goeie dag,
ik heb een probleem, norton vind een virus genaamd trojan.vundo, maar kan dit niet verwijderen, kan er iemand mij helpen?

bij voorbaat dank

sorry, maar het ligt even stil, op mysterieuze wijze staat er op elke account plots een wachtwoord, dus kan er niemand zich aanmelden, ik eerst eens zoeken wat ik daar aan kan doen

Hmm, dat is gek
Ik zie het vanzelf wel verschijnen!

Ik denk wel dat ik dat kan ja

Download Combofix naar je Bureaublad.
[list:2d0780a969]
Dubbelklik [b:2d0780a969]Combofix.exe[/b:2d0780a969]
Volg de instructies, aanvaard de disclaimer door "[b:2d0780a969]1[/b:2d0780a969]" te typen en te bevestigen via "[b:2d0780a969]Enter[/b:2d0780a969]".
Tijdens het runnen van de fix, [b:2d0780a969]NIET[/b:2d0780a969] in het venster klikken, want dit zal je pc doen vasthangen.[/list:u:2d0780a969]

Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.
[i:2d0780a969]Plaats deze log in je volgende post samen met een nieuw HijackThis log.[/i:2d0780a969]

[b:2d0780a969]Note:[/b:2d0780a969] Indien je virusscanner reageert tijdens het downloaden of gebruik van Combofix, mag je dit negeren.

Lees dit even door hoe je een Hijackthis log maakt:
http://forum.computertotaal.nl/phpBB2/viewtopic.php?t=115358

Pim

hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:23:42, on 29/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\hplampc.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Belgacom\bin\sprtcmd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Jef\LOCALS~1\Temp\Rar$EX00.657\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: Multi talen Woordenboek takenbalk.lnk = ?
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CS1\Services\Tcpip\..\{1B40DB49-1373-4D22-A753-9CCDF21FFF4F}: NameServer = 195.238.2.21 195.238.2.22
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: SiteAdvisor-service (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://www.rbimovies.nl/media/landbouw/Boerderij/Lezersservice/vettepech1024x768.jpg

–
End of file - 10883 bytes


ComboFix 07-11-19.4C - Jef 2007-11-29 10:27:07.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.31.1043.18.109 [GMT 1:00]
Gestart vanuit: C:\Documents and Settings\Jef\Local Settings\Temporary Internet Files\Content.IE5\89IF0XYV\ComboFix[1].exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\slwbszqn.dll
C:\Program Files\Common Files\ppatch~1
C:\Program Files\Common Files\ppatch~1\??pPatch\
C:\Program Files\Common Files\ppatch~1\rundll.exe
C:\Program Files\Common Files\Yazzle1162OinAdmin.exe
C:\Program Files\SecCenter
C:\WINDOWS\system32\drvmiwr.dll
C:\WINDOWS\system32\nqtss.ini
C:\WINDOWS\system32\nqtss.ini2
C:\WINDOWS\system32\sstqn.dll
C:\WINDOWS\system32\winmmt32.dll
K:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_WINDOWS_LOG


(((((((((((((((((((( Bestanden Gemaakt van 2007-10-28 to 2007-11-29 ))))))))))))))))))))))))))))))
.

2007-11-28 22:28 <DIR> d——– C:\Program Files\Enigma Software Group
2007-11-28 17:43 37,376 –a—— C:\WINDOWS\system32\urqppmj.dll
2007-11-28 17:42 <DIR> d——– C:\WINDOWS\system32\skjlrsjp
2007-11-28 17:42 <DIR> d——– C:\Program Files\Uqrosrjw
2007-11-28 17:41 <DIR> d——– C:\Program Files\jehuvsvc
2007-11-28 17:41 102,912 –a—— C:\WINDOWS\system32\drvmiw.dll
2007-11-28 17:41 37,376 –a—— C:\WINDOWS\system32\hggffge.dll
2007-11-28 17:41 34,304 ——— C:\WINDOWS\system32\tuvuuuv.dll
2007-11-28 16:32 10,740 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-28 16:32 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-28 16:13 <DIR> d——– C:\Program Files\Norton Internet Security
2007-11-28 16:13 10,344 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-11-19 19:02 <DIR> d——– C:\Program Files\Hasbro Interactive

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-29 08:06 ——— d—–w C:\Documents and Settings\Jef\Application Data\AdobeUM
2007-11-28 17:30 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-28 15:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-28 15:33 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-28 15:33 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-28 15:33 ——— d—–w C:\Program Files\Symantec
2007-11-28 15:20 ——— d—–w C:\Documents and Settings\Jef\Application Data\Symantec
2007-11-28 08:54 ——— d—–w C:\Documents and Settings\Jef\Application Data\U3
2007-11-26 19:06 ——— d—–w C:\Documents and Settings\Bert\Application Data\SiteAdvisor
2007-11-24 08:42 ——— d—–w C:\Documents and Settings\NetworkService\Application Data\SiteAdvisor
2007-11-22 08:52 ——— d—–w C:\Documents and Settings\Marc\Application Data\AdobeUM
2007-11-21 17:19 ——— d—–w C:\Documents and Settings\Bert\Application Data\AdobeUM
2007-11-21 16:33 ——— d—–w C:\Program Files\Google
2007-11-20 16:06 ——— d—–w C:\Documents and Settings\Marc\Application Data\U3
2007-11-18 14:04 ——— d—–w C:\Program Files\SPSSEVAL
2007-11-15 20:21 ——— d—–w C:\Documents and Settings\Marc\Application Data\SiteAdvisor
2007-11-09 18:09 ——— d—–w C:\Documents and Settings\Jef\Application Data\SiteAdvisor
2007-11-04 19:21 ——— d—–w C:\Documents and Settings\Leen\Application Data\AdobeUM
2007-10-28 19:58 ——— d—–w C:\Documents and Settings\Hans\Application Data\SiteAdvisor
2007-10-27 12:32 ——— d—–w C:\Documents and Settings\Leen\Application Data\SiteAdvisor
2007-10-22 19:19 ——— d—–w C:\Documents and Settings\Dries\Application Data\SiteAdvisor
2007-10-17 20:01 ——— d—–w C:\Program Files\Picasa2
2007-10-17 19:40 ——— d—–w C:\Program Files\SiteAdvisor
2007-10-17 19:40 ——— d—–w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-10-17 19:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-10-17 19:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-16 19:06 ——— d—–w C:\Documents and Settings\Leen\Application Data\U3
2007-10-14 18:34 ——— d—–w C:\Documents and Settings\Hans\Application Data\AdobeUM
2007-10-01 20:53 ——— d—–w C:\Program Files\Lavasoft
2007-10-01 20:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-01 20:52 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-01 20:50 ——— d—–w C:\Program Files\Hitman Pro
2007-10-01 20:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-01 20:49 ——— d—–w C:\Documents and Settings\Jef\Application Data\Lavasoft
2007-10-01 20:30 ——— d—–w C:\Program Files\CCleaner
2007-10-01 13:49 98,184 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-01 13:49 542,088 —-a-w C:\WINDOWS\system32\SymNeti.dll
2007-10-01 13:49 31,624 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-01 13:49 28,040 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-01 13:49 23,944 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-01 13:49 189,320 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-01 13:49 161,160 —-a-w C:\WINDOWS\system32\SymRedir.dll
2007-10-01 13:48 12,680 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2007-08-22 12:07 2,948 —-a-w C:\Documents and Settings\Leen\Application Data\mdb.bin
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}]
2007-11-28 17:41 34304 ——— C:\WINDOWS\system32\tuvuuuv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62780D18-D103-03D3-323A-01F43008B839}]
2007-11-28 17:42 98304 –a—— C:\Program Files\Uqrosrjw\pturgriq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-22 20:25]
"NVIEW"="nview.dll" [2003-05-02 22:19 C:\WINDOWS\system32\nview.dll]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 11:57]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2004-09-13 09:22]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-23 19:11]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 15:04]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 06:07]
"CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 06:23]
"HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 02:03]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 01:58]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 20:42]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:03 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-05-02 22:19 C:\WINDOWS\system32\nwiz.exe]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 20:10]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 10:27]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 17:12]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
"hplampc"="C:\WINDOWS\system32\hplampc.exe" [2002-01-17 09:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"AdslTaskBar"="stmctrl.dll" [2005-02-11 09:38 C:\WINDOWS\system32\stmctrl.dll]
"Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 08:34]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 14:53]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-13 19:05]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-01 12:04]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22]
"SpyHunter"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 18:03]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Multi talen Woordenboek takenbalk.lnk - C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe [2006-10-10 18:12:19]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}"= C:\WINDOWS\system32\tuvuuuv.dll [2007-11-28 17:41 34304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuuuv]
tuvuuuv.dll 2007-11-28 17:41 34304 C:\WINDOWS\system32\tuvuuuv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnli.dll

R3 hp4200c;%usbscan.SvcDesc%;C:\WINDOWS\system32\DRIVERS\hp4200c.sys
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys
R3 TaurusPci;ADSL Modem PCI Service;C:\WINDOWS\system32\DRIVERS\toruspci.sys
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys
S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys
S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys
S3 stppp;Speedtouch PPP Adapter Adapter;C:\WINDOWS\system32\DRIVERS\stppp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
\Shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86173d11-8dc0-11db-b0b5-54484d000031}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Inhoud van de 'Gedeelde Taken' map
"2007-11-18 16:49:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-29 00:51:02 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-28 15:24:51 C:\WINDOWS\Tasks\Norton AntiVirus - Volledige systeemscan uitvoeren - Jef.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-29 10:47:20
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen …

scannen van verborgen autostart items …

scannen van verborgen bestanden …

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2007-11-29 10:52:45 - machine was rebooted
.
— E O F —

Download Combofix even opnieuw en download hem naar je bureaublad toe!
Nu heb je hem gestart vanuit het download venster van je brouwser.

Open Kladblok, kopiëer en plak het volgende (vetgedrukte tekst) in een leeg venster:
[b:a8ce91ef5b]
File::
C:\WINDOWS\system32\urqppmj.dll
C:\WINDOWS\system32\drvmiw.dll
C:\WINDOWS\system32\hggffge.dll
C:\WINDOWS\system32\tuvuuuv.dll

Folder::
C:\WINDOWS\system32\skjlrsjp
C:\Program Files\jehuvsvc
C:\Program Files\Uqrosrjw

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{62780D18-D103-03D3-323A-01F43008B839}]
[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{30BAA4DF-E0AB-4AFD-B6D8-FFAA032D0468}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
[/b:a8ce91ef5b]

Sla dit op op je Bureaublad als [b:a8ce91ef5b]CFScript.txt[/b:a8ce91ef5b]

Sleep [b:a8ce91ef5b]CFScript.txt[/b:a8ce91ef5b] in [b:a8ce91ef5b]ComboFix.exe[/b:a8ce91ef5b] zoals getoond in onderstaand voorbeeld :
[img:a8ce91ef5b]http://img.photobucket.com/albums/v666/sUBs/CFScript.gif[/img:a8ce91ef5b]

Dit zal [b:a8ce91ef5b]ComboFix[/b:a8ce91ef5b] doen herstarten.
Start opnieuw op als daarom gevraagd wordt en post de inhoud van de Combofix.txt in je volgende antwoord samen met een nieuw HijackThislogje.

Pim

beide log's

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:23:46, on 29/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\hplampc.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Belgacom\bin\sprtcmd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\hijackthis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: Multi talen Woordenboek takenbalk.lnk = ?
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CS1\Services\Tcpip\..\{1B40DB49-1373-4D22-A753-9CCDF21FFF4F}: NameServer = 195.238.2.21 195.238.2.22
O20 - Winlogon Notify: tuvuuuv - tuvuuuv.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: SiteAdvisor-service (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://www.rbimovies.nl/media/landbouw/Boerderij/Lezersservice/vettepech1024x768.jpg

–
End of file - 12185 bytes




ComboFix 07-11-29.3 - Jef 2007-11-29 12:08:26.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.31.1043.18.205 [GMT 1:00]
Gestart vanuit: C:\Documents and Settings\Jef\Bureaublad\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jef\Bureaublad\CFScript.txt
* Nieuw herstelpunt werd aangemaakt

FILE
C:\WINDOWS\system32\drvmiw.dll
C:\WINDOWS\system32\hggffge.dll
C:\WINDOWS\system32\tuvuuuv.dll
C:\WINDOWS\system32\urqppmj.dll
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\jehuvsvc
C:\Program Files\jehuvsvc\detklwns.dll
C:\Program Files\Uqrosrjw
C:\Program Files\Uqrosrjw\pturgriq.dll
C:\WINDOWS\system32\drvmiw.dll
C:\WINDOWS\system32\hggffge.dll
C:\WINDOWS\system32\ilnmp.ini
C:\WINDOWS\system32\ilnmp.ini2
C:\WINDOWS\system32\pmnli.dll
C:\WINDOWS\system32\skjlrsjp
C:\WINDOWS\system32\skjlrsjp\bg1.gif
C:\WINDOWS\system32\skjlrsjp\bgtop.gif
C:\WINDOWS\system32\skjlrsjp\bottom1.gif
C:\WINDOWS\system32\skjlrsjp\essentials.gif
C:\WINDOWS\system32\skjlrsjp\icon1.ico
C:\WINDOWS\system32\skjlrsjp\install1.gif
C:\WINDOWS\system32\skjlrsjp\left1.gif
C:\WINDOWS\system32\skjlrsjp\li.gif
C:\WINDOWS\system32\skjlrsjp\logo.gif
C:\WINDOWS\system32\skjlrsjp\main.htm
C:\WINDOWS\system32\skjlrsjp\mainframe.htm
C:\WINDOWS\system32\skjlrsjp\reinstall1.gif
C:\WINDOWS\system32\skjlrsjp\right1.gif
C:\WINDOWS\system32\skjlrsjp\s1.htm
C:\WINDOWS\system32\skjlrsjp\s2.htm
C:\WINDOWS\system32\skjlrsjp\s3.htm
C:\WINDOWS\system32\skjlrsjp\SMTop1.gif
C:\WINDOWS\system32\skjlrsjp\SMTop2.gif
C:\WINDOWS\system32\skjlrsjp\SMTop3.gif
C:\WINDOWS\system32\skjlrsjp\SMTop4.gif
C:\WINDOWS\system32\skjlrsjp\soft1_off.gif
C:\WINDOWS\system32\skjlrsjp\soft1_off_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft1_on.gif
C:\WINDOWS\system32\skjlrsjp\soft1_on_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft2_off.gif
C:\WINDOWS\system32\skjlrsjp\soft2_off_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft2_on.gif
C:\WINDOWS\system32\skjlrsjp\soft2_on_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft3_off.gif
C:\WINDOWS\system32\skjlrsjp\soft3_off_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft3_on.gif
C:\WINDOWS\system32\skjlrsjp\soft3_on_ext.gif
C:\WINDOWS\system32\skjlrsjp\softbottom_off.gif
C:\WINDOWS\system32\skjlrsjp\softbottom_on.gif
C:\WINDOWS\system32\skjlrsjp\softleft_off.gif
C:\WINDOWS\system32\skjlrsjp\softleft_on.gif
C:\WINDOWS\system32\skjlrsjp\top1.gif
C:\WINDOWS\system32\skjlrsjp\top2.gif
C:\WINDOWS\system32\skjlrsjp\turnoff1.gif
C:\WINDOWS\system32\skjlrsjp\turnon1.gif
C:\WINDOWS\system32\tuvuuuv.dll
C:\WINDOWS\system32\urqppmj.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2007-10-28 to 2007-11-29 ))))))))))))))))))))))))))))))
.

2007-11-29 11:10 . 2007-11-29 11:10 <DIR> d——– C:\WINDOWS\system32\InsFiles
2007-11-29 11:09 . <DIR> C:\WINDOWS\LastGood.Tmp
2007-11-28 22:28 . 2007-11-29 11:39 <DIR> d——– C:\Program Files\Enigma Software Group
2007-11-28 17:41 . 2007-11-28 17:41 0 –a—— C:\Install
2007-11-28 16:32 . 2007-11-28 16:33 10,740 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-28 16:32 . 2007-11-28 16:33 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-28 16:13 . 2007-11-28 17:13 <DIR> d——– C:\Program Files\Norton Internet Security
2007-11-28 16:13 . 2007-11-28 16:13 10,344 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-11-19 19:02 . 2007-11-19 19:02 <DIR> d——– C:\Program Files\Hasbro Interactive
2007-10-30 13:39 . 2007-11-28 17:11 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-10-30 13:39 . 2007-10-30 13:39 1,409 –a—— C:\WINDOWS\QTFont.for

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-29 10:11 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-29 08:06 ——— d—–w C:\Documents and Settings\Jef\Application Data\AdobeUM
2007-11-28 15:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-28 15:33 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-28 15:33 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-28 15:33 ——— d—–w C:\Program Files\Symantec
2007-11-28 15:20 ——— d—–w C:\Documents and Settings\Jef\Application Data\Symantec
2007-11-28 08:54 ——— d—–w C:\Documents and Settings\Jef\Application Data\U3
2007-11-26 19:06 ——— d—–w C:\Documents and Settings\Bert\Application Data\SiteAdvisor
2007-11-24 08:42 ——— d—–w C:\Documents and Settings\NetworkService\Application Data\SiteAdvisor
2007-11-22 08:52 ——— d—–w C:\Documents and Settings\Marc\Application Data\AdobeUM
2007-11-21 17:19 ——— d—–w C:\Documents and Settings\Bert\Application Data\AdobeUM
2007-11-21 16:33 ——— d—–w C:\Program Files\Google
2007-11-20 16:06 ——— d—–w C:\Documents and Settings\Marc\Application Data\U3
2007-11-18 14:04 ——— d—–w C:\Program Files\SPSSEVAL
2007-11-15 20:21 ——— d—–w C:\Documents and Settings\Marc\Application Data\SiteAdvisor
2007-11-09 18:09 ——— d—–w C:\Documents and Settings\Jef\Application Data\SiteAdvisor
2007-11-04 19:21 ——— d—–w C:\Documents and Settings\Leen\Application Data\AdobeUM
2007-10-28 19:58 ——— d—–w C:\Documents and Settings\Hans\Application Data\SiteAdvisor
2007-10-27 12:32 ——— d—–w C:\Documents and Settings\Leen\Application Data\SiteAdvisor
2007-10-22 19:19 ——— d—–w C:\Documents and Settings\Dries\Application Data\SiteAdvisor
2007-10-17 20:01 ——— d—–w C:\Program Files\Picasa2
2007-10-17 19:40 ——— d—–w C:\Program Files\SiteAdvisor
2007-10-17 19:40 ——— d—–w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-10-17 19:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-10-17 19:40 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-16 19:06 ——— d—–w C:\Documents and Settings\Leen\Application Data\U3
2007-10-14 18:34 ——— d—–w C:\Documents and Settings\Hans\Application Data\AdobeUM
2007-10-01 20:53 ——— d—–w C:\Program Files\Lavasoft
2007-10-01 20:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-01 20:52 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-01 20:50 ——— d—–w C:\Program Files\Hitman Pro
2007-10-01 20:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-01 20:49 ——— d—–w C:\Documents and Settings\Jef\Application Data\Lavasoft
2007-10-01 20:30 ——— d—–w C:\Program Files\CCleaner
2007-10-01 13:49 98,184 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
2007-10-01 13:49 542,088 —-a-w C:\WINDOWS\system32\SymNeti.dll
2007-10-01 13:49 31,624 —-a-w C:\WINDOWS\system32\drivers\symids.sys
2007-10-01 13:49 28,040 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-01 13:49 23,944 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-01 13:49 189,320 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-01 13:49 161,160 —-a-w C:\WINDOWS\system32\SymRedir.dll
2007-10-01 13:48 12,680 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
2007-08-22 12:07 2,948 —-a-w C:\Documents and Settings\Leen\Application Data\mdb.bin
.

((((((((((((((((((((((((((((( snapshot@2007-11-29_10.49.35.75 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-08 15:59:01 136,704 —-a-w C:\WINDOWS\catchme.exe
+ 2007-11-27 02:58:11 140,288 —-a-w C:\WINDOWS\catchme.exe
- 2005-02-11 08:38:12 294,912 —-a-w C:\WINDOWS\editadsl.exe
+ 2003-04-28 18:55:06 249,856 —-a-w C:\WINDOWS\editadsl.exe
- 2005-02-11 08:38:12 401,408 —-a-w C:\WINDOWS\stmchart.exe
+ 2003-04-28 18:55:06 401,408 —-a-w C:\WINDOWS\stmchart.exe
- 2005-02-11 08:38:10 98,304 —-a-w C:\WINDOWS\stmtrace.exe
+ 2003-04-28 18:55:04 94,208 —-a-w C:\WINDOWS\stmtrace.exe
- 2004-11-16 14:48:38 60,191 —-a-w C:\WINDOWS\system32\drivers\stmatm.sys
+ 2003-04-23 16:54:34 60,106 —-a-w C:\WINDOWS\system32\drivers\stmatm.sys
- 2004-12-01 14:56:20 504,674 —-a-w C:\WINDOWS\system32\drivers\toruspci.sys
+ 2003-04-30 18:42:34 503,297 —-a-w C:\WINDOWS\system32\drivers\toruspci.sys
- 2005-02-11 08:38:08 180,224 —-a-w C:\WINDOWS\system32\stmcfg32.dll
+ 2003-04-28 18:55:04 180,224 —-a-w C:\WINDOWS\system32\stmcfg32.dll
- 2005-02-11 08:38:08 167,936 —-a-w C:\WINDOWS\system32\stmctrl.dll
+ 2003-04-28 18:55:04 151,552 —-a-w C:\WINDOWS\system32\stmctrl.dll
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-22 20:25]
"NVIEW"="nview.dll" [2003-05-02 22:19 C:\WINDOWS\system32\nview.dll]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 11:57]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2004-09-13 09:22]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-23 19:11]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 15:04]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 06:07]
"CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 06:23]
"HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 02:03]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 01:58]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 20:42]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:03 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-05-02 22:19 C:\WINDOWS\system32\nwiz.exe]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 20:10]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 10:27]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 17:12]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
"hplampc"="C:\WINDOWS\system32\hplampc.exe" [2002-01-17 09:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 12:03]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 08:34]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 14:53]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-13 19:05]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-01 12:04]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22]
"AdslTaskBar"="stmctrl.dll" [2003-04-28 19:55 C:\WINDOWS\system32\stmctrl.dll]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Multi talen Woordenboek takenbalk.lnk - C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe [2006-10-10 18:12:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuuuv]
tuvuuuv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnli.dll

R3 hp4200c;%usbscan.SvcDesc%;C:\WINDOWS\system32\DRIVERS\hp4200c.sys
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys
R3 TaurusPci;ADSL Modem PCI Service;C:\WINDOWS\system32\DRIVERS\toruspci.sys
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys
S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys
S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys
S3 stppp;Speedtouch PPP Adapter Adapter;C:\WINDOWS\system32\DRIVERS\stppp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
\Shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86173d11-8dc0-11db-b0b5-54484d000031}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Inhoud van de 'Gedeelde Taken' map
"2007-11-18 16:49:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-29 00:51:02 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-28 15:24:51 C:\WINDOWS\Tasks\Norton AntiVirus - Volledige systeemscan uitvoeren - Jef.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-29 12:18:18
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen …

scannen van verborgen autostart items …

scannen van verborgen bestanden …

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2007-11-29 12:22:59 - machine was rebooted
C:\ComboFix2.txt … 2007-11-29 10:52
.
— E O F —

Open Kladblok, kopiëer en plak het volgende (vetgedrukte tekst) in een leeg venster:
[b:096712f6e1]
File::
C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuuuv]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,00,\
00
[/b:096712f6e1]
Sla dit op op je Bureaublad als [b:096712f6e1]CFScript.txt[/b:096712f6e1]

Sleep [b:096712f6e1]CFScript.txt[/b:096712f6e1] in [b:096712f6e1]ComboFix.exe[/b:096712f6e1] zoals getoond in onderstaand voorbeeld :

[img:096712f6e1]http://img.photobucket.com/albums/v666/sUBs/CFScript.gif[/img:096712f6e1]

Dit zal [b:096712f6e1]ComboFix[/b:096712f6e1] doen herstarten.
Start opnieuw op als daarom gevraagd wordt,
en post de inhoud van de [b:096712f6e1]Combofix.txt[/b:096712f6e1] in je volgende antwoord samen met een nieuw HijackThislogje.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:36:38, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\hplampc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Belgacom\bin\sprtcmd.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\hijackthis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scouts-pulle.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: Multi talen Woordenboek takenbalk.lnk = ?
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CS1\Services\Tcpip\..\{1B40DB49-1373-4D22-A753-9CCDF21FFF4F}: NameServer = 195.238.2.21 195.238.2.22
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: SiteAdvisor-service (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - http://www.rbimovies.nl/media/landbouw/Boerderij/Lezersservice/vettepech1024x768.jpg

–
End of file - 12363 bytes


ComboFix 07-11-29.3 - Jef 2007-11-30 16:29:15.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.31.1043.18.118 [GMT 1:00]
Gestart vanuit: C:\Documents and Settings\Jef\Bureaublad\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jef\Bureaublad\CFScript.txt
* Nieuw herstelpunt werd aangemaakt

FILE
C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\QTFont.for
C:\WINDOWS\QTFont.qfn

.
(((((((((((((((((((( Bestanden Gemaakt van 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))
.

2007-11-29 11:10 . 2007-11-29 11:10 <DIR> d——– C:\WINDOWS\system32\InsFiles
2007-11-28 22:28 . 2007-11-29 11:39 <DIR> d——– C:\Program Files\Enigma Software Group
2007-11-28 17:41 . 2007-11-28 17:41 0 –a—— C:\Install
2007-11-28 16:32 . 2007-11-28 16:33 10,740 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-28 16:32 . 2007-11-28 16:33 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-28 16:13 . 2007-11-28 17:13 <DIR> d——– C:\Program Files\Norton Internet Security
2007-11-28 16:13 . 2007-11-28 16:13 10,344 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-11-19 19:02 . 2007-11-19 19:02 <DIR> d——– C:\Program Files\Hasbro Interactive
2007-10-23 17:56 . 2007-11-03 17:10 <DIR> d——– C:\Documents and Settings\Dries\Contacts
2007-10-22 20:19 . 2007-10-22 20:19 <DIR> d——– C:\Documents and Settings\Dries\Application Data\SiteAdvisor
2007-10-19 16:01 . 2007-11-09 19:09 <DIR> d——– C:\Documents and Settings\Jef\Application Data\SiteAdvisor
2007-10-18 20:50 . 2007-10-27 13:32 <DIR> d——– C:\Documents and Settings\Leen\Application Data\SiteAdvisor
2007-10-18 15:42 . 2007-10-28 20:58 <DIR> d——– C:\Documents and Settings\Hans\Application Data\SiteAdvisor
2007-10-18 07:44 . 2007-11-26 20:06 <DIR> d——– C:\Documents and Settings\Bert\Application Data\SiteAdvisor
2007-10-18 06:17 . 2007-10-18 06:17 <DIR> d——– C:\Documents and Settings\NetworkService\Bureaublad
2007-10-18 06:17 . 2007-11-24 09:42 <DIR> d——– C:\Documents and Settings\NetworkService\Application Data\SiteAdvisor
2007-10-17 21:01 . 2007-10-17 21:01 <DIR> d——– C:\WINDOWS\system32\IOSUBSYS
2007-10-17 21:01 . 2007-10-17 21:01 <DIR> d——– C:\Program Files\Picasa2
2007-10-17 21:01 . 2007-11-21 17:33 <DIR> d——– C:\Program Files\Google
2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Program Files\SiteAdvisor
2007-10-17 20:40 . 2007-11-15 21:21 <DIR> d——– C:\Documents and Settings\Marc\Application Data\SiteAdvisor
2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Documents and Settings\LocalService\Bureaublad
2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2007-10-17 20:40 . 2007-10-17 20:40 <DIR> d——– C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-11 08:04 . 2007-10-11 08:07 1,393 –a—— C:\WINDOWS\imsins.BAK
2007-10-10 09:25 . 2007-07-09 14:11 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-08 22:25 . 2007-01-18 13:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-10-05 11:53 . 2007-11-23 12:27 244 –ah—– C:\sqmnoopt19.sqm
2007-10-05 08:28 . 2007-11-23 09:56 244 –ah—– C:\sqmnoopt18.sqm
2007-10-04 21:56 . 2007-11-22 23:51 244 –ah—– C:\sqmnoopt17.sqm
2007-10-03 13:14 . 2007-11-22 17:24 244 –ah—– C:\sqmnoopt16.sqm
2007-10-02 22:35 . 2007-11-22 15:46 244 –ah—– C:\sqmnoopt15.sqm
2007-10-02 20:23 . 2007-11-22 10:07 244 –ah—– C:\sqmnoopt14.sqm
2007-10-02 02:54 . 2007-11-21 13:44 244 –ah—– C:\sqmnoopt13.sqm
2007-10-01 21:53 . 2007-10-01 21:53 <DIR> d——– C:\Program Files\Lavasoft
2007-10-01 21:53 . 2007-10-01 21:53 <DIR> d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-01 21:52 . 2007-10-01 21:52 <DIR> d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-10-01 21:34 . 2007-11-20 19:31 <DIR> dr-h—– C:\Documents and Settings\Marc\Onlangs geopend
2007-10-01 21:30 . 2007-10-01 21:30 <DIR> d——– C:\Program Files\CCleaner
2007-10-01 17:13 . 2007-11-20 22:46 244 –ah—– C:\sqmnoopt12.sqm
2007-10-01 16:41 . 2007-11-30 10:40 244 –ah—– C:\sqmnoopt11.sqm
2007-10-01 14:49 . 2007-10-01 14:49 98,184 –a—— C:\WINDOWS\system32\drivers\symfw.sys
2007-10-01 14:49 . 2007-10-01 14:49 31,624 –a—— C:\WINDOWS\system32\drivers\symids.sys
2007-10-01 14:48 . 2007-10-01 14:48 12,680 –a—— C:\WINDOWS\system32\drivers\symdns.sys

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-29 15:35 ——— d—–w C:\Documents and Settings\Bert\Application Data\Symantec
2007-11-29 13:18 ——— d—–w C:\Documents and Settings\Marc\Application Data\Symantec
2007-11-29 11:31 ——— d—–w C:\Program Files\Java
2007-11-29 10:11 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-29 08:06 ——— d—–w C:\Documents and Settings\Jef\Application Data\AdobeUM
2007-11-28 15:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-28 15:33 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-28 15:33 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-28 15:33 ——— d—–w C:\Program Files\Symantec
2007-11-28 15:20 ——— d—–w C:\Documents and Settings\Jef\Application Data\Symantec
2007-11-28 08:54 ——— d—–w C:\Documents and Settings\Jef\Application Data\U3
2007-11-22 08:52 ——— d—–w C:\Documents and Settings\Marc\Application Data\AdobeUM
2007-11-21 17:19 ——— d—–w C:\Documents and Settings\Bert\Application Data\AdobeUM
2007-11-20 16:06 ——— d—–w C:\Documents and Settings\Marc\Application Data\U3
2007-11-18 14:04 ——— d—–w C:\Program Files\SPSSEVAL
2007-11-04 19:21 ——— d—–w C:\Documents and Settings\Leen\Application Data\AdobeUM
2007-10-16 19:06 ——— d—–w C:\Documents and Settings\Leen\Application Data\U3
2007-10-14 18:34 ——— d—–w C:\Documents and Settings\Hans\Application Data\AdobeUM
2007-10-01 20:50 ——— d—–w C:\Program Files\Hitman Pro
2007-10-01 20:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-01 20:49 ——— d—–w C:\Documents and Settings\Jef\Application Data\Lavasoft
2007-10-01 13:49 542,088 —-a-w C:\WINDOWS\system32\SymNeti.dll
2007-10-01 13:49 28,040 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
2007-10-01 13:49 23,944 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-01 13:49 189,320 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-01 13:49 161,160 —-a-w C:\WINDOWS\system32\SymRedir.dll
2007-08-22 12:07 2,948 —-a-w C:\Documents and Settings\Leen\Application Data\mdb.bin
2007-08-21 06:18 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
.

((((((((((((((((((((((((((((( snapshot@2007-11-29_10.49.35.75 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-08 15:59:01 136,704 —-a-w C:\WINDOWS\catchme.exe
+ 2007-11-27 02:58:11 140,288 —-a-w C:\WINDOWS\catchme.exe
- 2005-02-11 08:38:12 294,912 —-a-w C:\WINDOWS\editadsl.exe
+ 2003-04-28 18:55:06 249,856 —-a-w C:\WINDOWS\editadsl.exe
- 2005-02-11 08:38:12 401,408 —-a-w C:\WINDOWS\stmchart.exe
+ 2003-04-28 18:55:06 401,408 —-a-w C:\WINDOWS\stmchart.exe
- 2005-02-11 08:38:10 98,304 —-a-w C:\WINDOWS\stmtrace.exe
+ 2003-04-28 18:55:04 94,208 —-a-w C:\WINDOWS\stmtrace.exe
- 2004-11-16 14:48:38 60,191 —-a-w C:\WINDOWS\system32\drivers\stmatm.sys
+ 2003-04-23 16:54:34 60,106 —-a-w C:\WINDOWS\system32\drivers\stmatm.sys
- 2004-12-01 14:56:20 504,674 —-a-w C:\WINDOWS\system32\drivers\toruspci.sys
+ 2003-04-30 18:42:34 503,297 —-a-w C:\WINDOWS\system32\drivers\toruspci.sys
- 2005-11-10 09:27:06 49,248 —-a-w C:\WINDOWS\system32\java.exe
+ 2007-09-24 21:30:28 135,168 —-a-w C:\WINDOWS\system32\java.exe
- 2005-11-10 09:27:16 49,250 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-24 21:30:30 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
- 2005-11-10 11:03:54 127,078 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2007-09-24 22:31:42 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
- 2005-02-11 08:38:08 180,224 —-a-w C:\WINDOWS\system32\stmcfg32.dll
+ 2003-04-28 18:55:04 180,224 —-a-w C:\WINDOWS\system32\stmcfg32.dll
- 2005-02-11 08:38:08 167,936 —-a-w C:\WINDOWS\system32\stmctrl.dll
+ 2003-04-28 18:55:04 151,552 —-a-w C:\WINDOWS\system32\stmctrl.dll
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-22 20:25]
"NVIEW"="nview.dll" [2003-05-02 22:19 C:\WINDOWS\system32\nview.dll]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-12-16 11:57]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [2004-09-13 09:22]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-23 19:11]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 15:04]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-07 06:07]
"CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 06:23]
"HPHUPD05"="c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 02:03]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-05-23 01:58]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 20:42]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:03 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2003-05-02 22:19 C:\WINDOWS\system32\nwiz.exe]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 20:10]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-08-09 10:27]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 19:35 C:\WINDOWS\ALCXMNTR.EXE]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-04-03 17:12]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
"hplampc"="C:\WINDOWS\system32\hplampc.exe" [2002-01-17 09:40]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"Belgacom"="C:\Program Files\Belgacom\bin\sprtcmd.exe" [2006-06-22 08:34]
"AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 14:53]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-13 19:05]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-03-01 12:04]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22]
"AdslTaskBar"="stmctrl.dll" [2003-04-28 19:55 C:\WINDOWS\system32\stmctrl.dll]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Multi talen Woordenboek takenbalk.lnk - C:\Program Files\Easy Computing\Mult Talen Woordenboek\TrueTerm.exe [2006-10-10 18:12:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvuuuv]
tuvuuuv.dll

R3 hp4200c;%usbscan.SvcDesc%;C:\WINDOWS\system32\DRIVERS\hp4200c.sys
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys
R3 TaurusPci;ADSL Modem PCI Service;C:\WINDOWS\system32\DRIVERS\toruspci.sys
S3 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys
S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys
S3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys
S3 stppp;Speedtouch PPP Adapter Adapter;C:\WINDOWS\system32\DRIVERS\stppp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
\Shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86173d11-8dc0-11db-b0b5-54484d000031}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

*Newly Created Service* - COMHOST
.
Inhoud van de 'Gedeelde Taken' map
"2007-11-18 16:49:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-29 00:51:02 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-11-28 15:24:51 C:\WINDOWS\Tasks\Norton AntiVirus - Volledige systeemscan uitvoeren - Jef.job"
- C:\PROGRA~1\NORTON~2\NORTON~1\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-30 16:34:05
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen …

scannen van verborgen autostart items …

scannen van verborgen bestanden …

**************************************************************************
.
Voltooingstijd: 2007-11-30 16:35:43
C:\ComboFix2.txt … 2007-11-29 12:22
C:\ComboFix3.txt … 2007-11-29 10:52
.
— E O F —

Probeer onderstaande eens:

Download Dr.Web Cureit naar je bureaublad.
[list:fd44729c0b]
* Dubbelklik [b:fd44729c0b]drweb-cureit.exe[/b:fd44729c0b] en sta het toe om de express scan te starten.
* Indien een popup verschijnt met het voorstel tot kopen/50% korting,
mag je deze sluiten met het kruisje.
* Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt,
klik de [b:fd44729c0b]Yes to all[/b:fd44729c0b] knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
* Kies bovenaan in het menu voor [b:fd44729c0b]Language/Taal[/b:fd44729c0b] en wijzig deze naar [b:fd44729c0b]Dutch (Nederlands)[/b:fd44729c0b] indien deze bij jou anders staat ingesteld.
* Druk op [b:fd44729c0b]F9[/b:fd44729c0b] en kies daarna voor [b:fd44729c0b]Acties[/b:fd44729c0b] en stel daar het volgende in onder [b:fd44729c0b]Malware[/b:fd44729c0b] :
o Adware: [b:fd44729c0b]Verplaats[/b:fd44729c0b]
Dialers: [b:fd44729c0b]Verplaats[/b:fd44729c0b]
Jokes: [b:fd44729c0b]Rapportage[/b:fd44729c0b]
Riskware: [b:fd44729c0b]Rapportage[/b:fd44729c0b]
Hacktools: [b:fd44729c0b]Verplaats[/b:fd44729c0b]
Haal dan het [b:fd44729c0b]vinkje weg bij "Prompt bij actie"[/b:fd44729c0b].
Druk dan op [b:fd44729c0b]OK[/b:fd44729c0b].
* Druk op [b:fd44729c0b]F9[/b:fd44729c0b] en kies daarna voor [b:fd44729c0b]Scan[/b:fd44729c0b] en verwijder het vinkje bij [b:fd44729c0b]Heuristische analyse[/b:fd44729c0b] en klik op [b:fd44729c0b]OK[/b:fd44729c0b].
* Eenmaal de korte scan is beeïndigd, kan je de drives selecteren die je wilt laten scannen (Selecteer stations).
* Selecteer hier [b:fd44729c0b]alle stations[/b:fd44729c0b]. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
* Klik daarna de

tja, hij gaat terug binnen bij de winkel, het lukt me niet echt, ik zal nadien wel iets laten weten, toch bedankt voor alle gedane moeite en tijd

Graag gedaan deschutter.
Ik ben zelf toch wel erg benieuwd hoe die wachtwoorden nou opeens op alle gebruikers accounts komen. :? Zou het niet kunnen dat een andere gebruiker van de laptop deze erop heeft gezet?

Laat even weten hoe het is afgelopen :wink: