1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive [InActive] Pls. help with the problem of spyware/IE add-on

Discussion in 'Malware and Virus Removal Archive' started by Kar123, 2008/10/25.

  1. 2008/10/25
    Kar123

    Kar123 Inactive Thread Starter

    Joined:
    2008/10/25
    Messages:
    7
    Likes Received:
    0
    Hello,

    A couple days ago my pc was infected: it began to work slow and even restarting at himself. I scanned pc for viruses with Avast software and its founds some trojan horse viruses and deleted them.
    Now is my system working good except of one thing: Internet Explorer AND Firefox redirect me each time when I search in Google, Yahoo etc. Can somebody help me???
    I have already used SuperAntiSpyware and Malwarebites (the last one I couldn't update because of some firewall problems). Both of them finds viruses and malwares but I still have the redirect problem.
    PLEASE HELP. Thanks in advance!!!
    My Hijack log file is:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:04:46, on 25.10.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Spyware Terminator\sp_rsser.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\PROGRA~1\MICROS~4\rapimgr.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe "
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Mobiele favorieten maken... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
    O9 - Extra button: Альбом клипов HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Расширенный выбор HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by135fd.bay135.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139154817482
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
    O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://217.21.249.12/msrdp.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://robocam.eindhoven.nl/activex/AMC.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
    O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\Apache Group\Apache2\bin\Apache.exe
    O23 - Service: AppToService taskmg (AppToService_taskmg) - Unknown owner - c:\windows\smsc.exe (file missing)
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

    --
    End of file - 11645 bytes
     
    Kar123,
    #1
  2. 2008/10/25
    Kar123

    Kar123 Inactive Thread Starter

    Joined:
    2008/10/25
    Messages:
    7
    Likes Received:
    0
    I gues I solve the problem. I have deleted all coockies, application data of all users including myself, temporary files and all kind of that stuff. After this I get problem with dissapeard quick launch icon but it was no problem to solve this.

    So if somebody have tesame problem use first some antivirus and antiwalware program and then delete al tha crup that microsoft write on your hard disk and your system will be healty.
     
    Kar123,
    #2


  3. to hide this advert.

  4. 2008/10/26
    Kar123

    Kar123 Inactive Thread Starter

    Joined:
    2008/10/25
    Messages:
    7
    Likes Received:
    0
    ****, my pc is still infected. Yesterday was everything good, but now I get Google redirects again. I believ I need help of somebody with experiance.
    The redirects go to hxxp://clearask.com
    Please help.
     
    Last edited by a moderator: 2008/10/26
    Kar123,
    #3
  5. 2008/10/26
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS Kar123 :)

    • Download RSIT by random/random and save it to your desktop.
    • Double click RSIT.exe to start the tool.
    • At the disclaimer, please use the drop down box to select 3 months for the file/folder search, then click Continue.
    • When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
    • Please post the contents of log.txt here in your next reply.
     
    noahdfear,
    #4
  6. 2008/10/29
    Kar123

    Kar123 Inactive Thread Starter

    Joined:
    2008/10/25
    Messages:
    7
    Likes Received:
    0
    I think I have solve the problem... again :)
    In the begin I couldn't download malwarebytes or any other programm. I just used Shareza. Then I couldn't get it updated, and that's why it didn't help at firs time.
    To solve the update problem I started pc in safe mod, and donwloaded all malwarebytes updates. It founds 8 malwares / viruses and now redirect problem is solved.

    noahdfear thanks for your reaction
     
    Kar123,
    #5
  7. 2008/10/29
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    I would still recommend you follow through with my recommendation. It's likely there is a bit more to cleanup. :)
     
    noahdfear,
    #6
  8. 2008/10/30
    Kar123

    Kar123 Inactive Thread Starter

    Joined:
    2008/10/25
    Messages:
    7
    Likes Received:
    0
    Then would you please look at it:

    Logfile of random's system information tool 1.04 (written by random/random)
    Run by Admin at 2008-10-30 19:21:30
    Microsoft Windows XP Professional Service Pack 3
    System drive C: has 10 GB (14%) free of 73 GB
    Total RAM: 511 MB (29% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:21:53, on 30.10.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\PROGRA~1\MICROS~4\rapimgr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Documents and Settings\Admin\Bureaublad\RSIT.exe
    C:\Program Files\trend micro\Admin.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe "
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe "
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Mobiele favorieten maken... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
    O9 - Extra button: Альбом клипов HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Расширенный выбор HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
    O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by135fd.bay135.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139154817482
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
    O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://217.21.249.12/msrdp.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://robocam.eindhoven.nl/activex/AMC.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
    O23 - Service: Apache2 - Apache Software Foundation - C:\Program Files\Apache Group\Apache2\bin\Apache.exe
    O23 - Service: AppToService taskmg (AppToService_taskmg) - Unknown owner - c:\windows\smsc.exe (file missing)
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

    --
    End of file - 12212 bytes

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "=C:\Program Files\Apoint\Apoint.exe [2004-09-13 155648]
    "ATIPTA "=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-12-03 344064]
    "Dell QuickSet "=C:\Program Files\Dell\QuickSet\quickset.exe [2005-09-01 684032]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "IMJPMIG8.1 "=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952]
    "IMEKRMIG6.1 "=C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE [2001-09-07 44032]
    "MSPY2002 "=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2002-08-28 59392]
    "PHIME2002ASync "=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2002-08-28 455168]
    "PHIME2002A "=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2002-08-28 455168]
    "HP Software Update "=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]
    "NeroFilterCheck "=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-02-28 570664]
    "NBKeyScan "=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
    "MSMSGS "=C:\Program Files\Messenger\MSMSGS.EXE [2008-04-14 1695232]
    "H/PC Connection Agent "=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]
    "Uniblue RegistryBooster 2009 "=C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
    C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe [2008-04-23 483328]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Version Cue CS2]
    C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [2005-04-04 856064]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
    C:\Program Files\BitTorrent_DNA\dna.exe [2007-10-17 286016]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\WINDOWS\system32\NeroCheck.exe []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-04-19 185896]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Xlight FTP Server "=2

    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    C:\WINDOWS\system32\Ati2evxx.dll [2004-12-03 90112]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDrives "=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun "=
    "NoDrives "=
    "NoDriveAutoRun "=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\Ares\Ares.exe "= "C:\Program Files\Ares\Ares.exe:*:Enabled:Ares "
    "C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe "= "C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2 "
    "C:\Program Files\@Last Software\SketchUp 5\SketchUp.exe "= "C:\Program Files\@Last Software\SketchUp 5\SketchUp.exe:*:Enabled:SketchUp Application "
    "C:\Program Files\Gambler\gambler.exe "= "C:\Program Files\Gambler\gambler.exe:*:Enabled:gambler "
    "C:\Program Files\Macromedia\Dreamweaver 8\Dreamweaver.exe "= "C:\Program Files\Macromedia\Dreamweaver 8\Dreamweaver.exe:*:Enabled:Dreamweaver 8 "
    "C:\Program Files\Emergency\Yerevan Drive v 1.0\Yerevan_Drive.exe "= "C:\Program Files\Emergency\Yerevan Drive v 1.0\Yerevan_Drive.exe:*:Enabled:Yerevan_Drive "
    "C:\Program Files\BitTorrent_DNA\dna.exe "= "C:\Program Files\BitTorrent_DNA\dna.exe:*:Enabled:BitTorrent DNA "
    "C:\Program Files\BitTorrent\bittorrent.exe "= "C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "
    "C:\Program Files\Shareaza\Shareaza.exe "= "C:\Program Files\Shareaza\Shareaza.exe:*:Enabled:Shareaza Ultimate File Sharing "
    "C:\Program Files\Microsoft ActiveSync\rapimgr.exe "= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe:*:Enabled:ActiveSync RAPI Manager "
    "C:\Program Files\Microsoft ActiveSync\wcescomm.exe "= "C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "
    "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe "= "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "
    "C:\Program Files\ICQ6\ICQ.exe "= "C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\Program Files\Windows Live\Messenger\livecall.exe "= "C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "
    "C:\Program Files\Skype\Phone\Skype.exe "= "C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype "
    "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe "= "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe: * :Disabled:hpoews01.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe "= "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe: * :Disabled:hpofxm08.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe "= "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe: * :Disabled:hposfx08.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe "= "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe: * Disabled:hposid01.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe "= "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe: * :Disabled:hpqkygrp.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe "= "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe: * :Disabled:hpqnrs08.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe "= "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe: * :Disabled:hpqscnvw.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe "= "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe: :Disabled:hpqste08.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe "= "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe: * :Disabled:hpqtra08.exe "
    "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe "= "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Disabled:hpzwiz01.exe "
    "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe "= "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe:*:Enabled:Malwarebytes' Anti-Malware "
    "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe "= "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe:*:Enabled:mbamservice.exe "
    "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe "= "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe:*:Enabled:mbamgui.exe "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\Microsoft ActiveSync\rapimgr.exe "= "C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "
    "C:\Program Files\Microsoft ActiveSync\wcescomm.exe "= "C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "
    "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe "= "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\Program Files\Windows Live\Messenger\livecall.exe "= "C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{593994f4-cf23-11db-842f-001422dbd85c}]
    shell\Auto\command - H:\Recycled/dllcache32.exe
    shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled/dllcache32.exe
    shell\explore\command - H:\Recycled/dllcache32.exe
    shell\open\command - H:\Recycled/dllcache32.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cea3d578-98fc-11da-9530-001422dbd85c}]
    shell\open\command - %SystemRoot%\Explorer.exe /idlist,%I,%L

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cea3d57d-98fc-11da-9530-001422dbd85c}]
    shell\AutoRun\command - F:\Teaching.exe


    ======File associations======

    .js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1 "
    .scr - open - "C:\WINDOWS\system32\notepad.exe" "%1 "
    .scr - install -
    .scr - config -

    ======List of files/folders created in the last 1 months======

    2008-10-29 22:11:01 ----D---- C:\Program Files\NeroInstall.bak
    2008-10-29 22:08:33 ----D---- C:\Documents and Settings\Admin\Application Data\Nero
    2008-10-29 22:07:33 ----A---- C:\WINDOWS\system32\MsiExec.exe.log
    2008-10-29 22:02:09 ----D---- C:\Documents and Settings\All Users\Application Data\Nero
    2008-10-29 22:02:08 ----D---- C:\Program Files\Common Files\Nero
    2008-10-29 19:09:04 ----D---- C:\rsit
    2008-10-26 23:16:02 ----D---- C:\Documents and Settings\Admin\Application Data\Google
    2008-10-26 22:25:46 ----D---- C:\Documents and Settings\Admin\Application Data\Sun
    2008-10-26 16:50:24 ----D---- C:\Documents and Settings\Admin\Application Data\ICQ
    2008-10-26 15:42:55 ----SHD---- C:\RECYCLER
    2008-10-26 14:43:33 ----A---- C:\ComboFix.txt
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\zip.exe
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\VFIND.exe
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\SWXCACLS.exe
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\SWSC.exe
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\SWREG.exe
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\sed.exe
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\NIRCMD.exe
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\grep.exe
    2008-10-26 14:16:31 ----A---- C:\WINDOWS\fdsv.exe
    2008-10-26 14:15:38 ----D---- C:\WINDOWS\ERDNT
    2008-10-26 14:15:38 ----D---- C:\Qoobox
    2008-10-26 12:18:54 ----D---- C:\WINDOWS\CSC
    2008-10-26 12:18:37 ----A---- C:\WINDOWS\ntbtlog.txt
    2008-10-26 12:05:10 ----D---- C:\Documents and Settings\Admin\Application Data\Shareaza
    2008-10-26 12:02:41 ----D---- C:\Documents and Settings\Admin\Application Data\BitTorrent
    2008-10-26 11:34:11 ----D---- C:\Documents and Settings\Admin\Application Data\Malwarebytes
    2008-10-26 11:22:27 ----D---- C:\Documents and Settings\Admin\Application Data\Uniblue
    2008-10-26 00:13:04 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
    2008-10-25 17:50:43 ----D---- C:\Documents and Settings\Admin\Application Data\Ipswitch
    2008-10-25 17:50:07 ----D---- C:\Documents and Settings\Admin\Application Data\Microsoft
    2008-10-25 17:23:14 ----D---- C:\Documents and Settings\Admin\Application Data\Macromedia
    2008-10-25 17:23:14 ----D---- C:\Documents and Settings\Admin\Application Data\Adobe
    2008-10-25 17:21:43 ----D---- C:\Documents and Settings\Admin\Application Data\Mozilla
    2008-10-25 13:30:08 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-10-25 13:30:02 ----D---- C:\Program Files\SUPERAntiSpyware
    2008-10-25 13:30:02 ----D---- C:\Documents and Settings\Admin\Application Data\SUPERAntiSpyware.com
    2008-10-25 12:49:47 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2008-10-25 11:10:49 ----D---- C:\Program Files\Trend Micro
    2008-10-24 23:43:58 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-21 21:27:21 ----D---- C:\DRIVERS
    2008-10-15 23:20:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
    2008-10-15 23:19:55 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
    2008-10-15 23:19:42 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
    2008-10-15 23:18:24 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
    2008-10-15 23:17:48 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
    2008-10-15 23:15:19 ----HDC---- C:\WINDOWS\$NtUninstallKB953155$
    2008-10-15 23:13:54 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
    2008-10-10 22:59:48 ----D---- C:\Program Files\Common Files\Skype
    2008-10-08 20:52:07 ----A---- C:\WINDOWS\SoundConverter.INI

    ======List of files/folders modified in the last 1 months======

    2008-10-30 18:17:34 ----D---- C:\Program Files\Samsung
    2008-10-30 18:17:33 ----D---- C:\WINDOWS\system32\inetsrv
    2008-10-30 18:14:28 ----D---- C:\WINDOWS\Prefetch
    2008-10-30 18:11:10 ----D---- C:\WINDOWS\Temp
    2008-10-29 23:34:31 ----A---- C:\WINDOWS\SchedLgU.Txt
    2008-10-29 23:34:20 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-10-29 23:21:07 ----HD---- C:\Program Files\InstallShield Installation Information
    2008-10-29 23:06:31 ----A---- C:\WINDOWS\NeroDigital.ini
    2008-10-29 22:59:30 ----HD---- C:\WINDOWS\inf
    2008-10-29 22:46:56 ----SHD---- C:\WINDOWS\Installer
    2008-10-29 22:44:14 ----HD---- C:\Config.Msi
    2008-10-29 22:12:14 ----D---- C:\WINDOWS\WinSxS
    2008-10-29 22:11:01 ----D---- C:\Program Files
    2008-10-29 22:07:33 ----D---- C:\WINDOWS\system32
    2008-10-29 22:06:25 ----D---- C:\WINDOWS\system32\drivers
    2008-10-29 22:06:19 ----D---- C:\WINDOWS
    2008-10-29 22:02:09 ----D---- C:\Program Files\Nero
    2008-10-29 22:02:08 ----D---- C:\Program Files\Common Files
    2008-10-29 22:02:00 ----D---- C:\WINDOWS\Cursors
    2008-10-26 14:45:26 ----D---- C:\Program Files\Mozilla Firefox
    2008-10-26 14:29:30 ----A---- C:\WINDOWS\system.ini
    2008-10-26 14:26:41 ----D---- C:\WINDOWS\system32\config
    2008-10-26 14:22:05 ----D---- C:\WINDOWS\AppPatch
    2008-10-26 14:18:48 ----SD---- C:\WINDOWS\Downloaded Program Files
    2008-10-26 12:07:37 ----D---- C:\WINDOWS\Registration
    2008-10-26 11:29:44 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
    2008-10-26 00:13:09 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2008-10-26 00:12:38 ----HD---- C:\WINDOWS\$hf_mig$
    2008-10-25 10:12:49 ----D---- C:\WINDOWS\tmp
    2008-10-25 00:13:10 ----D---- C:\WINDOWS\system32\Restore
    2008-10-24 23:24:19 ----D---- C:\Program Files\Axis Communications
    2008-10-23 20:39:14 ----D---- C:\Program Files\Common Files\Ahead
    2008-10-15 23:20:12 ----A---- C:\WINDOWS\imsins.BAK
    2008-10-15 17:37:40 ----A---- C:\WINDOWS\system32\netapi32.dll
    2008-10-10 23:00:31 ----D---- C:\Program Files\Skype
    2008-10-10 23:00:22 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
    2008-10-08 21:13:37 ----D---- C:\Program Files\Alerator
    2008-10-08 20:54:43 ----D---- C:\Program Files\Nokia
    2008-10-07 20:19:40 ----A---- C:\WINDOWS\system32\MRT.exe

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-07-19 26944]
    R1 APPDRV;APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [2005-08-03 16128]
    R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
    R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-07-19 42912]
    R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2002-09-16 4228]
    R1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2004-10-05 62799]
    R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-07-19 94416]
    R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-03-17 13059]
    R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP; C:\WINDOWS\System32\DRIVERS\Apfiltr.sys [2004-11-16 108791]
    R3 Arp1394;1394 ARP-clientprotocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
    R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-07-19 23152]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2004-12-03 800768]
    R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys [2004-05-26 44928]
    R3 CmBatt;Stuurprogramma voor Microsoft ACPI-besturingsmethode-accu; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952]
    R3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSF_DP.sys [2004-06-17 1041536]
    R3 HSFHWICH;HSFHWICH; C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys [2004-06-17 200064]
    R3 NIC1394;1394-stuurprogramma; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
    R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-09-07 5888]
    R3 sdbus;sdbus; C:\WINDOWS\System32\DRIVERS\sdbus.sys [2008-04-13 79232]
    R3 STAC97;SigmaTel C-Major Audio; C:\WINDOWS\system32\drivers\STAC97.sys [2005-03-10 273168]
    R3 tosporte;Bluetooth Port Driver from Toshiba; C:\WINDOWS\System32\DRIVERS\tosporte.sys [2005-01-08 51582]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2004-06-17 685056]
    S3 audiobridge;Virtual Audio Bridge; C:\WINDOWS\system32\DRIVERS\aubridge.sys [2006-02-15 22528]
    S3 Bridge;MAC-brug; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
    S3 BridgeMP;MAC-brugminipoort; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
    S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
    S3 CCDECODE;Closed Caption-decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
    S3 CVirtA;Cisco Systems VPN Adapter; C:\WINDOWS\system32\DRIVERS\CVirtA.sys [2005-02-08 5185]
    S3 FWL;Fwl Packet Filter; \??\C:\Program files\Software602\602LAN SUITE\fwl.sys []
    S3 gv3;Intel GV3-processorstuurprogramma; C:\WINDOWS\System32\DRIVERS\gv3.sys [2002-11-20 33664]
    S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2007-04-03 26056]
    S3 HidUsb;Microsoft HID Class-stuurprogramma; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-03-08 49920]
    S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-03-08 16496]
    S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-03-08 21568]
    S3 Lvckap;Logitech Kernel Audio Processing Filter Driver; \??\C:\WINDOWS\system32\drivers\Lvckap.sys []
    S3 mouhid;Stuurprogramma voor muis-HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-09-06 12288]
    S3 MR97310_USB_DUAL_CAMERA;DUAL MODE CAMERA SL310; C:\WINDOWS\system32\DRIVERS\mr97310c.sys [2002-07-02 129438]
    S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-conversieprogramma; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
    S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
    S3 NdisIP;Microsoft TV/Video-verbinding; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
    S3 sffdisk;SFF Storage Class-stuurprogramma; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
    S3 sffp_sd;Stuurprogramma volgens SFF-opslagprotocol voor SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
    S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
    S3 SONYPVU1;Sony USB-filterstuurrapparaat (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
    S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2005-08-30 58320]
    S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2005-08-30 8336]
    S3 ssm_mdm;SAMSUNG Mobile USB Port II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2005-08-30 94000]
    S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
    S3 toshidpt;TOSHIBA Bluetooth HID port driver; C:\WINDOWS\system32\drivers\Toshidpt.sys [2002-10-17 2851]
    S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbd.sys [2005-01-17 98304]
    S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2004-07-09 36531]
    S3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:\WINDOWS\System32\DRIVERS\Tosrfhid.sys [2004-11-16 50048]
    S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA; C:\WINDOWS\System32\DRIVERS\tosrfnds.sys [2005-01-07 18612]
    S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA; C:\WINDOWS\system32\drivers\TosRfSnd.sys [2004-12-16 50048]
    S3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\Drivers\tosrfusb.sys [2004-12-22 34816]
    S3 tunmp;Stuurprogramma voor Microsoft Tun Minipoort-adapter; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-13 12288]
    S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\drivers\UIUSys.sys []
    S3 usb_rndisx;USB RNDIS Adapter; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2005-10-21 12800]
    S3 usbccgp;Microsoft generiek hoofd-USB-stuurprogramma; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
    S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
    S3 usbscan;Stuurprogramma voor USB-scanner; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
    S3 USBSTOR;Stuurprogramma voor USB-massaopslag; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 w29n51;Stuurprogramma voor Intel(R) PRO/Wireless 2200BG-netwerkverbinding onder Windows XP; C:\WINDOWS\System32\DRIVERS\w29n51.sys [2004-10-21 3210496]
    S3 WSTCODEC;World Standard Teletext-codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056]
    R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2004-12-03 405504]
    R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640]
    R2 hpqddsvc;HP CUE DeviceDiscovery-service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
    R2 IISADMIN;IIS-beheer; C:\WINDOWS\System32\inetsrv\inetinfo.exe [2008-04-14 15360]
    R2 MySQL;MySQL; C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt --defaults-file=C:\Program Files\MySQL\MySQL Server 5.0\my.ini MySQL []
    R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
    R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
    R2 NICCONFIGSVC;NICCONFIGSVC; C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe [2005-06-09 356352]
    R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
    R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
    R2 SMTPSVC;SMTP (Simple Mail Transfer Protocol); C:\WINDOWS\System32\inetsrv\inetinfo.exe [2008-04-14 15360]
    R2 W3SVC;World Wide Web-publicatie; C:\WINDOWS\System32\inetsrv\inetinfo.exe [2008-04-14 15360]
    R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040]
    R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-23 348344]
    R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
    R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
    R3 usnjsvc;Messenger USN Journal Reader service voor Gedeelde mappen; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
    S2 AppToService_taskmg;AppToService taskmg; c:\windows\smsc.exe /sys c:/windows/taskmg.exe /Directory:c:/windows /Arguments:eek:cgen.conf /startup:A /priority:N /show:2 []
    S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2006-07-22 72704]
    S3 Adobe Version Cue CS2;Adobe Version Cue CS2; C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe [2005-04-04 163840]
    S3 Apache2;Apache2; C:\Program Files\Apache Group\Apache2\bin\Apache.exe [2006-07-27 20541]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2007-10-19 85096]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
    S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-05-03 74656]
    S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing-service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-02 917504]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
    S4 Xlight FTP Server;Xlight FTP Server; c:\windows\spoolsvc.exe -runservice []

    -----------------EOF-----------------
     
    Kar123,
    #7
  9. 2008/10/31
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please post the log from ComboFix located at C:\ComboFix.txt
    Do you still have ComboFix.exe?
     
    noahdfear,
    #8
  10. 2008/10/31
    Kar123

    Kar123 Inactive Thread Starter

    Joined:
    2008/10/25
    Messages:
    7
    Likes Received:
    0
    Yes I have ComboFix, but when I started it faild to update. So I used the vesion that I have.

    ComboFix 08-10-30.13 - Admin 2008-10-31 17:59:24.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1251.1.1043.18.190 [GMT 1:00]
    Running from: C:\Documents and Settings\Admin\Mijn documenten\Downloads\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\TDSSosvd.dat

    .
    ((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-31 )))))))))))))))))))))))))))))))
    .

    2008-10-29 22:11 . 2008-10-29 22:11 <DIR> d-------- C:\Program Files\NeroInstall.bak
    2008-10-29 22:08 . 2008-10-29 22:08 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Nero
    2008-10-29 22:02 . 2008-10-29 22:06 <DIR> d-------- C:\Program Files\Common Files\Nero
    2008-10-29 22:02 . 2008-10-29 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-10-29 19:09 . 2008-10-29 19:09 <DIR> d-------- C:\rsit
    2008-10-26 16:50 . 2008-10-27 18:49 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\ICQ
    2008-10-26 12:05 . 2008-10-26 12:05 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Shareaza
    2008-10-26 12:02 . 2008-10-26 12:14 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\BitTorrent
    2008-10-26 11:34 . 2008-10-26 11:34 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Malwarebytes
    2008-10-26 11:22 . 2008-10-26 11:22 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Uniblue
    2008-10-25 17:50 . 2008-10-25 17:50 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Ipswitch
    2008-10-25 13:30 . 2008-10-26 15:46 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
    2008-10-25 13:30 . 2008-10-25 13:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-10-25 13:30 . 2008-10-26 15:46 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\SUPERAntiSpyware.com
    2008-10-25 12:49 . 2008-10-26 12:20 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-10-25 12:49 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-10-25 12:49 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-10-25 11:10 . 2008-10-30 19:21 <DIR> d-------- C:\Program Files\Trend Micro
    2008-10-25 10:17 . 2008-10-15 17:37 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
    2008-10-25 00:00 . 2008-10-25 00:00 282 --a------ C:\WINDOWS\ocgen.user
    2008-10-24 23:48 . 2008-10-29 18:11 2,184 --a------ C:\WINDOWS\system32\wpa.dbl
    2008-10-24 23:43 . 2008-10-24 23:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-21 21:27 . 2008-10-21 21:41 <DIR> d-------- C:\DRIVERS
    2008-10-15 18:39 . 2008-09-08 11:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
    2008-10-15 18:35 . 2008-08-14 14:27 2,149,888 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
    2008-10-15 18:35 . 2008-08-14 14:27 2,070,400 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
    2008-10-15 18:35 . 2008-08-14 14:27 2,028,544 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
    2008-10-15 18:35 . 2008-09-15 16:28 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
    2008-10-15 18:34 . 2008-08-14 14:27 2,193,536 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
    2008-10-11 15:26 . 2008-10-21 18:40 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-10-11 15:26 . 2008-10-11 15:26 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-10-10 23:03 . 2008-10-10 23:03 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
    2008-10-10 22:59 . 2008-10-10 23:00 <DIR> d-------- C:\Program Files\Common Files\Skype
    2008-10-08 20:52 . 2008-10-08 20:52 19 --a------ C:\WINDOWS\SoundConverter.INI

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-30 17:17 --------- d-----w C:\Program Files\Samsung

    2008-10-29 22:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-10-29 21:02 --------- d-----w C:\Program Files\Nero
    2008-10-24 22:24 --------- d-----w C:\Program Files\Axis Communications
    2008-10-23 19:39 --------- d-----w C:\Program Files\Common Files\Ahead
    2008-10-10 22:00 --------- d-----w C:\Program Files\Skype
    2008-10-10 22:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
    2008-10-08 20:13 --------- d-----w C:\Program Files\Alerator
    2008-10-08 19:54 --------- d-----w C:\Program Files\Nokia
    2008-09-30 19:39 --------- d-----w C:\Program Files\ICQ6
    2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
    2008-08-14 17:34 49,501 ----a-w C:\Program Files\systeem configuratie.txt
    1823-05-13 04:57 4,263 --sh--w C:\WINDOWS\windllreg1c.sys
    2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    .
    Code:
    <pre>
----a-w         6,586,904 2008-10-25 12:41:34  C:\Documents and Settings\Admin\Mijn documenten\Downloads\SUPERAntiSpywarePro v4.21.1004 .exe
</pre>

    ((((((((((((((((((((((((((((( snapshot@2008-10-26_14.42.23.81 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-02-18 15:21:08 11,304 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
    + 2008-02-18 15:21:08 132,904 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
    + 2006-03-17 10:45:52 1,757,184 ----a-w C:\WINDOWS\system32\imagX7.dll
    + 2006-03-17 10:45:54 497,296 ----a-w C:\WINDOWS\system32\imagXpr7.dll
    + 2006-03-17 10:45:54 258,048 ----a-w C:\WINDOWS\system32\imagXR7.dll
    + 2006-03-17 10:45:54 802,816 ----a-w C:\WINDOWS\system32\imagXRA7.dll
    - 2008-10-26 13:28:49 248,863 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2008-10-31 16:18:31 248,858 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2006-12-19 08:30:26 81,920 ----a-w C:\WINDOWS\system32\IoctlSvc.exe
    + 2008-02-18 15:04:04 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
    + 2006-03-17 13:49:46 368,640 ----a-w C:\WINDOWS\system32\TwnLib4.dll
    + 2008-10-30 17:08:16 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_49c.dat
    + 2007-03-20 19:22:04 972,336 ----a-w C:\WINDOWS\UNNeroBackItUp.exe
    + 2008-02-28 16:38:48 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
    + 2007-02-28 14:41:02 972,336 ----a-w C:\WINDOWS\UNNeroShowTime.exe
    + 2007-03-21 19:02:12 972,336 ----a-w C:\WINDOWS\UNNeroVision.exe
    + 2008-02-26 15:14:26 972,072 ----a-w C:\WINDOWS\UNRecode.exe
    + 2008-10-29 21:12:11 1,233,920 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll
    + 2006-12-01 21:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
    + 2006-12-01 21:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
    + 2006-12-01 21:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
    + 2006-12-01 21:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
    + 2006-12-01 23:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
    + 2006-12-01 23:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
    + 2006-12-01 23:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
    + 2006-12-01 23:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
    + 2006-12-01 23:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
    + 2006-12-01 23:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
    + 2006-12-01 23:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
    + 2006-12-01 23:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
    + 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
    + 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
    + 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
    + 2006-12-01 23:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
    + 2006-12-01 23:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
    + 2006-12-01 23:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
    "MSMSGS "= "C:\Program Files\Messenger\MSMSGS.EXE" [2008-04-14 1695232]
    "H/PC Connection Agent "= "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
    "Uniblue RegistryBooster 2009 "= "C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe" [N/A]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "= "C:\Program Files\Apoint\Apoint.exe" [2004-09-13 155648]
    "ATIPTA "= "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-03 344064]
    "Dell QuickSet "= "C:\Program Files\Dell\QuickSet\quickset.exe" [2005-09-01 684032]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
    "IMEKRMIG6.1 "= "C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2001-09-07 44032]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2002-08-28 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-28 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-28 455168]
    "HP Software Update "= "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
    "NBKeyScan "= "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "IETI "= "C:\Program Files\Skype\Phone\IEPlugin\unins000.exe" [N/A]

    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-07-22 25214]
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-14 113664]
    Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-22 45056]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420 "= i420vfw.dll
    "vidc.MJPG "= m3jpeg32.dll
    "vidc.dmb1 "= m3jpeg32.dll
    "vidc.3iv2 "= 3ivxVfWCodec.dll
    "VIDC.HFYU "= huffyuv.dll
    "VIDC.VP31 "= vp31vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
    --a------ 2008-04-23 01:08 483328 C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Version Cue CS2]
    --a------ 2005-04-04 17:58 856064 C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
    --a------ 2007-10-17 18:33 286016 C:\Program Files\BitTorrent_DNA\dna.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\WINDOWS\system32\NeroCheck.exe [N/A]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [N/A]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    --a------ 2008-04-19 16:53 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Xlight FTP Server "=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001
    "UpdatesDisableNotify "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Ares\\Ares.exe "=
    "C:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe "=
    "C:\\Program Files\\@Last Software\\SketchUp 5\\SketchUp.exe "=
    "C:\\Program Files\\Gambler\\gambler.exe "=
    "C:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe "=
    "C:\\Program Files\\Emergency\\Yerevan Drive v 1.0\\Yerevan_Drive.exe "=
    "C:\\Program Files\\BitTorrent_DNA\\dna.exe "=
    "C:\\Program Files\\BitTorrent\\bittorrent.exe "=
    "C:\\Program Files\\Shareaza\\Shareaza.exe "=
    "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe "=
    "C:\Program Files\Microsoft ActiveSync\wcescomm.exe "= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe "= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "C:\\Program Files\\ICQ6\\ICQ.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
    "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe "=
    "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbamservice.exe "=
    "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP "= 3389:TCP:*:Disabled:mad:xpsp2res.dll,-22009
    "26675:TCP "= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    S2 AppToService_taskmg;AppToService taskmg;c:\windows\smsc.exe /sys c:/windows/taskmg.exe [ ]
    S3 audiobridge;Virtual Audio Bridge;C:\WINDOWS\system32\DRIVERS\aubridge.sys [2006-02-15 22528]
    S3 FWL;Fwl Packet Filter;C:\Program files\Software602\602LAN SUITE\fwl.sys [ ]
    S4 Xlight FTP Server;Xlight FTP Server;c:\windows\spoolsvc.exe [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{593994f4-cf23-11db-842f-001422dbd85c}]
    \Shell\Auto\command - H:\Recycled/dllcache32.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled/dllcache32.exe
    \Shell\explore\Command - H:\Recycled/dllcache32.exe
    \Shell\open\Command - H:\Recycled/dllcache32.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cea3d578-98fc-11da-9530-001422dbd85c}]
    \shell\open\command - %SystemRoot%\Explorer.exe /idlist,%I,%L

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cea3d57d-98fc-11da-9530-001422dbd85c}]
    \Shell\AutoRun\command - F:\Teaching.exe
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\xlqutgtq.default\
    FF -: plugin - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\browser\nppdf32.dll
    FF -: plugin - C:\Program Files\BitTorrent_DNA\npbtdna.dll
    FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-31 18:12:05
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\AppToService_taskmg]
    "ImagePath "= "c:\windows\smsc.exe /sys \ "c:/windows/taskmg.exe\" /Directory:\ "c:/windows\" /Arguments:\ "ocgen.conf\" /startup:A /priority:N /show:2 "

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL]
    "ImagePath "= "\ "C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\ "C:\Program Files\MySQL\MySQL Server 5.0\my.ini\" MySQL "
    .
    Completion time: 2008-10-31 18:23:37
    ComboFix-quarantined-files.txt 2008-10-31 17:23:30
    ComboFix2.txt 2008-10-26 13:43:33

    Pre-Run: 10*510*946*304 bytes beschikbaar
    Post-Run: 12,087,033,856 bytes beschikbaar

    246 --- E O F --- 2008-10-29 17:17:10
     
    Kar123,
    #9
  11. 2008/11/02
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    You have a flash drive infection. Please download Flash_Disinfector by sUBs and save it to your desktop:

    NOTE: In the event you already have Flash_Disinfector, this is a new version that I need you to download.

    • Plug in your USB flash drive.
    • Double-click Flash_Disinfector.exe to run it.
    • Follow any prompts that may appear.
    • Your desktop will vanish for a while, and then reappear. This is normal.
    • Wait until the program has finished scanning, then please exit the program. If you use more than 1 flash drive, run the tool with each plugged in.



    Please make sure your avast! realtime protection is disabled prior to completing the instructions below. Check this link for instructions for doing so.

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    KillAll::
File::
C:\WINDOWS\windllreg1c.sys
RenV::
C:\Documents and Settings\Admin\Mijn documenten\Downloads\SUPERAntiSpywarePro v4.21.1004 .exe
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{593994f4-cf23-11db-842f-001422dbd85c}]
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
     
    noahdfear,
    #10
  12. 2008/11/03
    Kar123

    Kar123 Inactive Thread Starter

    Joined:
    2008/10/25
    Messages:
    7
    Likes Received:
    0
    Bellow the log.txt file:



    ComboFix 08-10-30.13 - Admin 2008-11-03 21:38:53.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1251.1.1043.18.179 [GMT 1:00]
    Running from: C:\Documents and Settings\Admin\Bureaublad\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Admin\Bureaublad\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\windllreg1c.sys
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\windllreg1c.sys

    .
    ((((((((((((((((((((((((( Files Created from 2008-10-03 to 2008-11-03 )))))))))))))))))))))))))))))))
    .

    2008-11-03 01:11 . 2008-11-03 10:07 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\TAC
    2008-11-02 23:28 . 2008-11-02 23:28 <DIR> d-------- C:\Taccels
    2008-11-02 23:27 . 2008-11-02 23:28 <DIR> d-------- C:\Program Files\TAC
    2008-10-29 22:11 . 2008-10-29 22:11 <DIR> d-------- C:\Program Files\NeroInstall.bak
    2008-10-29 22:08 . 2008-10-29 22:08 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Nero
    2008-10-29 22:02 . 2008-10-29 22:06 <DIR> d-------- C:\Program Files\Common Files\Nero
    2008-10-29 22:02 . 2008-10-29 22:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-10-29 19:09 . 2008-10-29 19:09 <DIR> d-------- C:\rsit
    2008-10-26 16:50 . 2008-10-27 18:49 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\ICQ
    2008-10-26 12:05 . 2008-10-26 12:05 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Shareaza
    2008-10-26 12:02 . 2008-10-26 12:14 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\BitTorrent
    2008-10-26 11:34 . 2008-10-26 11:34 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Malwarebytes
    2008-10-26 11:22 . 2008-10-26 11:22 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Uniblue
    2008-10-25 17:50 . 2008-10-25 17:50 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\Ipswitch
    2008-10-25 13:30 . 2008-10-26 15:46 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
    2008-10-25 13:30 . 2008-10-25 13:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-10-25 13:30 . 2008-10-26 15:46 <DIR> d-------- C:\Documents and Settings\Admin\Application Data\SUPERAntiSpyware.com
    2008-10-25 12:49 . 2008-10-26 12:20 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-10-25 12:49 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-10-25 12:49 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-10-25 11:10 . 2008-10-30 19:21 <DIR> d-------- C:\Program Files\Trend Micro
    2008-10-25 10:17 . 2008-10-15 17:37 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
    2008-10-25 00:00 . 2008-10-25 00:00 282 --a------ C:\WINDOWS\ocgen.user
    2008-10-24 23:48 . 2008-11-02 12:37 2,184 --a------ C:\WINDOWS\system32\wpa.dbl
    2008-10-24 23:43 . 2008-10-24 23:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-21 21:27 . 2008-10-21 21:41 <DIR> d-------- C:\DRIVERS
    2008-10-15 18:39 . 2008-09-08 11:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
    2008-10-15 18:35 . 2008-08-14 14:27 2,149,888 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
    2008-10-15 18:35 . 2008-08-14 14:27 2,070,400 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
    2008-10-15 18:35 . 2008-08-14 14:27 2,028,544 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
    2008-10-15 18:35 . 2008-09-15 16:28 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
    2008-10-15 18:34 . 2008-08-14 14:27 2,193,536 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
    2008-10-11 15:26 . 2008-10-21 18:40 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-10-11 15:26 . 2008-10-11 15:26 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-10-10 23:03 . 2008-10-10 23:03 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
    2008-10-10 22:59 . 2008-10-10 23:00 <DIR> d-------- C:\Program Files\Common Files\Skype
    2008-10-08 20:52 . 2008-10-08 20:52 19 --a------ C:\WINDOWS\SoundConverter.INI

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-30 17:17 --------- d-----w C:\Program Files\Samsung
    2008-10-29 22:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-10-29 21:02 --------- d-----w C:\Program Files\Nero
    2008-10-24 22:24 --------- d-----w C:\Program Files\Axis Communications
    2008-10-23 19:39 --------- d-----w C:\Program Files\Common Files\Ahead
    2008-10-10 22:00 --------- d-----w C:\Program Files\Skype
    2008-10-10 22:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
    2008-10-08 20:13 --------- d-----w C:\Program Files\Alerator
    2008-10-08 19:54 --------- d-----w C:\Program Files\Nokia
    2008-09-30 19:39 --------- d-----w C:\Program Files\ICQ6
    2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
    2008-08-14 17:34 49,501 ----a-w C:\Program Files\systeem configuratie.txt
    2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    .
    Code:
    <pre>
----a-w         6,586,904 2008-10-25 12:41:34  C:\Documents and Settings\Admin\Mijn documenten\Downloads\SUPERAntiSpywarePro v4.21.1004 .exe
</pre>

    ((((((((((((((((((((((((((((( snapshot_2008-10-31_18.22.57,42 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-10-31 16:18:31 248,858 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2008-11-03 20:51:48 248,866 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2008-11-03 20:51:32 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_484.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
    "MSMSGS "= "C:\Program Files\Messenger\MSMSGS.EXE" [2008-04-14 1695232]
    "H/PC Connection Agent "= "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
    "Uniblue RegistryBooster 2009 "= "C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe" [N/A]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint "= "C:\Program Files\Apoint\Apoint.exe" [2004-09-13 155648]
    "ATIPTA "= "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-03 344064]
    "Dell QuickSet "= "C:\Program Files\Dell\QuickSet\quickset.exe" [2005-09-01 684032]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "IMJPMIG8.1 "= "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
    "IMEKRMIG6.1 "= "C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2001-09-07 44032]
    "MSPY2002 "= "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2002-08-28 59392]
    "PHIME2002ASync "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-28 455168]
    "PHIME2002A "= "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-28 455168]
    "HP Software Update "= "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
    "NBKeyScan "= "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "IETI "= "C:\Program Files\Skype\Phone\IEPlugin\unins000.exe" [N/A]

    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-07-22 25214]
    Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-14 113664]
    Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-22 45056]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420 "= i420vfw.dll
    "vidc.MJPG "= m3jpeg32.dll
    "vidc.dmb1 "= m3jpeg32.dll
    "vidc.3iv2 "= 3ivxVfWCodec.dll
    "VIDC.HFYU "= huffyuv.dll
    "VIDC.VP31 "= vp31vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
    --a------ 2008-04-23 01:08 483328 C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Version Cue CS2]
    --a------ 2005-04-04 17:58 856064 C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
    --a------ 2007-10-17 18:33 286016 C:\Program Files\BitTorrent_DNA\dna.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\WINDOWS\system32\NeroCheck.exe [N/A]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
    C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [N/A]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    --a------ 2008-04-19 16:53 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Xlight FTP Server "=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001
    "UpdatesDisableNotify "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\Ares\\Ares.exe "=
    "C:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe "=
    "C:\\Program Files\\@Last Software\\SketchUp 5\\SketchUp.exe "=
    "C:\\Program Files\\Gambler\\gambler.exe "=
    "C:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe "=
    "C:\\Program Files\\Emergency\\Yerevan Drive v 1.0\\Yerevan_Drive.exe "=
    "C:\\Program Files\\BitTorrent_DNA\\dna.exe "=
    "C:\\Program Files\\BitTorrent\\bittorrent.exe "=
    "C:\\Program Files\\Shareaza\\Shareaza.exe "=
    "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe "=
    "C:\Program Files\Microsoft ActiveSync\wcescomm.exe "= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe "= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "C:\\Program Files\\ICQ6\\ICQ.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
    "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe "=
    "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbamservice.exe "=
    "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP "= 3389:TCP:*:Disabled:mad:xpsp2res.dll,-22009
    "26675:TCP "= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    S2 AppToService_taskmg;AppToService taskmg;c:\windows\smsc.exe /sys c:/windows/taskmg.exe [ ]
    S3 audiobridge;Virtual Audio Bridge;C:\WINDOWS\system32\DRIVERS\aubridge.sys [2006-02-15 22528]
    S3 FWL;Fwl Packet Filter;C:\Program files\Software602\602LAN SUITE\fwl.sys [ ]
    S4 Xlight FTP Server;Xlight FTP Server;c:\windows\spoolsvc.exe [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cea3d578-98fc-11da-9530-001422dbd85c}]
    \shell\open\command - %SystemRoot%\Explorer.exe /idlist,%I,%L

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cea3d57d-98fc-11da-9530-001422dbd85c}]
    \Shell\AutoRun\command - F:\Teaching.exe
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-11-03 21:52:40
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AppToService_taskmg]
    "ImagePath "= "c:\windows\smsc.exe /sys \ "c:/windows/taskmg.exe\" /Directory:\ "c:/windows\" /Arguments:\ "ocgen.conf\" /startup:A /priority:N /show:2 "

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
    "ImagePath "= "\ "C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\ "C:\Program Files\MySQL\MySQL Server 5.0\my.ini\" MySQL "
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Apoint\ApntEx.exe
    C:\PROGRA~1\MICROS~4\rapimgr.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    C:\Program Files\Webteh\BSplayer\bsplayer.exe
    .
    **************************************************************************
    .
    Completion time: 2008-11-03 22:09:36 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-11-03 21:09:16
    ComboFix2.txt 2008-10-31 17:23:40
    ComboFix3.txt 2008-10-26 13:43:33

    Pre-Run: 11*274*747*904 bytes beschikbaar
    Post-Run: 11,918,737,408 bytes beschikbaar

    227 --- E O F --- 2008-10-29 17:17:10
     
    Kar123,
    #11
  13. 2008/11/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hmmm ..... something prevented ComboFix from fixing one thing. Recommend you delete the following file, and all others similarly named if present. They are likely infected.

    C:\Documents and Settings\Admin\Mijn documenten\Downloads\SUPERAntiSpywarePro v4.21.1004 .exe

    SUPERAntiSpywarePro v4.21.1004 .exe << notice the space between 1004 and .exe
    There might be others with no space at that location and/or more than 1 space at that location. Empty the recycle bin when done.

    Now I recommend doing an online scan. Please do an online scan with Kaspersky Online Scanner

    Click Accept, when prompted to download and install the program files and database of malware definitions.
    • Click Run at the Security prompt.
    • The program will then begin downloading and installing and will also update the database.
    • Please be patient as this can take several minutes.
    • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Click View scan report at the bottom.
    • Click the Save Report As... button.
    • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


    Post the Kaspersky log here.
     
    noahdfear,
    #12

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...