Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Bleeping Computer


  • This topic is locked This topic is locked
16 replies to this topic

#1 Mae$tro

Mae$tro

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 04 February 2006 - 05:51 PM

actually my computer beeps once a while. i had alot of spyware, received from a crack, i thought i removed it all. but my pc still feels infected. when i took the log, MS anti spyware was shut down, cause i think it's also infected, i get processes of gcasDTserv.exe and also a second. wich i googled and foud to be spyware but don't know how to solve.

Logfile of HijackThis v1.99.1
Scan saved at 23:44:41, on 4/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\niSvcLoc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\hphmon04.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\mpcsvc.exe
C:\WINDOWS\system32\lsdntr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
D:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Raf\Bureaublad\Anti Spyware\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programs\ANTISP~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [CloneCDTray] "D:\Programs\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [sjkfdrtex] C:\WINDOWS\system32\lsdntr.exe
O4 - HKLM\..\Run: [Repair Service Manager] C:\WINDOWS\system32\lzxdpo.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\games\half life 2\steam.exe" -silent
O4 - HKCU\..\Run: [hnetmon] c:\Windows\system32\hnetmon.dll
O4 - HKCU\..\RunServices: [System Services] opesaxr.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = D:\Programs\Adobe Reader\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1115847562200
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla...5/Installer.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: sndu32 - C:\WINDOWS\SYSTEM32\sndu32.dll
O20 - Winlogon Notify: ssldr - C:\WINDOWS\SYSTEM32\ssldr32.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NILM License manager - Macrovision Corporation - D:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments - C:\WINDOWS\system32\niSvcLoc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

BC AdBot (Login to Remove)

 


m

#2 Daemon

Daemon

    Security Expert


  • Members
  • 1,446 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:40 AM

Posted 04 February 2006 - 05:53 PM

Click here to download ewido anti-malware - it is a trial version of the program.
  • Install ewido.
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen.
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
The update will start and a progress bar will show the updates being installed. Then:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin (do not open any folders or open the windows control panel while the scan is in progress).
  • While the scan is in progress you will be prompted to clean files, click OK
  • When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
Now close ewido.

Rescan with HJT and post a new log here together with the ewido log so that any remnants can be removed manually.
Posted Image

Have I helped you? Please consider donating to help me continue with the fight against malware. Click here

#3 Mae$tro

Mae$tro
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 04 February 2006 - 08:12 PM

When i do the scan, my pc reboots while it's in progress, around 40 %
happend twice in a row, don't know how it is caused

#4 Daemon

Daemon

    Security Expert


  • Members
  • 1,446 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:40 AM

Posted 05 February 2006 - 05:49 AM

Do this then try ewido again. Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
F2 - REG:system.ini: Shell=
O4 - HKLM\..\Run: [sjkfdrtex] C:\WINDOWS\system32\lsdntr.exe
O4 - HKLM\..\Run: [Repair Service Manager] C:\WINDOWS\system32\lzxdpo.exe
O4 - HKCU\..\Run: [hnetmon] c:\Windows\system32\hnetmon.dll
O4 - HKCU\..\RunServices: [System Services] opesaxr.exe
O20 - Winlogon Notify: sndu32 - C:\WINDOWS\SYSTEM32\sndu32.dll
O20 - Winlogon Notify: ssldr - C:\WINDOWS\SYSTEM32\ssldr32.dll


Exit HijackThis when done. Reboot into Safe Mode by tapping F8 after the BIOS has loaded. Using Windows Explorer, find and delete the following:

C:\WINDOWS\system32\lsdntr.exe
C:\WINDOWS\system32\lzxdpo.exe
C:\WINDOWS\SYSTEM32\sndu32.dll
C:\WINDOWS\SYSTEM32\ssldr32.dll

Exit Explorer and reboot into Normal Mode. Rescan with HijackThis and post a new log here.
Posted Image

Have I helped you? Please consider donating to help me continue with the fight against malware. Click here

#5 Mae$tro

Mae$tro
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 05 February 2006 - 07:54 AM

C:\WINDOWS\SYSTEM32\sndu32.dll
was not there

and besides lzxdpo.exe there was also a lzxdpo.dll, does it has to be removed to ?

Rapport Ewido
don't know if u understand dutch :thumbsup: but:

-Fout gedurende het schoonmake = Error during cleaning
-Schoongemaakt met een backup= cleaned with backup


---------------------------------------------------------
ewido anti-malware - Scan rapport
---------------------------------------------------------

+ Gemaakt op: 13:48:00, 5/02/2006
+ Rapport samenvatting: 4A226D4

+ Scan resultaten:

[1256] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1360] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1380] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1444] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1480] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1504] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1564] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1712] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1796] C:\WINDOWS\System32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[716] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[756] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1004] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1044] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[968] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1456] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1592] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1924] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1104] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[1960] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[2276] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[2528] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
[2820] C:\WINDOWS\system32\sndu32.dll -> Backdoor.Haxdoor.gf : Fout gedurende het schoonmake
:mozilla.54:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Cqcounter : Schoongemaakt met een backup
:mozilla.59:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.60:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.61:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.62:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.63:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.64:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.65:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.66:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.85:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Adocean : Schoongemaakt met een backup
:mozilla.86:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Adocean : Schoongemaakt met een backup
:mozilla.91:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Euroclick : Schoongemaakt met een backup
:mozilla.121:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Sitestat : Schoongemaakt met een backup
:mozilla.122:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Sitestat : Schoongemaakt met een backup
:mozilla.163:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Com : Schoongemaakt met een backup
:mozilla.164:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Com : Schoongemaakt met een backup
:mozilla.185:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.186:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.187:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.188:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.189:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Esomniture : Schoongemaakt met een backup
:mozilla.323:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Ivwbox : Schoongemaakt met een backup
:mozilla.491:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Serving-sys : Schoongemaakt met een backup
:mozilla.492:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Serving-sys : Schoongemaakt met een backup
:mozilla.493:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Serving-sys : Schoongemaakt met een backup
:mozilla.494:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Serving-sys : Schoongemaakt met een backup
:mozilla.552:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Trafic : Schoongemaakt met een backup
:mozilla.562:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Clickzs : Schoongemaakt met een backup
:mozilla.563:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Clickzs : Schoongemaakt met een backup
:mozilla.616:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Cqcounter : Schoongemaakt met een backup
:mozilla.636:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.637:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.638:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.639:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.640:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.643:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Clickhype : Schoongemaakt met een backup
:mozilla.756:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Onestat : Schoongemaakt met een backup
:mozilla.757:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Onestat : Schoongemaakt met een backup
:mozilla.800:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Adengage : Schoongemaakt met een backup
:mozilla.801:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Adengage : Schoongemaakt met een backup
:mozilla.802:C:\Documents and Settings\Raf\Application Data\Mozilla\Firefox\Profiles\9t7yvfl1.default\cookies.txt -> Spyware.Cookie.Adengage : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Cookies\raf@data3.perf.overture[1].txt -> Spyware.Cookie.Overture : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Cookies\raf@perf.overture[1].txt -> Spyware.Cookie.Overture : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\11353062.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\11953031.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\1336343.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\24068078.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\2466687.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\25266687.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\2576531.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\28145171.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\28745171.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\3051015.exe -> Downloader.Small.cic : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\3066687.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\3176500.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\4745093.exe -> Downloader.Small.cic : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\5451031.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\5945093.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\6545140.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\666859.exe -> Downloader.Small.cic : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\670062.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\699375.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\736359.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\10184.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\1040.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\10480.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\127936.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\131184.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\132036.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\133436.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\133552.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\134560.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\135240.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\135416.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\135512.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\135540.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\135924.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\135956.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\135988.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\136824.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\138176.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\138672.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\13892.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\139164.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\14848.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\15256.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\15660.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\15912.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\16256.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\16948.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\17060.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\17396.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\17480.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\17844.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\18212.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\19592.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\1984.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\2132.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\2284.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\23264.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\2416.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\2452.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\2608.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\2908.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\29332.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\2936.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\3120.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\3212.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\32136.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\32572.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\3288.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\3296.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\3360.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\3576.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\3896.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\3912.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\7320.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\776.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\7848.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temp\E01083060\8248.tmp -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\8LYNCXM7\adv549[1].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\8LYNCXM7\adv549[2].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\8LYNCXM7\adv549[3].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\GXEV4DMJ\adv549[1].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\GXEV4DMJ\adv549[2].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\GXEV4DMJ\adv549[3].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\N3XNZ5OW\adv549[1].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\N3XNZ5OW\adv549[2].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\N3XNZ5OW\adv549[3].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\N3XNZ5OW\adv549[4].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\S9EZWP6N\adv549[2].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\SBJ3MK9T\002[1].exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\SBJ3MK9T\adv549[1].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\W9MRO1MR\adv549[1].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\W9MRO1MR\adv549[2].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\X0O7D1OH\001[1].exe -> Downloader.Small.cic : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\X0O7D1OH\adv549[1].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\X0O7D1OH\adv549[2].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\X0O7D1OH\adv549[3].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Raf\Local Settings\Temporary Internet Files\Content.IE5\X0O7D1OH\sploitadv549[1].anr -> Downloader.Ani.c : Schoongemaakt met een backup
:mozilla.22:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Com : Schoongemaakt met een backup
:mozilla.23:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Com : Schoongemaakt met een backup
:mozilla.24:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Ivwbox : Schoongemaakt met een backup
:mozilla.91:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Schoongemaakt met een backup
:mozilla.92:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Schoongemaakt met een backup
:mozilla.101:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Adbrite : Schoongemaakt met een backup
:mozilla.122:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.123:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.124:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.125:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.126:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.127:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.128:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.129:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.183:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Valueclick : Schoongemaakt met een backup
:mozilla.184:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Valueclick : Schoongemaakt met een backup
:mozilla.187:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Dbbsrv : Schoongemaakt met een backup
:mozilla.234:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.238:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Realtracker : Schoongemaakt met een backup
:mozilla.239:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Realtracker : Schoongemaakt met een backup
:mozilla.255:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Hitbox : Schoongemaakt met een backup
:mozilla.256:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Hitbox : Schoongemaakt met een backup
:mozilla.265:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Trafic : Schoongemaakt met een backup
:mozilla.271:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.272:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.273:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.274:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
:mozilla.298:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Hitbox : Schoongemaakt met een backup
:mozilla.304:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.247realmedia : Schoongemaakt met een backup
:mozilla.319:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Sexcounter : Schoongemaakt met een backup
:mozilla.320:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Sexcounter : Schoongemaakt met een backup
:mozilla.363:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Clickhype : Schoongemaakt met een backup
:mozilla.404:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Hitbox : Schoongemaakt met een backup
:mozilla.428:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Hitbox : Schoongemaakt met een backup
:mozilla.429:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Hitbox : Schoongemaakt met een backup
:mozilla.430:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Hitbox : Schoongemaakt met een backup
:mozilla.431:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\1tjzbkdt.default\cookies.txt -> Spyware.Cookie.Hitbox : Schoongemaakt met een backup
:mozilla.6:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\4at9jy0d.Standaardgebruiker\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.25:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\4at9jy0d.Standaardgebruiker\cookies.txt -> Spyware.Cookie.2o7 : Schoongemaakt met een backup
:mozilla.37:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\4at9jy0d.Standaardgebruiker\cookies.txt -> Spyware.Cookie.Ivwbox : Schoongemaakt met een backup
:mozilla.59:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\4at9jy0d.Standaardgebruiker\cookies.txt -> Spyware.Cookie.Overture : Schoongemaakt met een backup
:mozilla.83:C:\Documents and Settings\Rest\Application Data\Mozilla\Firefox\Profiles\4at9jy0d.Standaardgebruiker\cookies.txt -> Spyware.Cookie.Tradedoubler : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Cookies\rest@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Cookies\rest@adopt.euroclick[1].txt -> Spyware.Cookie.Euroclick : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Cookies\rest@findwhat[2].txt -> Spyware.Cookie.Findwhat : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temp\1505687.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temp\1854640.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temp\1868671.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temp\2105656.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temp\2454640.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temp\2456640.exe -> Hijacker.Small.jr : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temp\2468671.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temp\3056640.exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temporary Internet Files\Content.IE5\G9YNG5YN\sploitadv549[1].anr -> Downloader.Ani.c : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temporary Internet Files\Content.IE5\OX23452R\adv549[1].htm -> Not-A-Virus.Exploit.HTML.Mht : Schoongemaakt met een backup
C:\Documents and Settings\Rest\Local Settings\Temporary Internet Files\Content.IE5\WTM7CDQN\002[1].exe -> Hijacker.Small.ju : Schoongemaakt met een backup
C:\WINDOWS\system\svwhost.dll -> Trojan.Agent.nw : Schoongemaakt met een backup
C:\WINDOWS\system32\mpcsvc.exe -> Logger.Small.dp : Schoongemaakt met een backup
C:\WINDOWS\system32\qm.sys -> Backdoor.Haxdoor.gk : Schoongemaakt met een backup
C:\WINDOWS\system32\sxlntr.exe -> Downloader.Small.bux : Schoongemaakt met een backup
D:\Program Files\Common Files\tjd\amstercam.exe -> Heuristic.Win32.Dialer : Schoongemaakt met een backup
D:\Program Files\Messenger Plus! 2\Setup.dat/70000011.exe -> Downloader.Swizzor.af : Schoongemaakt met een backup
D:\WINDOWS\Downloaded Program Files\miniclipGameLoader.dll -> Spyware.Retro64 : Schoongemaakt met een backup
D:\WINDOWS\Downloaded Program Files\nl.exe -> Heuristic.Win32.Dialer : Schoongemaakt met een backup
D:\WINDOWS\Hot_Kiss.vxe -> Dialer.Generic : Schoongemaakt met een backup
D:\WINDOWS\system32\bgnteu0o4u.dll -> Trojan.Krepper.v : Schoongemaakt met een backup
D:\WINDOWS\system32\oj9zlbu4vm.dll -> Trojan.Krepper.v : Schoongemaakt met een backup


::Einde rapport

#6 Mae$tro

Mae$tro
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 05 February 2006 - 07:55 AM

New HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 13:53:45, on 5/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\niSvcLoc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\hphmon04.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\HPHipm11.exe
C:\Program Files\ewido anti-malware\SecuritySuite.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Raf\Bureaublad\Anti Spyware\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programs\ANTISP~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [CloneCDTray] "D:\Programs\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\games\half life 2\steam.exe" -silent
O4 - Global Startup: Adobe Reader Snelle start.lnk = D:\Programs\Adobe Reader\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1115847562200
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla...5/Installer.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: sndu32 - C:\WINDOWS\SYSTEM32\sndu32.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NILM License manager - Macrovision Corporation - D:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments - C:\WINDOWS\system32\niSvcLoc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

sndu32 still there

Edited by Mae$tro, 05 February 2006 - 07:57 AM.


#7 Daemon

Daemon

    Security Expert


  • Members
  • 1,446 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:40 AM

Posted 05 February 2006 - 09:56 AM

Download haxfix.exe.
Save it to your desktop.
Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files)
When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed.
A red "dos window" (dos box) will open.
This message will appear:

Insert the haxdoor notify subkey without the numbers,
and then press enter:


At this point please type the following: sndu
Press Enter to continue with the fix.

If an infection is found, you'll get a message to close all other open windows.
Close them, except the red dos window from haxfix and press Enter.
The computer will reboot.
After reboot find the logfile c:\haxfix.txt.
Post the contents of c:\haxfix.txt along with a new hijackthislog.
Posted Image

Have I helped you? Please consider donating to help me continue with the fight against malware. Click here

#8 Mae$tro

Mae$tro
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 05 February 2006 - 10:52 AM

My pc rebooted, started up, rebooted again, started, reboot, start :thumbsup:
dunno if that is a problem, but looked weird that it rebooted 3 times without me doing anything. i always saw the red box for a moment, except the last time


HAXFIX logfile
--------------
by Marckie


haxdoor key: sndu


searching for services....
services found


deleting services.....
[SWSC] StopService FAIL
[SWSC] DeleteService SUCCESS
[SWSC] StopService FAIL
[SWSC] DeleteService SUCCESS


rebooting the computer.....


haxdoor notify subkey: sndu


searching for services....
haxdoor notify subkey: sndu


searching for services....
services not found


checking if files are found.....
sndu32.dll exist
sndu64.sys exist
klgcptini.dat exist
qm.dll exist
stt82.ini exist
ps.a3d exist
sndu32.sys not found
qm.sys not found
qy.dll not found
qy.sys not found
qz.dll not found
qz.sys not found
klogini.dll not found
p3.ini not found


deleting files.....


checking if files are deleted.....
sndu32.dll not found
sndu32.sys not found
sndu64.sys not found
klgcptini.dat not found
qm.dll not found
qm.sys not found
qy.dll not found
qy.sys not found
qz.dll not found
qz.sys not found
stt82.ini not found
klogini.dll not found
p3.ini not found
ps.a3d not found

Finished




Logfile of HijackThis v1.99.1
Scan saved at 16:50:12, on 5/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\niSvcLoc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\hphmon04.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\mpcsvc.exe
C:\WINDOWS\system32\HPHipm11.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Raf\Bureaublad\Anti Spyware\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programs\ANTISP~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {9C5875B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\system32\sxlntr.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [CloneCDTray] "D:\Programs\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IExplore adviser] Regsvr32.exe /s C:\WINDOWS\system32\sxlntr.dll
O4 - HKLM\..\Run: [Repair Service Manager] C:\WINDOWS\system32\lzxdpo.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\games\half life 2\steam.exe" -silent
O4 - Global Startup: Adobe Reader Snelle start.lnk = D:\Programs\Adobe Reader\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1115847562200
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla...5/Installer.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NILM License manager - Macrovision Corporation - D:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments - C:\WINDOWS\system32\niSvcLoc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

#9 Mae$tro

Mae$tro
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 05 February 2006 - 10:53 AM

If i look at my processes running, i now also have mpcsvc.exe running, but it keepse appearing and disappearing all the time, rellay fast so i can't shut it down.

#10 Daemon

Daemon

    Security Expert


  • Members
  • 1,446 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:40 AM

Posted 05 February 2006 - 11:09 AM

Go to Jotti's malware scan

Copy and paste the following file path into the "File to upload & scan" box on the top of the page:

C:\WINDOWS\system32\mpcsvc.exe

Click on the submit button. Please post the results in your next reply.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O2 - BHO: (no name) - {9C5875B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\system32\sxlntr.dll
O4 - HKLM\..\Run: [IExplore adviser] Regsvr32.exe /s C:\WINDOWS\system32\sxlntr.dll
O4 - HKLM\..\Run: [Repair Service Manager] C:\WINDOWS\system32\lzxdpo.exe


Exit HijackThis when done. Reboot into Safe Mode by tapping F8 after the BIOS has loaded. Using Windows Explorer, find and delete the following:

C:\WINDOWS\system32\lzxdpo.exe

Exit Explorer and reboot into Normal Mode. Rescan with HijackThis and post a new log here.
Posted Image

Have I helped you? Please consider donating to help me continue with the fight against malware. Click here

#11 Mae$tro

Mae$tro
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 05 February 2006 - 12:15 PM

Scanner results
AntiVir
Found Trojan/Spy.Small.DP.2
ArcaVir
Found Trojan.Spy.Small.Dp
Avast
Found nothing
AVG Antivirus
Found PSW.Generic.OQE
BitDefender
Found Trojan.Spy.Small.AJ
ClamAV
Found Trojan.Downloader.Delf-204
Dr.Web
Found Trojan.Spambot
F-Prot Antivirus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found Trojan-Spy.Win32.Small.dp
NOD32
Found Win32/Spy.Small.DP
Norman Virus Control
Found nothing
UNA
Found Trojan.Spy.Win32.Small
VBA32
Found Trojan-Spy.Win32.Small.dp

#12 Mae$tro

Mae$tro
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 05 February 2006 - 12:27 PM

New HJT log after removal of lzxdpo

Logfile of HijackThis v1.99.1
Scan saved at 18:25:03, on 5/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\niSvcLoc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\hphmon04.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\HPHipm11.exe
D:\Programs\Adobe Reader\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Raf\Bureaublad\Anti Spyware\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programs\ANTISP~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [CloneCDTray] "D:\Programs\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [hdloker] C:\WINDOWS\system32\sxlntr.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\games\half life 2\steam.exe" -silent
O4 - Global Startup: Adobe Reader Snelle start.lnk = D:\Programs\Adobe Reader\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1115847562200
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla...5/Installer.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NILM License manager - Macrovision Corporation - D:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments - C:\WINDOWS\system32\niSvcLoc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

#13 Daemon

Daemon

    Security Expert


  • Members
  • 1,446 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:40 AM

Posted 05 February 2006 - 12:38 PM

Still got something lurking in there. Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.
  • Save it to your desktop.
  • Please double-click Killbox.exe to run it.
  • Select:
    • Delete on Reboot
    • then Click on the All Files button.
  • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\WINDOWS\system32\sxlntr.exe
    C:\WINDOWS\system32\mpcsvc.exe

  • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

With only HJT running, fix this entry:

O4 - HKLM\..\Run: [hdloker] C:\WINDOWS\system32\sxlntr.exe

Reboot again and post a new HJT log.
Posted Image

Have I helped you? Please consider donating to help me continue with the fight against malware. Click here

#14 Mae$tro

Mae$tro
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:40 AM

Posted 05 February 2006 - 01:53 PM

Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

I did not get that, and at reboot ,
O4 - HKLM\..\Run: [hdloker] C:\WINDOWS\system32\sxlntr.exe
that wasn't there.

new log

Logfile of HijackThis v1.99.1
Scan saved at 19:50:42, on 5/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\niSvcLoc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\hphmon04.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Programs\Adobe Reader\Reader\reader_sl.exe
C:\WINDOWS\system32\HPHipm11.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Raf\Bureaublad\Anti Spyware\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programs\Adobe Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programs\ANTISP~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe
O4 - HKLM\..\Run: [CloneCDTray] "D:\Programs\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\games\half life 2\steam.exe" -silent
O4 - Global Startup: Adobe Reader Snelle start.lnk = D:\Programs\Adobe Reader\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Zoeken - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - D:\Programs\VisualRoute\vrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1115847562200
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla...5/Installer.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NILM License manager - Macrovision Corporation - D:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments - C:\WINDOWS\system32\niSvcLoc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

#15 Daemon

Daemon

    Security Expert


  • Members
  • 1,446 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:40 AM

Posted 05 February 2006 - 01:57 PM

Looks better - how is it running now?
Posted Image

Have I helped you? Please consider donating to help me continue with the fight against malware. Click here




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users