesvol afgerond

  verborgen bestanden: 0

  **************************************************************************

  .

  ——————— VERGRENDELDE REGISTER SLEUTELS ———————

  @Allowed: (Read) (RestrictedCode)

  @Allowed: (Read) (RestrictedCode)

  .

  ——————— DLLs Geladen Onder Lopende Processen ———————

  - - - - - - - > ‘winlogon.exe’(504)

  c:\program files\SUPERAntiSpyware\SASWINLO.dll

  .

  Voltooingstijd: 2009-04-08 11:24:21

  ComboFix-quarantined-files.txt 2009-04-08 09:24:16

  Pre-Run: 16.007.274.496 bytes beschikbaar

  Post-Run: 16,096,989,184 bytes beschikbaar

  WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

  redirect=usebiossettingd

  redirectbaudrate=

  timeout=2

  default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

  c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons

  multi(0)disk(0)rdisk(0)partition(2)\WINDOWS=“Microsoft Windows XP Home Edition” /fastdetect /NoExecute=OptIn

  178 — E O F — 2009-04-06 06:08:44

  ——————————————————————————————————————————————————————–

  deel 2:

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 11:26:52, on 8-4-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16791)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  C:\Program Files\SPAMfighter\sfus.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\wscntfy.exe

  C:\WINDOWS\htpatch.exe

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\SPAMfighter\SFAgent.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\WINDOWS\system32\ctfmon.exe

  D:\speed\SpeedItUp.exe

  C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\WINDOWS\explorer.exe

  C:\Program Files\internet explorer\iexplore.exe

  C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\htpatch.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\SPAMfighter\SFAgent.exe” update delay 60

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: D:\speed\SpeedItUp.exe -MINI

  O4 - HKCU\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O9 - Extra button: HP Clipboek - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

  O9 - Extra button: HP Slim selecteren - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB

  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

  O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - http://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab

  O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

  O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab

  O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219949313125

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/sj/en/check/xp/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

  O20 - AppInit_DLLs: C:\WINDOWS\System32\dgnet32.dll

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

  O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\FAM~1.HOO\LOCALS~1\Temp\hpdj.exe (file missing)

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe

  –

  End of file - 9502 bytes

  Ik wacht wel weer op een reactie.

  Vast bedankt!

  Rapporteren
• 

  pejola

  08-04-2009 11:46

  Hallo,

  Hierbij mijn 2 logjes:

  ComboFix 09-04-04.01 - fam.hoogeveen 2009-04-08 11:19:56.1 - NTFSx86

  Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1043.18.480.163

  Gestart vanuit: c:\documents and settings\fam.hoogeveen\Bureaublad\ComboFix.exe

  * Nieuw herstelpunt werd aangemaakt

  .

  (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

  .

  c:\documents and settings\fam.hoogeveen\Application Data\0200000024331c3a573C.manifest

  c:\documents and settings\fam.hoogeveen\Application Data\0200000024331c3a573O.manifest

  c:\documents and settings\fam.hoogeveen\Application Data\0200000024331c3a573P.manifest

  c:\documents and settings\fam.hoogeveen\Application Data\0200000024331c3a573S.manifest

  c:\windows\GnuHashes.ini

  c:\windows\system32\AutoRun.inf

  c:\windows\system32\GroupPolicy000.dat

  .

  (((((((((((((((((((( Bestanden Gemaakt van 2009-03-08 to 2009-04-08 ))))))))))))))))))))))))))))))

  .

  2009-04-06 20:06 . 2009-04-06 20:06 d——– c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

  2009-04-06 20:05 . 2009-04-06 20:05 d——– c:\program files\SUPERAntiSpyware

  2009-04-06 20:05 . 2009-04-06 20:05 d——– c:\documents and settings\fam.hoogeveen\Application Data\SUPERAntiSpyware.com

  2009-04-06 19:56 . 2009-04-06 19:56 dr-h—– c:\documents and settings\fam.hoogeveen\Onlangs geopend

  2009-04-06 19:49 . 2009-04-06 19:54 d——– c:\program files\CCleaner

  2009-04-06 19:03 . 2009-04-06 19:03 d——– c:\program files\Malwarebytes' Anti-Malware

  2009-04-06 19:03 . 2009-04-06 19:03 d——– c:\documents and settings\fam.hoogeveen\Application Data\Malwarebytes

  2009-04-06 19:03 . 2009-04-06 19:03 d——– c:\documents and settings\All Users\Application Data\Malwarebytes

  2009-04-06 19:03 . 2009-03-26 16:49 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys

  2009-04-06 19:03 . 2009-03-26 16:49 15,504 –a—— c:\windows\system32\drivers\mbam.sys

  2009-04-06 16:33 . 2009-04-06 16:34 d——– c:\program files\CleanUp!

  2009-04-06 16:32 . 2009-04-06 16:32 339,257 –a—— c:\program files\CleanUp452.exe

  2009-04-06 07:48 . 2009-01-09 21:19 1,089,883 —–c— c:\windows\system32\dllcache\ntprint.cat

  2009-04-05 18:31 . 2009-04-05 18:31 615 –a—— c:\windows\system32\OO9vQ9z9jpmlUao.vbs

  2009-04-05 11:03 . 2009-04-05 11:03 d——– c:\windows\system32\XPSViewer

  2009-04-05 11:03 . 2009-04-05 11:03 d——– c:\program files\MSBuild

  2009-04-05 11:02 . 2009-04-05 11:02 d——– c:\program files\Reference Assemblies

  2009-04-05 10:56 . 2008-07-06 14:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll

  2009-04-05 10:56 . 2008-07-06 14:06 1,676,288 —–c— c:\windows\system32\dllcache\xpssvcs.dll

  2009-04-05 10:56 . 2008-07-06 12:50 597,504 —–c— c:\windows\system32\dllcache\printfilterpipelinesvc.exe

  2009-04-05 10:56 . 2008-07-06 14:06 575,488 ——— c:\windows\system32\xpsshhdr.dll

  2009-04-05 10:56 . 2008-07-06 14:06 575,488 —–c— c:\windows\system32\dllcache\xpsshhdr.dll

  2009-04-05 10:56 . 2008-07-06 14:06 117,760 ——— c:\windows\system32\prntvpt.dll

  2009-04-05 10:56 . 2008-07-06 14:06 89,088 —–c— c:\windows\system32\dllcache\filterpipelineprintproc.dll

  2009-04-05 10:51 . 2009-04-05 11:32 d——– c:\windows\SxsCaPendDel

  .

  ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  2009-04-08 09:15 ——— d—–w c:\program files\SPAMfighter

  2009-04-08 09:10 ——— d—–w c:\documents and settings\All Users\Application Data\avg8

  2009-04-07 13:20 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater

  2009-04-06 18:05 ——— d—–w c:\program files\Common Files\Wise Installation Wizard

  2009-04-06 17:53 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

  2009-04-05 16:30 ——— d—–w c:\documents and settings\fam.hoogeveen\Application Data\LimeWire

  2009-03-30 12:15 ——— d—–w c:\program files\Spybot - Search & Destroy

  2009-03-19 16:17 410,984 —-a-w c:\windows\system32\deploytk.dll

  2009-02-10 17:22 ——— d—–w c:\documents and settings\All Users\Application Data\Hitman Pro

  2009-02-09 14:08 1,846,912 —-a-w c:\windows\system32\win32k.sys

  2009-02-06 17:52 49,504 —-a-w c:\windows\system32\sirenacm.dll

  2008-11-07 08:32 22,392 -c–a-w c:\documents and settings\fam.hoogeveen\Application Data\GDIPFONTCACHEV1.DAT

  2008-08-23 14:53 1,018,584 -c–a-w c:\program files\Google_Updater.exe

  2008-05-01 13:51 532,480 —-a-w c:\program files\cwshredder.exe

  2008-04-14 18:14 23,700,784 -c–a-w c:\program files\QuickTimeInstaller.exe

  2008-04-14 13:30 17,874,288 -c–a-w c:\program files\Install_Messenger.exe

  2008-04-14 12:31 35,960,792 -c–a-w c:\program files\avg75free_519a1276.exe

  2008-07-20 10:55 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\Geschiedenis\History.IE5\MSHist012008072020080721\index.dat

  .

  ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

  REGEDIT4

  “CTFMON.EXE”=“c:\windows\system32\ctfmon.exe”

  “SpeedItUpEX”=“d:\speed\SpeedItUp.exe”

  “SUPERAntiSpyware”=“c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe”

  “HTpatch”=“c:\windows\htpatch.exe”

  “NeroFilterCheck”=“c:\windows\system32\NeroCheck.exe”

  “HP Software Update”=“c:\program files\HP\HP Software Update\HPWuSchd2.exe”

  “Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  “SPAMfighter Agent”=“c:\program files\SPAMfighter\SFAgent.exe”

  “QuickTime Task”=“c:\program files\QuickTime\qttask.exe”

  “SunJavaUpdateSched”=“c:\program files\Java\jre6\bin\jusched.exe”

  “CTFMON.EXE”=“c:\windows\System32\CTFMON.EXE”

  c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

  HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe

  “NoResolveTrack”= 1 (0x1)

  “NoResolveTrack”= 1 (0x1)

  “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”= “c:\program files\SUPERAntiSpyware\SASSEH.DLL”

  2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

  “AppInit_DLLs”=c:\windows\System32\dgnet32.dll

  path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Microsoft Office.lnk

  backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

  –a–c— 2008-10-01 13:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

  –a–c— 2008-11-20 14:20 290088 c:\program files\iTunes\iTunesHelper.exe

  –a—— 2008-11-04 11:30 413696 c:\program files\QuickTime\QTTask.exe

  “%windir%\\system32\\sessmgr.exe”=

  “%windir%\\Network Diagnostic\\xpnetdiag.exe”=

  “c:\\Program Files\\LimeWire\\LimeWire.exe”=

  “c:\\WINDOWS\\system32\\mshta.exe”=

  “c:\\Program Files\\Messenger\\msmsgs.exe”=

  “c:\\Program Files\\iTunes\\iTunes.exe”=

  “c:\\Program Files\\Bonjour\\mDNSResponder.exe”=

  “c:\\Program Files\\Windows Live\\Mail\\wlmail.exe”=

  “c:\\Program Files\\Lavasoft\\Ad-Aware\\Ad-Aware.exe”=

  “c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe”=

  R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys

  R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS

  R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\SPAMfighter\sfus.exe

  R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS

  S3 hitmanpro3;Hitman Pro 3 Support Driver;\??\c:\windows\system32\drivers\hitmanpro3.sys –> c:\windows\system32\drivers\hitmanpro3.sys

  HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

  hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

  .

  Inhoud van de ‘Gedeelde Taken’ map

  2009-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job

  - c:\program files\Apple Software Update\SoftwareUpdate.exe

  2009-04-08 c:\windows\Tasks\Google Software Updater.job

  - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe

  .

  - - - - ORPHANS VERWIJDERD - - - -

  Notify-20f3d7fd573 - c:\windows\System32\dgnet32.dll

  Notify-avgrsstarter - avgrsstx.dll

  .

  ——- Bijkomende Scan ——-

  .

  uStart Page = hxxp://www.startpagina.nl/

  uInternet Settings,ProxyOverride = *.local

  IE: E&xporteren naar Microsoft Excel

  DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab

  DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game13.zylom.com/activex/zylomgamesplayer.cab

  DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} - hxxp://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  .

  **************************************************************************

  catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

  Rootkit scan 2009-04-08 11:21:58

  Windows 5.1.2600 Service Pack 3 NTFS

  scannen van verborgen processen …

  scannen van verborgen autostart items …

  HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\??????[????`??[???[`??[???????????????[???[???[???[$??????[???????????????[???????????[???w????(????3?w???w?????3?w ??w???[??????d???r??[1??[???[d??????[?-?[????z??w8h?[\2?[?1?[htinst.INI?[?u?[????d???????HG?

  scannen van verborgen bestanden …

  Scan succesvol afgerond

  verborgen bestanden: 0

  **************************************************************************

  .

  ——————— VERGRENDELDE REGISTER SLEUTELS ———————

  @Allowed: (Read) (RestrictedCode)

  @Allowed: (Read) (RestrictedCode)

  .

  ——————— DLLs Geladen Onder Lopende Processen ———————

  - - - - - - - > ‘winlogon.exe’(504)

  c:\program files\SUPERAntiSpyware\SASWINLO.dll

  .

  Voltooingstijd: 2009-04-08 11:24:21

  ComboFix-quarantined-files.txt 2009-04-08 09:24:16

  Pre-Run: 16.007.274.496 bytes beschikbaar

  Post-Run: 16,096,989,184 bytes beschikbaar

  WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

  redirect=usebiossettingd

  redirectbaudrate=

  timeout=2

  default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

  c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons

  multi(0)disk(0)rdisk(0)partition(2)\WINDOWS=“Microsoft Windows XP Home Edition” /fastdetect /NoExecute=OptIn

  178 — E O F — 2009-04-06 06:08:44

  ______________________________________________________________________________________________

  en de 2e:

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 11:26:52, on 8-4-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16791)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  C:\Program Files\SPAMfighter\sfus.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\wscntfy.exe

  C:\WINDOWS\htpatch.exe

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\SPAMfighter\SFAgent.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\WINDOWS\system32\ctfmon.exe

  D:\speed\SpeedItUp.exe

  C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\WINDOWS\explorer.exe

  C:\Program Files\internet explorer\iexplore.exe

  C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\htpatch.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\SPAMfighter\SFAgent.exe” update delay 60

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: D:\speed\SpeedItUp.exe -MINI

  O4 - HKCU\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O9 - Extra button: HP Clipboek - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

  O9 - Extra button: HP Slim selecteren - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB

  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

  O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - http://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab

  O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

  O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab

  O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219949313125

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/sj/en/check/xp/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

  O20 - AppInit_DLLs: C:\WINDOWS\System32\dgnet32.dll

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

  O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\FAM~1.HOO\LOCALS~1\Temp\hpdj.exe (file missing)

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe

  –

  End of file - 9502 bytes

  ____________________________________________________________________________________________________

  Ik wacht het wel weer af, alvast bedankt!

  Rapporteren
• 

  Huib

  08-04-2009 21:22

  Hoi Pejola,

  Combologje ziet er goed uit;)

  Doe het volgende:

  Start Hijack This, en klik op Do a Systemscan only.

  Vink nu de volgende regel aan:

  O20 - AppInit_DLLs: C:\WINDOWS\System32\dgnet32.dll

  Sluit alle vensters, behalve HijackThis en klik op fix checked.

  Verwijder, indien aanwezig het volgende vet gedrukte bestand:

  C:\WINDOWS\System32\dgnet32.dll <—– dit bestand.

  Start je computer opnieuw op, vertel hoe het met jou probleem is en plaats een nieuw HijackThis logje;)

  Succes,

  Huib:)

  

  Rapporteren
• 

  Huib

  08-04-2009 21:42

  Hoi Pejalo,

  Wat heb je nog van Hitman Pro op jou computer zitten:S:S

  Verwijder dat ook nog ff;)

  Hier staat ook nog wat:

  c:\documents and settings\All Users\Application Data\Hitman Pro

  Groetjes Huib:)

  

  Rapporteren
• 

  pejola

  08-04-2009 22:02

  Hoi,

  Dat dll bestand is dit: dgnet.dll, dus zonder 32 ertussen…evengoed verwijderen?

  Rapporteren
• 

  pejola

  08-04-2009 22:13

  Hierbij het nieuwe logje

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 22:10:06, on 8-4-2009

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v7.00 (7.00.6000.16791)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\AVG\AVG8\avgrsx.exe

  C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\htpatch.exe

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

  C:\Program Files\SPAMfighter\SFAgent.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\PROGRA~1\AVG\AVG8\avgtray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  C:\Program Files\SPAMfighter\sfus.exe

  C:\WINDOWS\System32\svchost.exe

  C:\PROGRA~1\AVG\AVG8\avgrsx.exe

  C:\PROGRA~1\AVG\AVG8\avgnsx.exe

  C:\WINDOWS\system32\msiexec.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\htpatch.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\SPAMfighter\SFAgent.exe” update delay 60

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG8\avgtray.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: D:\speed\SpeedItUp.exe -MINI

  O4 - HKCU\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O9 - Extra button: HP Clipboek - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

  O9 - Extra button: HP Slim selecteren - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB

  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

  O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - http://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab

  O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

  O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab

  O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219949313125

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/sj/en/check/xp/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

  O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

  O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\FAM~1.HOO\LOCALS~1\Temp\hpdj.exe (file missing)

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe

  –

  End of file - 9879 bytes

  Rapporteren