Op deze website gebruiken we cookies om content en advertenties te personaliseren, om functies voor social media te bieden en om ons websiteverkeer te analyseren. Ook delen we informatie over uw gebruik van onze site met onze partners voor social media, adverteren en analyse. Deze partners kunnen deze gegevens combineren met andere informatie die u aan ze heeft verstrekt of die ze hebben verzameld op basis van uw gebruik van hun services. Meer informatie.

Akkoord

Vraag & Antwoord

Beveiliging & privacy

trojan vundo

None
12 antwoorden
  • goeie dag,
    ik heb een probleem, norton vind een virus genaamd trojan.vundo, maar kan dit niet verwijderen, kan er iemand mij helpen?

    bij voorbaat dank
  • Ik denk wel dat ik dat kan ja :)

    Download Combofix naar je Bureaublad.
    [list:2d0780a969]
    Dubbelklik [b:2d0780a969]Combofix.exe[/b:2d0780a969]
    Volg de instructies, aanvaard de disclaimer door "[b:2d0780a969]1[/b:2d0780a969]" te typen en te bevestigen via "[b:2d0780a969]Enter[/b:2d0780a969]".
    Tijdens het runnen van de fix, [b:2d0780a969]NIET[/b:2d0780a969] in het venster klikken, want dit zal je pc doen vasthangen.[/list:u:2d0780a969]

    Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.
    [i:2d0780a969]Plaats deze log in je volgende post samen met een nieuw HijackThis log.[/i:2d0780a969]

    [b:2d0780a969]Note:[/b:2d0780a969] Indien je virusscanner reageert tijdens het downloaden of gebruik van Combofix, mag je dit negeren.

    Lees dit even door hoe je een Hijackthis log maakt:
    http://forum.computertotaal.nl/phpBB2/viewtopic.php?t=115358

    Pim
  • hijackthis log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:23:42, on 29/11/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\system32\hplampc.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Belgacom\bin\sprtcmd.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus
    avapsvc.exe
    C:\Program Files\Eset
    od32krn.exe
    C:\Program Files\SiteAdvisor\6172\SAService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\DOCUME~1\Jef\LOCALS~1\Temp\Rar$EX00.657\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
    O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: Multi talen Woordenboek takenbalk.lnk = ?
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1B40DB49-1373-4D22-A753-9CCDF21FFF4F}: NameServer = 195.238.2.21 195.238.2.22
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
    avapsvc.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset
    od32krn.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
    vsvc32.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: SiteAdvisor-service (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O24 - Desktop Component 0: (no name) - http://www.rbimovies.nl/media/landbouw/Boerderij/Lezersservice/vettepech1024x768.jpg


    End of file - 10883 bytes


    ComboFix 07-11-19.4C - Jef 2007-11-29 10:27:07.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.31.1043.18.109 [GMT 1:00]
    Gestart vanuit: C:\Documents and Settings\Jef\Local Settings\Temporary Internet Files\Content.IE5\89IF0XYV\ComboFix[1].exe
    * Nieuw herstelpunt werd aangemaakt
    .

    (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Application Data.\slwbszqn.dll
    C:\Program Files\Common Files\ppatch~1
    C:\Program Files\Common Files\ppatch~1\??pPatch\
    C:\Program Files\Common Files\ppatch~1\rundll.exe
    C:\Program Files\Common Files\Yazzle1162OinAdmin.exe
    C:\Program Files\SecCenter
    C:\WINDOWS\system32\drvmiwr.dll
    C:\WINDOWS\system32
    qtss.ini
    C:\WINDOWS\system32
    qtss.ini2
    C:\WINDOWS\system32\sstqn.dll
    C:\WINDOWS\system32\winmmt32.dll
    K:\Autorun.inf

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    ——-\LEGACY_WINDOWS_LOG


    (((((((((((((((((((( Bestanden Gemaakt van 2007-10-28 to 2007-11-29 ))))))))))))))))))))))))))))))
    .

    2007-11-28 22:28 <DIR> d——– C:\Program Files\Enigma Software Group
    2007-11-28 17:43 37,376 –a—— C:\WINDOWS\system32\urqppmj.dll
    2007-11-28 17:42 <DIR> d——– C:\WINDOWS\system32\skjlrsjp
    2007-11-28 17:42 <DIR> d——– C:\Program Files\Uqrosrjw
    2007-11-28 17:41 <DIR> d——– C:\Program Files\jehuvsvc
    2007-11-28 17:41 102,912 –a—— C:\WINDOWS\system32\drvmiw.dll
    2007-11-28 17:41 37,376 –a—— C:\WINDOWS\system32\hggffge.dll
    2007-11-28 17:41 34,304 ——— C:\WINDOWS\system32\tuvuuuv.dll
    2007-11-28 16:32 10,740 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2007-11-28 16:32 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2007-11-28 16:13 <DIR> d——– C:\Program Files\Norton Internet Security
    2007-11-28 16:13 10,344 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys
    2007-11-19 19:02 <DIR> d——– C:\Program Files\Hasbro Interactive

    .
    ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-11-29 08:06 ——— d—–w C:\Documents and Settings\Jef\Application Data\AdobeUM
    2007-11-28 17:30 ——— d—–w C:\Program Files\Common Files\Symantec Shared
    2007-11-28 15:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
    2007-11-28 15:33 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
    2007-11-28 15:33 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2007-11-28 15:33 ——— d—–w C:\Program Files\Symantec
    2007-11-28 15:20 ——— d—–w C:\Documents and Settings\Jef\Application Data\Symantec
    2007-11-28 08:54 ——— d—–w C:\Documents and Settings\Jef\Application Data\U3
    2007-11-26 19:06 ——— d—–w C:\Documents and Settings\Bert\Application Data\SiteAdvisor
    2007-11-24 08:42 ——— d—–w C:\Documents and Settings\NetworkService\Application Data\SiteAdvisor
    2007-11-22 08:52 ——— d—–w C:\Documents and Settings\Marc\Application Data\AdobeUM
    2007-11-21 17:19 ——— d—–w C:\Documents and Settings\Bert\Application Data\AdobeUM
    2007-11-21 16:33 ——— d—–w C:\Program Files\Google
    2007-11-20 16:06 ——— d—–w C:\Documents and Settings\Marc\Application Data\U3
    2007-11-18 14:04 ——— d—–w C:\Program Files\SPSSEVAL
    2007-11-15 20:21 ——— d—–w C:\Documents and Settings\Marc\Application Data\SiteAdvisor
    2007-11-09 18:09 ——— d—–w C:\Documents and Settings\Jef\Application Data\SiteAdvisor
    2007-11-04 19:21 ——— d—–w C:\Documents and Settings\Leen\Application Data\AdobeUM
    2007-10-28 19:58 ——— d—–w C:\Documents and Settings\Hans\Application Data\SiteAdvisor
    2007-10-27 12:32 ——— d—–w C:\Documents and Settings\Leen\Application Data\SiteAdvisor
    2007-10-22 19:19 ——— d—–w C:\Documents and Settings\Dries\Application Data\SiteAdvisor
    2007-10-17 20:01 ——— d—–w C:\Program Files\Picasa2
    2007-10-17 19:40 ——— d—–w C:\Program Files\SiteAdvisor
    2007-10-17 19:40 ——— d—–w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
    2007-10-17 19:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
    2007-10-17 19:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
    2007-10-16 19:06 ——— d—–w C:\Documents and Settings\Leen\Application Data\U3
    2007-10-14 18:34 ——— d—–w C:\Documents and Settings\Hans\Application Data\AdobeUM
    2007-10-01 20:53 ——— d—–w C:\Program Files\Lavasoft
    2007-10-01 20:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2007-10-01 20:52 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
    2007-10-01 20:50 ——— d—–w C:\Program Files\Hitman Pro
    2007-10-01 20:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-10-01 20:49 ——— d—–w C:\Documents and Settings\Jef\Application Data\Lavasoft
    2007-10-01 20:30 ——— d—–w C:\Program Files\CCleaner
    2007-10-01 13:49 98,184 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
    2007-10-01 13:49 542,088 —-a-w C:\WINDOWS\system32\SymNeti.dll
    2007-10-01 13:49 31,624 —-a-w C:\WINDOWS\system32\drivers\symids.sys
    2007-10-01 13:49 28,040 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
    2007-10-01 13:49 23,944 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
    2007-10-01 13:49 189,320 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
    2007-10-01 13:49 161,160 —-a-w C:\WINDOWS\system32\SymRedir.dll
    2007-10-01 13:48 12,680 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
    2007-08-22 12:07 2,948 —-a-w C:\Documents and Settings\Leen\Application Data\mdb.bin
    .

    ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}]
    2007-11-28 17:41 34304 ——— C:\WINDOWS\system32\tuvuuuv.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62780D18-D103-03D3-323A-01F43008B839}]
    2007-11-28 17:42 98304 –a—— C:\Program Files\Uqrosrjw\pturgriq.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-22 20:25]
    "NVIEW"="nview.dll" [2003-05-02 22:19 C:\WINDOWS\system32
    view.dll]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 11:57]
    "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2004-09-13 09:22]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-23 19:11]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 15:04]
    "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 06:07]
    "CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 06:23]
    "HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 02:03]
    "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 01:58]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 20:42]
    "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:03 C:\WINDOWS\system32\rundll32.exe]
    "nwiz"="nwiz.exe" [2003-05-02 22:19 C:\WINDOWS\system32
    wiz.exe]
    "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 20:10]
    "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 10:27]
    "AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 17:12]
    "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
    "hplampc"="C:\WINDOWS\system32\hplampc.exe" [2002-01-17 09:40]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
    "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
    "AdslTaskBar"="stmctrl.dll" [2005-02-11 09:38 C:\WINDOWS\system32\stmctrl.dll]
    "Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 08:34]
    "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 14:53]
    "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-13 19:05]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-01 12:04]
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22]
    "SpyHunter"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 18:03]

    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
    Multi talen Woordenboek takenbalk.lnk - C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe [2006-10-10 18:12:19]

    [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}"= C:\WINDOWS\system32\tuvuuuv.dll [2007-11-28 17:41 34304]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
    otify\tuvuuuv]
    tuvuuuv.dll 2007-11-28 17:41 34304 C:\WINDOWS\system32\tuvuuuv.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnli.dll

    R3 hp4200c;%usbscan.SvcDesc%;C:\WINDOWS\system32\DRIVERS\hp4200c.sys
    R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys
    R3 TaurusPci;ADSL Modem PCI Service;C:\WINDOWS\system32\DRIVERS\toruspci.sys
    S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
    S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys
    S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys
    S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys
    S3 stppp;Speedtouch PPP Adapter Adapter;C:\WINDOWS\system32\DRIVERS\stppp.sys

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    \Shell\AutoRun\command - F:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
    \Shell\AutoRun\command - J:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
    \Shell\AutoRun\command - M:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86173d11-8dc0-11db-b0b5-54484d000031}]
    \Shell\AutoRun\command - J:\LaunchU3.exe -a

    *Newly Created Service* - COMHOST
    .
    Inhoud van de 'Gedeelde Taken' map
    "2007-11-18 16:49:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2007-11-29 00:51:02 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2007-11-28 15:24:51 C:\WINDOWS\Tasks\Norton AntiVirus - Volledige systeemscan uitvoeren - Jef.job"
    - C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe
    .
    **************************************************************************

    catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-11-29 10:47:20
    Windows 5.1.2600 Service Pack 2 NTFS

    scannen van verborgen processen …

    scannen van verborgen autostart items …

    scannen van verborgen bestanden …

    Scan succesvol afgerond
    verborgen bestanden: 0

    **************************************************************************
    .
    Voltooingstijd: 2007-11-29 10:52:45 - machine was rebooted
    .
    — E O F —
  • Download Combofix even opnieuw en download hem naar je bureaublad toe!
    Nu heb je hem gestart vanuit het download venster van je brouwser.

    Open Kladblok, kopiëer en plak het volgende (vetgedrukte tekst) in een leeg venster:
    [b:a8ce91ef5b]
    File::
    C:\WINDOWS\system32\urqppmj.dll
    C:\WINDOWS\system32\drvmiw.dll
    C:\WINDOWS\system32\hggffge.dll
    C:\WINDOWS\system32\tuvuuuv.dll

    Folder::
    C:\WINDOWS\system32\skjlrsjp
    C:\Program Files\jehuvsvc
    C:\Program Files\Uqrosrjw

    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}]
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62780D18-D103-03D3-323A-01F43008B839}]
    [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}"=-
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
    "Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
    [/b:a8ce91ef5b]

    Sla dit op op je Bureaublad als [b:a8ce91ef5b]CFScript.txt[/b:a8ce91ef5b]

    Sleep [b:a8ce91ef5b]CFScript.txt[/b:a8ce91ef5b] in [b:a8ce91ef5b]ComboFix.exe[/b:a8ce91ef5b] zoals getoond in onderstaand voorbeeld :
    [img:a8ce91ef5b]http://img.photobucket.com/albums/v666/sUBs/CFScript.gif[/img:a8ce91ef5b]

    Dit zal [b:a8ce91ef5b]ComboFix[/b:a8ce91ef5b] doen herstarten.
    Start opnieuw op als daarom gevraagd wordt en post de inhoud van de Combofix.txt in je volgende antwoord samen met een nieuw HijackThislogje.

    Pim :)
  • beide log's

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:23:46, on 29/11/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus
    avapsvc.exe
    C:\Program Files\Eset
    od32krn.exe
    C:\Program Files\SiteAdvisor\6172\SAService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\system32\hplampc.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Belgacom\bin\sprtcmd.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\hijackthis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: Multi talen Woordenboek takenbalk.lnk = ?
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1B40DB49-1373-4D22-A753-9CCDF21FFF4F}: NameServer = 195.238.2.21 195.238.2.22
    O20 - Winlogon Notify: tuvuuuv - tuvuuuv.dll (file missing)
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
    avapsvc.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset
    od32krn.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
    vsvc32.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: SiteAdvisor-service (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O24 - Desktop Component 0: (no name) - http://www.rbimovies.nl/media/landbouw/Boerderij/Lezersservice/vettepech1024x768.jpg


    End of file - 12185 bytes




    ComboFix 07-11-29.3 - Jef 2007-11-29 12:08:26.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.31.1043.18.205 [GMT 1:00]
    Gestart vanuit: C:\Documents and Settings\Jef\Bureaublad\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Jef\Bureaublad\CFScript.txt
    * Nieuw herstelpunt werd aangemaakt

    FILE
    C:\WINDOWS\system32\drvmiw.dll
    C:\WINDOWS\system32\hggffge.dll
    C:\WINDOWS\system32\tuvuuuv.dll
    C:\WINDOWS\system32\urqppmj.dll
    .

    (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\jehuvsvc
    C:\Program Files\jehuvsvc\detklwns.dll
    C:\Program Files\Uqrosrjw
    C:\Program Files\Uqrosrjw\pturgriq.dll
    C:\WINDOWS\system32\drvmiw.dll
    C:\WINDOWS\system32\hggffge.dll
    C:\WINDOWS\system32\ilnmp.ini
    C:\WINDOWS\system32\ilnmp.ini2
    C:\WINDOWS\system32\pmnli.dll
    C:\WINDOWS\system32\skjlrsjp
    C:\WINDOWS\system32\skjlrsjp\bg1.gif
    C:\WINDOWS\system32\skjlrsjp\bgtop.gif
    C:\WINDOWS\system32\skjlrsjp\bottom1.gif
    C:\WINDOWS\system32\skjlrsjp\essentials.gif
    C:\WINDOWS\system32\skjlrsjp\icon1.ico
    C:\WINDOWS\system32\skjlrsjp\install1.gif
    C:\WINDOWS\system32\skjlrsjp\left1.gif
    C:\WINDOWS\system32\skjlrsjp\li.gif
    C:\WINDOWS\system32\skjlrsjp\logo.gif
    C:\WINDOWS\system32\skjlrsjp\main.htm
    C:\WINDOWS\system32\skjlrsjp\mainframe.htm
    C:\WINDOWS\system32\skjlrsjp\reinstall1.gif
    C:\WINDOWS\system32\skjlrsjp\right1.gif
    C:\WINDOWS\system32\skjlrsjp\s1.htm
    C:\WINDOWS\system32\skjlrsjp\s2.htm
    C:\WINDOWS\system32\skjlrsjp\s3.htm
    C:\WINDOWS\system32\skjlrsjp\SMTop1.gif
    C:\WINDOWS\system32\skjlrsjp\SMTop2.gif
    C:\WINDOWS\system32\skjlrsjp\SMTop3.gif
    C:\WINDOWS\system32\skjlrsjp\SMTop4.gif
    C:\WINDOWS\system32\skjlrsjp\soft1_off.gif
    C:\WINDOWS\system32\skjlrsjp\soft1_off_ext.gif
    C:\WINDOWS\system32\skjlrsjp\soft1_on.gif
    C:\WINDOWS\system32\skjlrsjp\soft1_on_ext.gif
    C:\WINDOWS\system32\skjlrsjp\soft2_off.gif
    C:\WINDOWS\system32\skjlrsjp\soft2_off_ext.gif
    C:\WINDOWS\system32\skjlrsjp\soft2_on.gif
    C:\WINDOWS\system32\skjlrsjp\soft2_on_ext.gif
    C:\WINDOWS\system32\skjlrsjp\soft3_off.gif
    C:\WINDOWS\system32\skjlrsjp\soft3_off_ext.gif
    C:\WINDOWS\system32\skjlrsjp\soft3_on.gif
    C:\WINDOWS\system32\skjlrsjp\soft3_on_ext.gif
    C:\WINDOWS\system32\skjlrsjp\softbottom_off.gif
    C:\WINDOWS\system32\skjlrsjp\softbottom_on.gif
    C:\WINDOWS\system32\skjlrsjp\softleft_off.gif
    C:\WINDOWS\system32\skjlrsjp\softleft_on.gif
    C:\WINDOWS\system32\skjlrsjp\top1.gif
    C:\WINDOWS\system32\skjlrsjp\top2.gif
    C:\WINDOWS\system32\skjlrsjp\turnoff1.gif
    C:\WINDOWS\system32\skjlrsjp\turnon1.gif
    C:\WINDOWS\system32\tuvuuuv.dll
    C:\WINDOWS\system32\urqppmj.dll

    .
    (((((((((((((((((((( Bestanden Gemaakt van 2007-10-28 to 2007-11-29 ))))))))))))))))))))))))))))))
    .

    2007-11-29 11:10 . 2007-11-29 11:10 <DIR> d——– C:\WINDOWS\system32\InsFiles
    2007-11-29 11:09 . <DIR> C:\WINDOWS\LastGood.Tmp
    2007-11-28 22:28 . 2007-11-29 11:39 <DIR> d——– C:\Program Files\Enigma Software Group
    2007-11-28 17:41 . 2007-11-28 17:41 0 –a—— C:\Install
    2007-11-28 16:32 . 2007-11-28 16:33 10,740 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2007-11-28 16:32 . 2007-11-28 16:33 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2007-11-28 16:13 . 2007-11-28 17:13 <DIR> d——– C:\Program Files\Norton Internet Security
    2007-11-28 16:13 . 2007-11-28 16:13 10,344 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys
    2007-11-19 19:02 . 2007-11-19 19:02 <DIR> d——– C:\Program Files\Hasbro Interactive
    2007-10-30 13:39 . 2007-11-28 17:11 54,156 –ah—– C:\WINDOWS\QTFont.qfn
    2007-10-30 13:39 . 2007-10-30 13:39 1,409 –a—— C:\WINDOWS\QTFont.for

    .
    ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-11-29 10:11 ——— d—–w C:\Program Files\Common Files\Symantec Shared
    2007-11-29 08:06 ——— d—–w C:\Documents and Settings\Jef\Application Data\AdobeUM
    2007-11-28 15:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
    2007-11-28 15:33 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
    2007-11-28 15:33 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2007-11-28 15:33 ——— d—–w C:\Program Files\Symantec
    2007-11-28 15:20 ——— d—–w C:\Documents and Settings\Jef\Application Data\Symantec
    2007-11-28 08:54 ——— d—–w C:\Documents and Settings\Jef\Application Data\U3
    2007-11-26 19:06 ——— d—–w C:\Documents and Settings\Bert\Application Data\SiteAdvisor
    2007-11-24 08:42 ——— d—–w C:\Documents and Settings\NetworkService\Application Data\SiteAdvisor
    2007-11-22 08:52 ——— d—–w C:\Documents and Settings\Marc\Application Data\AdobeUM
    2007-11-21 17:19 ——— d—–w C:\Documents and Settings\Bert\Application Data\AdobeUM
    2007-11-21 16:33 ——— d—–w C:\Program Files\Google
    2007-11-20 16:06 ——— d—–w C:\Documents and Settings\Marc\Application Data\U3
    2007-11-18 14:04 ——— d—–w C:\Program Files\SPSSEVAL
    2007-11-15 20:21 ——— d—–w C:\Documents and Settings\Marc\Application Data\SiteAdvisor
    2007-11-09 18:09 ——— d—–w C:\Documents and Settings\Jef\Application Data\SiteAdvisor
    2007-11-04 19:21 ——— d—–w C:\Documents and Settings\Leen\Application Data\AdobeUM
    2007-10-28 19:58 ——— d—–w C:\Documents and Settings\Hans\Application Data\SiteAdvisor
    2007-10-27 12:32 ——— d—–w C:\Documents and Settings\Leen\Application Data\SiteAdvisor
    2007-10-22 19:19 ——— d—–w C:\Documents and Settings\Dries\Application Data\SiteAdvisor
    2007-10-17 20:01 ——— d—–w C:\Program Files\Picasa2
    2007-10-17 19:40 ——— d—–w C:\Program Files\SiteAdvisor
    2007-10-17 19:40 ——— d—–w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
    2007-10-17 19:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
    2007-10-17 19:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
    2007-10-16 19:06 ——— d—–w C:\Documents and Settings\Leen\Application Data\U3
    2007-10-14 18:34 ——— d—–w C:\Documents and Settings\Hans\Application Data\AdobeUM
    2007-10-01 20:53 ——— d—–w C:\Program Files\Lavasoft
    2007-10-01 20:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2007-10-01 20:52 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
    2007-10-01 20:50 ——— d—–w C:\Program Files\Hitman Pro
    2007-10-01 20:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-10-01 20:49 ——— d—–w C:\Documents and Settings\Jef\Application Data\Lavasoft
    2007-10-01 20:30 ——— d—–w C:\Program Files\CCleaner
    2007-10-01 13:49 98,184 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
    2007-10-01 13:49 542,088 —-a-w C:\WINDOWS\system32\SymNeti.dll
    2007-10-01 13:49 31,624 —-a-w C:\WINDOWS\system32\drivers\symids.sys
    2007-10-01 13:49 28,040 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
    2007-10-01 13:49 23,944 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
    2007-10-01 13:49 189,320 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
    2007-10-01 13:49 161,160 —-a-w C:\WINDOWS\system32\SymRedir.dll
    2007-10-01 13:48 12,680 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
    2007-08-22 12:07 2,948 —-a-w C:\Documents and Settings\Leen\Application Data\mdb.bin
    .

    ((((((((((((((((((((((((((((( snapshot@2007-11-29_10.49.35.75 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2007-11-08 15:59:01 136,704 —-a-w C:\WINDOWS\catchme.exe
    + 2007-11-27 02:58:11 140,288 —-a-w C:\WINDOWS\catchme.exe
    - 2005-02-11 08:38:12 294,912 —-a-w C:\WINDOWS\editadsl.exe
    + 2003-04-28 18:55:06 249,856 —-a-w C:\WINDOWS\editadsl.exe
    - 2005-02-11 08:38:12 401,408 —-a-w C:\WINDOWS\stmchart.exe
    + 2003-04-28 18:55:06 401,408 —-a-w C:\WINDOWS\stmchart.exe
    - 2005-02-11 08:38:10 98,304 —-a-w C:\WINDOWS\stmtrace.exe
    + 2003-04-28 18:55:04 94,208 —-a-w C:\WINDOWS\stmtrace.exe
    - 2004-11-16 14:48:38 60,191 —-a-w C:\WINDOWS\system32\drivers\stmatm.sys
    + 2003-04-23 16:54:34 60,106 —-a-w C:\WINDOWS\system32\drivers\stmatm.sys
    - 2004-12-01 14:56:20 504,674 —-a-w C:\WINDOWS\system32\drivers\toruspci.sys
    + 2003-04-30 18:42:34 503,297 —-a-w C:\WINDOWS\system32\drivers\toruspci.sys
    - 2005-02-11 08:38:08 180,224 —-a-w C:\WINDOWS\system32\stmcfg32.dll
    + 2003-04-28 18:55:04 180,224 —-a-w C:\WINDOWS\system32\stmcfg32.dll
    - 2005-02-11 08:38:08 167,936 —-a-w C:\WINDOWS\system32\stmctrl.dll
    + 2003-04-28 18:55:04 151,552 —-a-w C:\WINDOWS\system32\stmctrl.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-22 20:25]
    "NVIEW"="nview.dll" [2003-05-02 22:19 C:\WINDOWS\system32
    view.dll]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 11:57]
    "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2004-09-13 09:22]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-23 19:11]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 15:04]
    "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 06:07]
    "CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 06:23]
    "HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 02:03]
    "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 01:58]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 20:42]
    "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:03 C:\WINDOWS\system32\rundll32.exe]
    "nwiz"="nwiz.exe" [2003-05-02 22:19 C:\WINDOWS\system32
    wiz.exe]
    "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 20:10]
    "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 10:27]
    "AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 17:12]
    "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
    "hplampc"="C:\WINDOWS\system32\hplampc.exe" [2002-01-17 09:40]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
    "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
    "Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 08:34]
    "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 14:53]
    "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-13 19:05]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-01 12:04]
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22]
    "AdslTaskBar"="stmctrl.dll" [2003-04-28 19:55 C:\WINDOWS\system32\stmctrl.dll]

    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
    Multi talen Woordenboek takenbalk.lnk - C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe [2006-10-10 18:12:19]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
    otify\tuvuuuv]
    tuvuuuv.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnli.dll

    R3 hp4200c;%usbscan.SvcDesc%;C:\WINDOWS\system32\DRIVERS\hp4200c.sys
    R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys
    R3 TaurusPci;ADSL Modem PCI Service;C:\WINDOWS\system32\DRIVERS\toruspci.sys
    S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
    S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys
    S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys
    S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys
    S3 stppp;Speedtouch PPP Adapter Adapter;C:\WINDOWS\system32\DRIVERS\stppp.sys

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
    \Shell\AutoRun\command - J:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
    \Shell\AutoRun\command - M:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86173d11-8dc0-11db-b0b5-54484d000031}]
    \Shell\AutoRun\command - J:\LaunchU3.exe -a

    *Newly Created Service* - COMHOST
    .
    Inhoud van de 'Gedeelde Taken' map
    "2007-11-18 16:49:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2007-11-29 00:51:02 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2007-11-28 15:24:51 C:\WINDOWS\Tasks\Norton AntiVirus - Volledige systeemscan uitvoeren - Jef.job"
    - C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe
    .
    **************************************************************************

    catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-11-29 12:18:18
    Windows 5.1.2600 Service Pack 2 NTFS

    scannen van verborgen processen …

    scannen van verborgen autostart items …

    scannen van verborgen bestanden …

    Scan succesvol afgerond
    verborgen bestanden: 0

    **************************************************************************
    .
    Voltooingstijd: 2007-11-29 12:22:59 - machine was rebooted
    C:\ComboFix2.txt … 2007-11-29 10:52
    .
    — E O F —
  • Open Kladblok, kopiëer en plak het volgende (vetgedrukte tekst) in een leeg venster:
    [b:096712f6e1]
    File::
    C:\WINDOWS\QTFont.for
    C:\WINDOWS\QTFont.qfn

    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
    otify\tuvuuuv]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages"=hex(7):6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,00,\
    00
    [/b:096712f6e1]
    Sla dit op op je Bureaublad als [b:096712f6e1]CFScript.txt[/b:096712f6e1]

    Sleep [b:096712f6e1]CFScript.txt[/b:096712f6e1] in [b:096712f6e1]ComboFix.exe[/b:096712f6e1] zoals getoond in onderstaand voorbeeld :

    [img:096712f6e1]http://img.photobucket.com/albums/v666/sUBs/CFScript.gif[/img:096712f6e1]

    Dit zal [b:096712f6e1]ComboFix[/b:096712f6e1] doen herstarten.
    Start opnieuw op als daarom gevraagd wordt,
    en post de inhoud van de [b:096712f6e1]Combofix.txt[/b:096712f6e1] in je volgende antwoord samen met een nieuw HijackThislogje.
  • Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:36:38, on 30/11/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus
    avapsvc.exe
    C:\Program Files\Eset
    od32krn.exe
    C:\Program Files\SiteAdvisor\6172\SAService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\windows\system\hpsysdrv.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\hphmon05.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\system32\hplampc.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Belgacom\bin\sprtcmd.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\hijackthis\HijackThis.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
    O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
    O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
    O4 - Global Startup: Multi talen Woordenboek takenbalk.lnk = ?
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1B40DB49-1373-4D22-A753-9CCDF21FFF4F}: NameServer = 195.238.2.21 195.238.2.22
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
    avapsvc.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset
    od32krn.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
    vsvc32.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: SiteAdvisor-service (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O24 - Desktop Component 0: (no name) - http://www.rbimovies.nl/media/landbouw/Boerderij/Lezersservice/vettepech1024x768.jpg


    End of file - 12363 bytes


    ComboFix 07-11-29.3 - Jef 2007-11-30 16:29:15.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.31.1043.18.118 [GMT 1:00]
    Gestart vanuit: C:\Documents and Settings\Jef\Bureaublad\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Jef\Bureaublad\CFScript.txt
    * Nieuw herstelpunt werd aangemaakt

    FILE
    C:\WINDOWS\QTFont.for
    C:\WINDOWS\QTFont.qfn
    .

    (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\QTFont.for
    C:\WINDOWS\QTFont.qfn

    .
    (((((((((((((((((((( Bestanden Gemaakt van 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))
    .

    2007-11-29 11:10 . 2007-11-29 11:10 <DIR> d——– C:\WINDOWS\system32\InsFiles
    2007-11-28 22:28 . 2007-11-29 11:39 <DIR> d——– C:\Program Files\Enigma Software Group
    2007-11-28 17:41 . 2007-11-28 17:41 0 –a—— C:\Install
    2007-11-28 16:32 . 2007-11-28 16:33 10,740 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2007-11-28 16:32 . 2007-11-28 16:33 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2007-11-28 16:13 . 2007-11-28 17:13 <DIR> d——– C:\Program Files\Norton Internet Security
    2007-11-28 16:13 . 2007-11-28 16:13 10,344 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys
    2007-11-19 19:02 . 2007-11-19 19:02 <DIR> d——– C:\Program Files\Hasbro Interactive
    2007-10-23 17:56 . 2007-11-03 17:10 <DIR> d——– C:\Documents and Settings\Dries\Contacts
    2007-10-22 20:19 . 2007-10-22 20:19 <DIR> d——– C:\Documents and Settings\Dries\Application Data\SiteAdvisor
    2007-10-19 16:01 . 2007-11-09 19:09 <DIR> d——– C:\Documents and Settings\Jef\Application Data\SiteAdvisor
    2007-10-18 20:50 . 2007-10-27 13:32 <DIR> d——– C:\Documents and Settings\Leen\Application Data\SiteAdvisor
    2007-10-18 15:42 . 2007-10-28 20:58 <DIR> d——– C:\Documents and Settings\Hans\Application Data\SiteAdvisor
    2007-10-18 07:44 . 2007-11-26 20:06 <DIR> d——– C:\Documents and Settings\Bert\Application Data\SiteAdvisor
    2007-10-18 06:17 . 2007-10-18 06:17 <DIR> d——– C:\Documents and Settings\NetworkService\Bureaublad
    2007-10-18 06:17 . 2007-11-24 09:42 <DIR> d——– C:\Documents and Settings\NetworkService\Application Data\SiteAdvisor
    2007-10-17 21:01 . 2007-10-17 21:01 <DIR> d——– C:\WINDOWS\system32\IOSUBSYS
    2007-10-17 21:01 . 2007-10-17 21:01 <DIR> d——– C:\Program Files\Picasa2
    2007-10-17 21:01 . 2007-11-21 17:33 <DIR> d——– C:\Program Files\Google
    2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Program Files\SiteAdvisor
    2007-10-17 20:40 . 2007-11-15 21:21 <DIR> d——– C:\Documents and Settings\Marc\Application Data\SiteAdvisor
    2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Documents and Settings\LocalService\Bureaublad
    2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
    2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Documents and Settings\All Users\Application Data\SiteAdvisor
    2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Documents and Settings\All Users\Application Data\McAfee
    2007-10-11 08:04 . 2007-10-11 08:07 1,393 –a—— C:\WINDOWS\imsins.BAK
    2007-10-10 09:25 . 2007-07-09 14:11 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
    2007-10-08 22:25 . 2007-01-18 13:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
    2007-10-05 11:53 . 2007-11-23 12:27 244 –ah—– C:\sqmnoopt19.sqm
    2007-10-05 08:28 . 2007-11-23 09:56 244 –ah—– C:\sqmnoopt18.sqm
    2007-10-04 21:56 . 2007-11-22 23:51 244 –ah—– C:\sqmnoopt17.sqm
    2007-10-03 13:14 . 2007-11-22 17:24 244 –ah—– C:\sqmnoopt16.sqm
    2007-10-02 22:35 . 2007-11-22 15:46 244 –ah—– C:\sqmnoopt15.sqm
    2007-10-02 20:23 . 2007-11-22 10:07 244 –ah—– C:\sqmnoopt14.sqm
    2007-10-02 02:54 . 2007-11-21 13:44 244 –ah—– C:\sqmnoopt13.sqm
    2007-10-01 21:53 . 2007-10-01 21:53 <DIR> d——– C:\Program Files\Lavasoft
    2007-10-01 21:53 . 2007-10-01 21:53 <DIR> d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
    2007-10-01 21:52 . 2007-10-01 21:52 <DIR> d——– C:\Program Files\Common Files\Wise Installation Wizard
    2007-10-01 21:34 . 2007-11-20 19:31 <DIR> dr-h—– C:\Documents and Settings\Marc\Onlangs geopend
    2007-10-01 21:30 . 2007-10-01 21:30 <DIR> d——– C:\Program Files\CCleaner
    2007-10-01 17:13 . 2007-11-20 22:46 244 –ah—– C:\sqmnoopt12.sqm
    2007-10-01 16:41 . 2007-11-30 10:40 244 –ah—– C:\sqmnoopt11.sqm
    2007-10-01 14:49 . 2007-10-01 14:49 98,184 –a—— C:\WINDOWS\system32\drivers\symfw.sys
    2007-10-01 14:49 . 2007-10-01 14:49 31,624 –a—— C:\WINDOWS\system32\drivers\symids.sys
    2007-10-01 14:48 . 2007-10-01 14:48 12,680 –a—— C:\WINDOWS\system32\drivers\symdns.sys

    .
    ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-11-29 15:35 ——— d—–w C:\Documents and Settings\Bert\Application Data\Symantec
    2007-11-29 13:18 ——— d—–w C:\Documents and Settings\Marc\Application Data\Symantec
    2007-11-29 11:31 ——— d—–w C:\Program Files\Java
    2007-11-29 10:11 ——— d—–w C:\Program Files\Common Files\Symantec Shared
    2007-11-29 08:06 ——— d—–w C:\Documents and Settings\Jef\Application Data\AdobeUM
    2007-11-28 15:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
    2007-11-28 15:33 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
    2007-11-28 15:33 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2007-11-28 15:33 ——— d—–w C:\Program Files\Symantec
    2007-11-28 15:20 ——— d—–w C:\Documents and Settings\Jef\Application Data\Symantec
    2007-11-28 08:54 ——— d—–w C:\Documents and Settings\Jef\Application Data\U3
    2007-11-22 08:52 ——— d—–w C:\Documents and Settings\Marc\Application Data\AdobeUM
    2007-11-21 17:19 ——— d—–w C:\Documents and Settings\Bert\Application Data\AdobeUM
    2007-11-20 16:06 ——— d—–w C:\Documents and Settings\Marc\Application Data\U3
    2007-11-18 14:04 ——— d—–w C:\Program Files\SPSSEVAL
    2007-11-04 19:21 ——— d—–w C:\Documents and Settings\Leen\Application Data\AdobeUM
    2007-10-16 19:06 ——— d—–w C:\Documents and Settings\Leen\Application Data\U3
    2007-10-14 18:34 ——— d—–w C:\Documents and Settings\Hans\Application Data\AdobeUM
    2007-10-01 20:50 ——— d—–w C:\Program Files\Hitman Pro
    2007-10-01 20:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-10-01 20:49 ——— d—–w C:\Documents and Settings\Jef\Application Data\Lavasoft
    2007-10-01 13:49 542,088 —-a-w C:\WINDOWS\system32\SymNeti.dll
    2007-10-01 13:49 28,040 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
    2007-10-01 13:49 23,944 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
    2007-10-01 13:49 189,320 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
    2007-10-01 13:49 161,160 —-a-w C:\WINDOWS\system32\SymRedir.dll
    2007-08-22 12:07 2,948 —-a-w C:\Documents and Settings\Leen\Application Data\mdb.bin
    2007-08-21 06:18 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2007-11-29_10.49.35.75 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2007-11-08 15:59:01 136,704 —-a-w C:\WINDOWS\catchme.exe
    + 2007-11-27 02:58:11 140,288 —-a-w C:\WINDOWS\catchme.exe
    - 2005-02-11 08:38:12 294,912 —-a-w C:\WINDOWS\editadsl.exe
    + 2003-04-28 18:55:06 249,856 —-a-w C:\WINDOWS\editadsl.exe
    - 2005-02-11 08:38:12 401,408 —-a-w C:\WINDOWS\stmchart.exe
    + 2003-04-28 18:55:06 401,408 —-a-w C:\WINDOWS\stmchart.exe
    - 2005-02-11 08:38:10 98,304 —-a-w C:\WINDOWS\stmtrace.exe
    + 2003-04-28 18:55:04 94,208 —-a-w C:\WINDOWS\stmtrace.exe
    - 2004-11-16 14:48:38 60,191 —-a-w C:\WINDOWS\system32\drivers\stmatm.sys
    + 2003-04-23 16:54:34 60,106 —-a-w C:\WINDOWS\system32\drivers\stmatm.sys
    - 2004-12-01 14:56:20 504,674 —-a-w C:\WINDOWS\system32\drivers\toruspci.sys
    + 2003-04-30 18:42:34 503,297 —-a-w C:\WINDOWS\system32\drivers\toruspci.sys
    - 2005-11-10 09:27:06 49,248 —-a-w C:\WINDOWS\system32\java.exe
    + 2007-09-24 21:30:28 135,168 —-a-w C:\WINDOWS\system32\java.exe
    - 2005-11-10 09:27:16 49,250 —-a-w C:\WINDOWS\system32\javaw.exe
    + 2007-09-24 21:30:30 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
    - 2005-11-10 11:03:54 127,078 —-a-w C:\WINDOWS\system32\javaws.exe
    + 2007-09-24 22:31:42 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
    - 2005-02-11 08:38:08 180,224 —-a-w C:\WINDOWS\system32\stmcfg32.dll
    + 2003-04-28 18:55:04 180,224 —-a-w C:\WINDOWS\system32\stmcfg32.dll
    - 2005-02-11 08:38:08 167,936 —-a-w C:\WINDOWS\system32\stmctrl.dll
    + 2003-04-28 18:55:04 151,552 —-a-w C:\WINDOWS\system32\stmctrl.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-22 20:25]
    "NVIEW"="nview.dll" [2003-05-02 22:19 C:\WINDOWS\system32
    view.dll]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 11:57]
    "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2004-09-13 09:22]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-23 19:11]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 15:04]
    "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 06:07]
    "CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 06:23]
    "HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 02:03]
    "HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 01:58]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 20:42]
    "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:03 C:\WINDOWS\system32\rundll32.exe]
    "nwiz"="nwiz.exe" [2003-05-02 22:19 C:\WINDOWS\system32
    wiz.exe]
    "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 20:10]
    "Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 10:27]
    "AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 17:12]
    "Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
    "hplampc"="C:\WINDOWS\system32\hplampc.exe" [2002-01-17 09:40]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
    "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
    "Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 08:34]
    "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 14:53]
    "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-13 19:05]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-01 12:04]
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22]
    "AdslTaskBar"="stmctrl.dll" [2003-04-28 19:55 C:\WINDOWS\system32\stmctrl.dll]

    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
    Multi talen Woordenboek takenbalk.lnk - C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe [2006-10-10 18:12:19]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
    otify\tuvuuuv]
    tuvuuuv.dll

    R3 hp4200c;%usbscan.SvcDesc%;C:\WINDOWS\system32\DRIVERS\hp4200c.sys
    R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys
    R3 TaurusPci;ADSL Modem PCI Service;C:\WINDOWS\system32\DRIVERS\toruspci.sys
    S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
    S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys
    S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys
    S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys
    S3 stppp;Speedtouch PPP Adapter Adapter;C:\WINDOWS\system32\DRIVERS\stppp.sys

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
    \Shell\AutoRun\command - J:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
    \Shell\AutoRun\command - M:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86173d11-8dc0-11db-b0b5-54484d000031}]
    \Shell\AutoRun\command - J:\LaunchU3.exe -a

    *Newly Created Service* - COMHOST
    .
    Inhoud van de 'Gedeelde Taken' map
    "2007-11-18 16:49:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2007-11-29 00:51:02 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2007-11-28 15:24:51 C:\WINDOWS\Tasks\Norton AntiVirus - Volledige systeemscan uitvoeren - Jef.job"
    - C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-11-30 16:34:05
    Windows 5.1.2600 Service Pack 2 NTFS

    scannen van verborgen processen …

    scannen van verborgen autostart items …

    scannen van verborgen bestanden …

    **************************************************************************
    .
    Voltooingstijd: 2007-11-30 16:35:43
    C:\ComboFix2.txt … 2007-11-29 12:22
    C:\ComboFix3.txt … 2007-11-29 10:52
    .
    — E O F —
  • Probeer onderstaande eens:

    Download Dr.Web Cureit naar je bureaublad.
    [list:fd44729c0b]
    * Dubbelklik [b:fd44729c0b]drweb-cureit.exe[/b:fd44729c0b] en sta het toe om de express scan te starten.
    * Indien een popup verschijnt met het voorstel tot kopen/50% korting,
    mag je deze sluiten met het kruisje.
    * Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt,
    klik de [b:fd44729c0b]Yes to all[/b:fd44729c0b] knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
    * Kies bovenaan in het menu voor [b:fd44729c0b]Language/Taal[/b:fd44729c0b] en wijzig deze naar [b:fd44729c0b]Dutch (Nederlands)[/b:fd44729c0b] indien deze bij jou anders staat ingesteld.
    * Druk op [b:fd44729c0b]F9[/b:fd44729c0b] en kies daarna voor [b:fd44729c0b]Acties[/b:fd44729c0b] en stel daar het volgende in onder [b:fd44729c0b]Malware[/b:fd44729c0b] :
    o Adware: [b:fd44729c0b]Verplaats[/b:fd44729c0b]
    Dialers: [b:fd44729c0b]Verplaats[/b:fd44729c0b]
    Jokes: [b:fd44729c0b]Rapportage[/b:fd44729c0b]
    Riskware: [b:fd44729c0b]Rapportage[/b:fd44729c0b]
    Hacktools: [b:fd44729c0b]Verplaats[/b:fd44729c0b]
    Haal dan het [b:fd44729c0b]vinkje weg bij "Prompt bij actie"[/b:fd44729c0b].
    Druk dan op [b:fd44729c0b]OK[/b:fd44729c0b].
    * Druk op [b:fd44729c0b]F9[/b:fd44729c0b] en kies daarna voor [b:fd44729c0b]Scan[/b:fd44729c0b] en verwijder het vinkje bij [b:fd44729c0b]Heuristische analyse[/b:fd44729c0b] en klik op [b:fd44729c0b]OK[/b:fd44729c0b].
    * Eenmaal de korte scan is beeïndigd, kan je de drives selecteren die je wilt laten scannen (Selecteer stations).
    * Selecteer hier [b:fd44729c0b]alle stations[/b:fd44729c0b]. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
    * Klik daarna de groene pijl[/color:fd44729c0b] rechts om de scan te starten.
    * Gevonden bestanden worden naar de "%userprofile%\DoctorWeb\quarantaine-map" verplaatst, indien herstel niet mogelijk is.
    * Nadat de scan gedaan is, in het menu bovenaan, klik [b:fd44729c0b]Bestand[/b:fd44729c0b] en kies [b:fd44729c0b]Rapportage lijst opslaan[/b:fd44729c0b]. Bewaar het op je Bureaublad.
    * Sluit daarna Dr.Web Cureit.
    * [b:fd44729c0b]Herstart[/b:fd44729c0b] je computer!! [i:fd44729c0b]Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.[/i:fd44729c0b]
    * Na het herstarten, [b:fd44729c0b]kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.[/b:fd44729c0b]
    [/list:u:fd44729c0b]

    Pim
  • sorry, maar het ligt even stil, op mysterieuze wijze staat er op elke account plots een wachtwoord, dus kan er niemand zich aanmelden, ik eerst eens zoeken wat ik daar aan kan doen
  • Hmm, dat is gek :(
    Ik zie het vanzelf wel verschijnen!
  • tja, hij gaat terug binnen bij de winkel, het lukt me niet echt, ik zal nadien wel iets laten weten, toch bedankt voor alle gedane moeite en tijd
  • Graag gedaan deschutter.
    Ik ben zelf toch wel erg benieuwd hoe die wachtwoorden nou opeens op alle gebruikers accounts komen. :? Zou het niet kunnen dat een andere gebruiker van de laptop deze erop heeft gezet?

    Laat even weten hoe het is afgelopen :wink:

Beantwoord deze vraag

Dit is een gearchiveerde pagina. Antwoorden is niet meer mogelijk.