[ocelot]

Hey,
I seem to have several infections on my pc:
- Task manager is turned off by the administrator (I'm the admin and I didn't do so)
- a red circle with a white cross in it on the taskbar noticing me about me having infections
- the aurora popups
- my internet explorer startpage has been changed into a 'Search for...' page which I can't change
- and probably more...
So my pc is pretty messed up

Here is my HijackThis log:



Logfile of HijackThis v1.99.1
Scan saved at 20:35:29, on 26-7-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\windows\system32\tupjnkr.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ewupdater.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\6560.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\vxgame3.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\vxgamet2.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lucas Woudstra\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {2C504918-55E1-B9BF-3461-B183CBF58396} - C:\DOCUME~1\LUCASW~1\APPLIC~1\COPYCR~1\DriveClock.exe
O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} - C:\WINDOWS\SYSTEM\Loader.dll
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: BHOmodObj Class - {7F6828CA-9E42-462C-BC60-418C8144012C} - c:\windows\system\BHOmod.dll
O2 - BHO: (no name) - {9A81CAA4-7E7E-4B38-B0F0-43C2A2DB89BC} - C:\WINDOWS\System32\apmd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NetPumper] "C:\Program Files\NetPumper\NetPumperIEProxy.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Type Debug Rdr Store] C:\Documents and Settings\All Users\Application Data\intergreytypedebug\KeepVga.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\Run: [qidxzr] c:\windows\system32\tupjnkr.exe r
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HitwarePKLite] C:\Program Files\Hitware Popup Killer Lite\HitwarePKLite.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Apwheel] C:\WINDOWS\System32\6560.exe
O4 - HKCU\..\Run: [Cmt101] c:\windows\system32\cmt101.exe
O4 - HKCU\..\Run: [Msmon] c:\windows\system32\msmon.exe
O4 - HKCU\..\Run: [debug plus] C:\DOCUME~1\LUCASW~1\APPLIC~1\GRIMBI~1\hole dead.exe
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\symcsvc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
O9 - Extra button: Microsoft® JavaScript® Console - {19F17D7C-654C-49B5-B162-49D6A9157D82} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {52FAA6BF-7EC8-4B05-A458-21F7BD6D7491} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\PLUGINS\NPFinale.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://nl.browserupd...01/nliq0001.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c18.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://rimmel.ai-med...ve/makeover.cab
O16 - DPF: {225CDD95-6F20-4DE4-8680-4F8F14882229} (NDiamonds Class) - http://hosting0.game...ll/diamonds.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webca...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab32846.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom....gamesplayer.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...1/Installer.exe
O16 - DPF: {D27CDB6E-0000-0000-0000-000000000000} - https://download.mac...ash/swflash.cab
O16 - DPF: {E1E0FB30-7830-4DC2-8443-0EAB9695A421} (BaseRunner Class) - http://82.168.191.52/WebGuard.cab
O16 - DPF: {E3E34A32-3A6A-47CC-B4E3-B8B86715D388} (MBoom Class) - http://hosting0.game...in/dll/boom.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot....ownload/kdx.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E04CD814-9982-4A39-B1FE-4BC7218F9294}: NameServer = 194.134.5.5 194.134.0.97
O18 - Filter: text/html - {E979F391-EBC3-412F-8BBE-EA6D8E0A7369} - C:\WINDOWS\System32\apmd.dll
O18 - Filter: text/plain - {E979F391-EBC3-412F-8BBE-EA6D8E0A7369} - C:\WINDOWS\System32\apmd.dll
O21 - SSODL: Adobe Acrobat 5.0 - {55E57B4A-1389-C49F-BC70-7C2A6736D7AF} - c:\program files\common files\adobe\acrobat 5.0\nt\winfcbsgv32.dll
O21 - SSODL: System - {F5E9440A-C7DD-4FD1-903D-B46490C38B44} - vr_sys.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

[Advertisements]

Hello and welcome to Geeks To Go!

You have a really nice collection started there. Lets start with the aurora popups since they are the most annoying. Then well move on to the other infections

First:
Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")
• Exit ewido. DO NOT scan yet.

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Download CCleaner and install it, but do not run it yet.

Please download this file: Nailfix Utility
Save it to your desktop.
DO NOT run it yet.

To reboot into SafeMode with Windows XP, you can follow these steps from Microsoft:

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Once in Safe Mode, please double-click on nailfix.exe.
Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Now open ewido and do a scan of your system.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.**
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now as the action.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")

Now run HijackThis, click Scan, and place a checkmark next to each of the following items:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [qidxzr] c:\windows\system32\tupjnkr.exe r

Close all open windows except for HJT, then click the Fix Checked button. Close HJT.
NOTE: The 04 entry may have changed names if you have rebooted since posting the log; look for an entry with a similar format, that will always in in a single letter r.

Locate and delete the following File in BOLD:
c:\windows\system32\tupjnkr.exe (or whatever the name may have changed to, as noted above).

Now run CCleaner.

• Uncheck "Cookies" under "Internet Explorer".
• If running Firefox: click on the "Applications" tab and uncheck "Cookies" under "Firefox".
• Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.

Finally, restart your computer in normal mode and please post a new HijackThis log, as well as the report log from the Ewido scan by using Add Reply

[ScHwErV]

Hello and welcome to Geeks To Go!

You have a really nice collection started there. Lets start with the aurora popups since they are the most annoying. Then well move on to the other infections

First:
Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")
• Exit ewido. DO NOT scan yet.

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Download CCleaner and install it, but do not run it yet.

Please download this file: Nailfix Utility
Save it to your desktop.
DO NOT run it yet.

To reboot into SafeMode with Windows XP, you can follow these steps from Microsoft:

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Once in Safe Mode, please double-click on nailfix.exe.
Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Now open ewido and do a scan of your system.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.**
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now as the action.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")

Now run HijackThis, click Scan, and place a checkmark next to each of the following items:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [qidxzr] c:\windows\system32\tupjnkr.exe r

Close all open windows except for HJT, then click the Fix Checked button. Close HJT.
NOTE: The 04 entry may have changed names if you have rebooted since posting the log; look for an entry with a similar format, that will always in in a single letter r.

Locate and delete the following File in BOLD:
c:\windows\system32\tupjnkr.exe (or whatever the name may have changed to, as noted above).

Now run CCleaner.

• Uncheck "Cookies" under "Internet Explorer".
• If running Firefox: click on the "Applications" tab and uncheck "Cookies" under "Firefox".
• Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.

Finally, restart your computer in normal mode and please post a new HijackThis log, as well as the report log from the Ewido scan by using Add Reply

[ocelot]

thanks for your help
I wasn't able to delete the c:\windows\system32\ywhdhf.exe file, because it was in use or so.

Here is my HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 0:08:28, on 27-7-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\NetPumper\NetPumperIEProxy.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\ctfmon.exe
c:\windows\system32\vxonqci.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\6560.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Lucas Woudstra\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {2C504918-55E1-B9BF-3461-B183CBF58396} - C:\DOCUME~1\LUCASW~1\APPLIC~1\COPYCR~1\DriveClock.exe
O2 - BHO: (no name) - {9A81CAA4-7E7E-4B38-B0F0-43C2A2DB89BC} - C:\WINDOWS\System32\apmd.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NetPumper] "C:\Program Files\NetPumper\NetPumperIEProxy.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Type Debug Rdr Store] C:\Documents and Settings\All Users\Application Data\intergreytypedebug\KeepVga.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\Run: [pqmvub] c:\windows\system32\vxonqci.exe r
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HitwarePKLite] C:\Program Files\Hitware Popup Killer Lite\HitwarePKLite.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Apwheel] C:\WINDOWS\System32\6560.exe
O4 - HKCU\..\Run: [Cmt101] c:\windows\system32\cmt101.exe
O4 - HKCU\..\Run: [Msmon] c:\windows\system32\msmon.exe
O4 - HKCU\..\Run: [debug plus] C:\DOCUME~1\LUCASW~1\APPLIC~1\GRIMBI~1\hole dead.exe
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\symcsvc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
O9 - Extra button: Microsoft® JavaScript® Console - {19F17D7C-654C-49B5-B162-49D6A9157D82} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {52FAA6BF-7EC8-4B05-A458-21F7BD6D7491} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\PLUGINS\NPFinale.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://nl.browserupd...01/nliq0001.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c18.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://rimmel.ai-med...ve/makeover.cab
O16 - DPF: {225CDD95-6F20-4DE4-8680-4F8F14882229} (NDiamonds Class) - http://hosting0.game...ll/diamonds.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webca...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab32846.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom....gamesplayer.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...1/Installer.exe
O16 - DPF: {D27CDB6E-0000-0000-0000-000000000000} - https://download.mac...ash/swflash.cab
O16 - DPF: {E1E0FB30-7830-4DC2-8443-0EAB9695A421} (BaseRunner Class) - http://82.168.191.52/WebGuard.cab
O16 - DPF: {E3E34A32-3A6A-47CC-B4E3-B8B86715D388} (MBoom Class) - http://hosting0.game...in/dll/boom.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot....ownload/kdx.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E04CD814-9982-4A39-B1FE-4BC7218F9294}: NameServer = 194.134.5.5 194.134.0.97
O18 - Filter: text/html - {A09321BD-F215-473A-80AA-C791124DEAC7} - C:\WINDOWS\System32\apmd.dll
O18 - Filter: text/plain - {A09321BD-F215-473A-80AA-C791124DEAC7} - C:\WINDOWS\System32\apmd.dll
O21 - SSODL: Adobe Acrobat 5.0 - {55E57B4A-1389-C49F-BC70-7C2A6736D7AF} - c:\program files\common files\adobe\acrobat 5.0\nt\winfcbsgv32.dll (file missing)
O21 - SSODL: System - {F5E9440A-C7DD-4FD1-903D-B46490C38B44} - vr_sys.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe



Here is my Ewido log:

---------------------------------------------------------
ewido security suite - Scan rapport
---------------------------------------------------------

+ Gemaakt op: 23:49:12, 26-7-2005
+ Rapport samenvatting: 365071E5

+ Scan resultaten:

C:\Documents and Settings\Frits Woudstra\Cookies\frits [email protected][1].txt -> Spyware.Cookie.Serving-sys : Genegeerd
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Genegeerd
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas [email protected][2].txt -> Spyware.Cookie.Serving-sys : Genegeerd
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Genegeerd
C:\new.exe -> TrojanDownloader.Small.air : Genegeerd
C:\WINDOWS\Downloaded Program Files\dMi_191.exe -> Heuristic.Win32.Dialer : Genegeerd
HKLM\SOFTWARE\Classes\CLSID\{0F9561D0-03B2-44a3-89A6-E95E417CBA25} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{2E246FAE-8420-11D9-870D-000C2917DE7F} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{38D4D5D0-423E-4220-B6F9-30918C2AE4A4} -> Spyware.BetterInternet : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} -> Spyware.iSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{7F6828CA-9E42-462C-BC60-418C8144012C} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\CLSID\{C91E8926-D4BE-4685-99F4-0D996B96BAC0} -> Spyware.P2PNetworking : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Interface\{16097036-894C-4C00-A61F-93CA0D49A70E} -> Spyware.TOPicks : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Interface\{2ED5AF98-9258-45BA-B79B-06625C92F662} -> Spyware.TOPicks : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Interface\{491BE5B7-A7F8-40EC-AAD4-CBA11FDFD814} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Interface\{700DC0DD-F409-42E0-9DE5-21EE1A2BA9FD} -> Spyware.TOPicks : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Interface\{8C505A6B-124B-4768-8FD3-1A066C839848} -> Spyware.BlazeFind : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Interface\{C91E8926-D4BE-4685-99F4-0D996B96BAC0} -> Spyware.P2PNetworking : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\Interface\{FD42F6D3-7AB1-470C-979B-7996EDC99099} -> Spyware.TOPicks : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\TypeLib\{09CA52B3-703C-4B17-9690-C13F736E3DCD} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\TypeLib\{29358AA6-679D-44EA-8A51-59A3C6E6F811} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\TypeLib\{841A9195-5690-11D4-A258-0040954A01BE} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Classes\TypeLib\{8EA362BD-39CB-40F5-9226-73CD40999095} -> Spyware.BetterInternet : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bargain Buddy -> Spyware.BargainBuddy : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E246FAE-8420-11D9-870D-000C2917DE7F} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} -> Spyware.iSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6828CA-9E42-462C-BC60-418C8144012C} -> Dialer.Generic : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MNPol -> Spyware.BetterInternet : Schoongemaakt met een backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistant Uninstall -> Spyware.CoolWebSearch : Schoongemaakt met een backup
HKLM\SOFTWARE\saap -> Spyware.180Solutions : Schoongemaakt met een backup
HKLM\SOFTWARE\SearchRelevancy -> Spyware.SearchRelevancy : Schoongemaakt met een backup
HKLM\SOFTWARE\SearchRelevancy\Update -> Spyware.SearchRelevancy : Schoongemaakt met een backup
HKLM\SYSTEM\CurrentControlSet\Services\delprot -> Spyware.iSearch : Schoongemaakt met een backup
HKLM\SYSTEM\CurrentControlSet\Services\delprot\Security -> Spyware.iSearch : Schoongemaakt met een backup
HKLM\SYSTEM\CurrentControlSet\Services\delprot\Enum -> Spyware.iSearch : Schoongemaakt met een backup
HKU\S-1-5-21-2593592043-1319382865-2346362425-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{0656A137-B161-CADD-9777-E37A75727E78} -> Dialer.Generic : Schoongemaakt met een backup
HKU\S-1-5-21-2593592043-1319382865-2346362425-1006\Software\MNPol -> Spyware.BetterInternet : Schoongemaakt met een backup
HKU\S-1-5-21-2593592043-1319382865-2346362425-1006\Software\saap -> Spyware.180Solutions : Schoongemaakt met een backup
HKU\S-1-5-21-2593592043-1319382865-2346362425-1006\Software\Classes\CLSID\{0656A137-B161-CADD-9777-E37A75727E78} -> Dialer.Generic : Schoongemaakt met een backup
HKU\S-1-5-21-2593592043-1319382865-2346362425-1006_Classes\CLSID\{0656A137-B161-CADD-9777-E37A75727E78} -> Dialer.Generic : Schoongemaakt met een backup
C:\Documents and Settings\All Users\Documenten\smsrv.exe -> Backdoor.Agobot.nq : Schoongemaakt met een backup
C:\Documents and Settings\All Users\Documenten\system.exe -> Backdoor.Agobot.aaq : Schoongemaakt met een backup
C:\Documents and Settings\Anouk Overbeek\Cookies\anouk overbeek@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Schoongemaakt met een backup
C:\Documents and Settings\Anouk Overbeek\Local Settings\Temp\se.dll -> Spyware.Hijacker.Generic : Schoongemaakt met een backup
C:\Documents and Settings\Anouk Overbeek\Local Settings\Temp\WGR\aurareco.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\Documents and Settings\Anouk Overbeek\Local Settings\Temporary Internet Files\Content.IE5\YKKYY7K9\gdnNL1956[1].exe -> TrojanDownloader.Small.ayl : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits [email protected][2].txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits [email protected][1].txt -> Spyware.Cookie.Clickhype : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@adtech[2].txt -> Spyware.Cookie.Adtech : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits [email protected][2].txt -> Spyware.Cookie.Falkag : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@burstnet[1].txt -> Spyware.Cookie.Burstnet : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@fastclick[2].txt -> Spyware.Cookie.Fastclick : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits [email protected][1].txt -> Spyware.Cookie.Masterstats : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@ivwbox[2].txt -> Spyware.Cookie.Ivwbox : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits [email protected][1].txt -> Spyware.Cookie.Adjuggler : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@spylog[1].txt -> Spyware.Cookie.Spylog : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@statcounter[1].txt -> Spyware.Cookie.Statcounter : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Cookies\frits woudstra@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Local Settings\Temp\se.dll -> Spyware.Hijacker.Generic : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Local Settings\Temporary Internet Files\Content.IE5\CLMFSDER\latest[1].exe -> Trojan.Crypt.c : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Local Settings\Temporary Internet Files\Content.IE5\CLMFSDER\latest[2].exe -> Trojan.Crypt.c : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Local Settings\Temporary Internet Files\Content.IE5\ORLJQIN9\win32[1].exe -> TrojanDownloader.Small.agq : Schoongemaakt met een backup
C:\Documents and Settings\Frits Woudstra\Local Settings\Temporary Internet Files\Content.IE5\W5U701UR\abc[1].exe -> TrojanSpy.LdPinch.os : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@abetterinternet[1].txt -> Spyware.Cookie.Abetterinternet : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas [email protected][1].txt -> Spyware.Cookie.Yieldmanager : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas [email protected][1].txt -> Spyware.Cookie.Clickhype : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas [email protected][1].txt -> Spyware.Cookie.Euroclick : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas [email protected][2].txt -> Spyware.Cookie.Pointroll : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas [email protected][1].txt -> Spyware.Cookie.Falkag : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@atdmt[2].txt -> Spyware.Cookie.Atdmt : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@burstnet[1].txt -> Spyware.Cookie.Burstnet : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@centrport[2].txt -> Spyware.Cookie.Centrport : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@fastclick[1].txt -> Spyware.Cookie.Fastclick : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas [email protected][1].txt -> Spyware.Cookie.Popularix : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas [email protected][1].txt -> Spyware.Cookie.Wegcash : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@revenue[1].txt -> Spyware.Cookie.Revenue : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@statcounter[1].txt -> Spyware.Cookie.Statcounter : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@targetnet[1].txt -> Spyware.Cookie.Targetnet : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Cookies\lucas woudstra@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Local Settings\Temp\Cookies\lucas woudstra@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Local Settings\Temp\Cookies\lucas woudstra@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Local Settings\Temp\Cookies\lucas [email protected][2].txt -> Spyware.Cookie.Webtrendslive : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Local Settings\Temp\se.dll -> Spyware.Hijacker.Generic : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Local Settings\Temporary Internet Files\Content.IE5\M0MWHOPL\latest[1].exe -> Trojan.Crypt.c : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Local Settings\Temporary Internet Files\Content.IE5\OD8D5E60\abc[1].exe -> TrojanSpy.LdPinch.os : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Local Settings\Temporary Internet Files\Content.IE5\OD8D5E60\latest[1].exe -> Trojan.Crypt.c : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Mijn documenten\cleaning [bleep]\backup-20041219-160502-282.dll -> Spyware.AdPowerZone : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Mijn documenten\cleaning [bleep]\backup-20050530-152752-653.dll -> Trojan.Puper.g : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Mijn documenten\cleaning [bleep]\backup-20050616-190116-562.dll -> TrojanDownloader.Ieser.a : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Mijn documenten\cleaning [bleep]\backup-20050621-232223-470.dll -> TrojanDownloader.Ieser.a : Schoongemaakt met een backup
C:\Documents and Settings\Lucas Woudstra\Mijn documenten\Mijn afbeeldingen\Nieuwe map\RealOne.Player.and.iQfx3.and.vTuner.Plus.v4.0 ( OK! ).zip/RealOne.Player.and.iQfx3.and.vTuner.Plus.v4.0/RealOnePlayer.exe -> Backdoor.Optix.Pro.o : Schoongemaakt met een backup
C:\Program Files\Command & Conquer\Command And Conquer-Tiberian Sun\razor.exe -> TrojanDropper.Small.ux : Schoongemaakt met een backup
C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\winfcbsgv32.dll -> TrojanDownloader.Murlo.ar : Schoongemaakt met een backup
C:\Program Files\Internet Explorer\iexplorer.exe -> TrojanDownloader.Small.uy : Schoongemaakt met een backup
C:\Program Files\SearchRelevant\SearchRelevant.dll -> Spyware.Relevance : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001329.TXT -> Spyware.Cookie.Falkag : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001331.TXT -> Spyware.Cookie.Gator : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001332.TXT -> Spyware.Cookie.Gator : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001364.TXT -> Spyware.Cookie.Gator : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001365.TXT -> Spyware.Cookie.Gator : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001575.TXT -> Spyware.Cookie.Internetfuel : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001576.TXT -> Spyware.Cookie.Internetfuel : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001577.TXT -> Spyware.Cookie.Internetfuel : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001578.TXT -> Spyware.Cookie.Internetfuel : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001581.TXT -> Spyware.Cookie.Internetfuel : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001582.TXT -> Spyware.Cookie.Internetfuel : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001583.TXT -> Spyware.Cookie.Internetfuel : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001607.TXT -> Spyware.Cookie.Revenue : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001608.TXT -> Spyware.Cookie.Revenue : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001609.TXT -> Spyware.Cookie.Gator : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00001610.TXT -> Spyware.Cookie.Gator : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002468.TXT -> Spyware.Cookie.Paycounter : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002470.TXT -> Spyware.Cookie.Paycounter : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002575.TXT -> Spyware.Cookie.Tribalfusion : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002576.TXT -> Spyware.Cookie.Fastclick : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002582.TXT -> Spyware.Cookie.Trafficmp : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002583.TXT -> Spyware.Cookie.Trafficmp : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002584.TXT -> Spyware.Cookie.Trafficmp : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002598.TXT -> Spyware.Cookie.Fastclick : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002603.TXT -> Spyware.Cookie.Sexlist : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002604.TXT -> Spyware.Cookie.Sexlist : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002605.TXT -> Spyware.Cookie.Sexlist : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002606.TXT -> Spyware.Cookie.Sexlist : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002618.TXT -> Spyware.Cookie.Sextracker : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002619.TXT -> Spyware.Cookie.Sextracker : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002622.TXT -> Spyware.Cookie.Sextracker : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002625.TXT -> Spyware.Cookie.Sextracker : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002627.TXT -> Spyware.Cookie.Paycounter : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002628.TXT -> Spyware.Cookie.Paycounter : Schoongemaakt met een backup
C:\RECYCLER\NPROTECT\00002631.TXT -> Spyware.Cookie.Paycounter : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318694.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318695.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318708.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318709.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318714.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318732.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318733.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318734.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318745.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318746.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318774.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0318775.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0319774.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0319775.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP514\A0319781.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0319784.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0319788.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320774.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320775.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320792.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320802.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320803.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320804.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320809.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320823.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320824.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320839.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP515\A0320840.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP516\A0320872.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP516\A0320876.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320897.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320901.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320907.exe -> TrojanDownloader.Adload.a : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320915.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320917.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320922.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320931.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320934.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320943.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320944.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320971.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0320972.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0321971.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0321972.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP518\A0321976.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0321987.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0321988.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0321992.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0322014.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0322016.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0322022.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0323014.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0323016.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0323030.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0323032.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0323040.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP519\A0323041.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0323055.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0323062.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0323063.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0323068.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0323088.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0323089.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0323091.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0324088.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP520\A0324089.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0324113.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0324114.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0324115.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0325088.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0325090.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0325096.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326088.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326090.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326099.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326101.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326113.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326115.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326127.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326129.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326147.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326149.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326152.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326162.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326163.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0326164.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0327162.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP521\A0327164.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327180.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327181.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327192.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327194.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327201.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327213.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327215.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327246.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327247.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327268.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327285.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP522\A0327287.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328285.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328286.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328293.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328338.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328339.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328340.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328364.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328365.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328386.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328387.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP523\A0328391.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0328407.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0328408.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0329386.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0329387.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0329404.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0329405.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0329414.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330404.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330405.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330406.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330410.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330433.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330434.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330447.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330475.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330476.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330486.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330487.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0330491.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331486.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331487.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331493.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331513.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331514.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331525.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331526.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331539.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331540.dll -> Trojan.Agent.fc : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP524\A0331545.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP525\A0331570.exe -> Adware.BetterInternet : Schoongemaakt met een backup
C:\System Volume Information\_restore{F89817AF-0A8C-4752-B403-11B3333F859B}\RP525

[ScHwErV]

Lets first take another stab at that file and some of his friends. Just so we dont get an infection back.

1) Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

2) Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.

3) Once in Safe Mode, please run Killbox.

4) Select "Delete on Reboot".

5) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\Program Files\NetPumper\NetPumperIEProxy.exe
C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\se.dll
C:\Documents and Settings\All Users\Application Data\GRIMBI~1\
C:\Documents and Settings\All Users\Application Data\intergreytypedebug\
C:\WINDOWS\System32\apmd.dll
C:\WINDOWS\ewupdater.exe
C:\WINDOWS\isrvs\
C:\WINDOWS\System32\kernels32.exe
C:\WINDOWS\System\svchost.exe
c:\windows\system32\cmt101.exe
c:\windows\system32\msmon.exe
C:\WINDOWS\System32\symcsvc.exe

6) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

7) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

Let the system reboot.

===========================================

Now well go after that CWS infection.

Download about:buster by RubbeRDuckY Here.
Download CWShredder Here.
Download SpSeHjfix Here.
Download and install CleanUp! Here

Save all of these files somewhere you will remember like to the Desktop.

Unzip SpSeHjfix to its own folder (ie c:\SpSeHjfix)

Run the CleanUp! installer. You dont need to do anything with it right now.

Update About:Buster

• Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
• Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
• Click "OK" at the prompt with instructions.
• Click "Update" and then "Check For Update" to begin the update process.
• If any updates exist please download them by clicking "Download Update" then click the X to close that window.
• Now close About:Buster

Update CWShredder

• Open CWShredder and click I AGREE
• Click Check For Update
• Close CWShredder

Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Please run about:buster by RubbeRDuckY:

• Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
• Click Yes to allow it to shutdown explorer.exe.
• It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
• When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.
• Reboot your computer into safe mode again

Run about:buster again following the same instructions as above, this time without the restart at the end

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

Now run SpSeHjfix. A log will be saved in the same folder that you put the exe into. Please post the results of that log in your next reply.

Now run CleanUp!. Click CleanUp and allow it to delete all the temporary files.Reboot your computer into normal windows.

Please run an on-line virus scan at Kaspersky OnLine Scan or if that doesnt work, you can use TrendMicro or BitDefender. (Please post the results of the scan(s) in your next reply)

After all that, please post back with how things went as well as the logs requested and a new HiJackThis log. Please do not reboot your computer after you submit your next log until instructed.

Good Luck

ScHwErV

[ocelot]

Hey,
thanks for your help again. Sorry for taking so long, but someone opened internet through Internet Explorer (which means he visited the search startpage) so I did some virus scans again.
My startpage is back to normal now, and I haven't had another Aurora popup yet. The most annoying problem is still that task manager won't open, though.
I did the TrendMicro scan, and it resulted in no trojans/spyware, just some vulnerabilities of Microsoft or so. If you want to see that report, please say so.

Here are the logs you asked for:

SpSeHjfix log:



(7-28-05 16:25:19) SPSeHjFix started v1.1.2
(7-28-05 16:25:19) OS: WinXP Service Pack 2 (5.1.2600)
(7-28-05 16:25:19) Language: nederlands
(7-28-05 16:25:19) Win-Path: C:\WINDOWS
(7-28-05 16:25:19) System-Path: C:\WINDOWS\System32
(7-28-05 16:25:19) Temp-Path: C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\
(7-28-05 16:25:22) Disinfection started
(7-28-05 16:25:22) Bad-Dll(IEP): c:\docume~1\lucasw~1\locals~1\temp\se.dll
(7-28-05 16:25:22) UBF: 4 - UBB: 0 - UBR: 29
(7-28-05 16:25:22) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(7-28-05 16:25:22) UBF: 4 - UBB: 0 - UBR: 28
(7-28-05 16:25:22) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\lucasw~1\locals~1\temp\se.dll/spage.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\lucasw~1\locals~1\temp\se.dll/spage.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(7-28-05 16:25:22) Stealth-String not found
(7-28-05 16:25:22) File added to delete: c:\docume~1\lucasw~1\locals~1\temp\se.dll
(7-28-05 16:25:22) Reboot


(7-28-05 17:13:29) SPSeHjFix started v1.1.2
(7-28-05 17:13:29) OS: WinXP Service Pack 2 (5.1.2600)
(7-28-05 17:13:29) Language: nederlands
(7-28-05 17:13:29) Win-Path: C:\WINDOWS
(7-28-05 17:13:29) System-Path: C:\WINDOWS\System32
(7-28-05 17:13:29) Temp-Path: C:\DOCUME~1\FRITSW~1\LOCALS~1\Temp\
(7-28-05 17:14:46) Disinfection started
(7-28-05 17:14:46) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:46) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:46) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:46) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\fritsw~1\locals~1\temp\se.dll/spage.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(7-28-05 17:14:46) Stealth-String not found
(7-28-05 17:14:46) No locked Files to delete. End without Reboot
(7-28-05 17:14:47) Disinfection started
(7-28-05 17:14:47) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:47) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:47) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:47) Bad IE-pages: (none)
(7-28-05 17:14:47) Stealth-String not found
(7-28-05 17:14:47) No locked Files to delete. End without Reboot
(7-28-05 17:14:49) Disinfection started
(7-28-05 17:14:49) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:49) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:49) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:49) Bad IE-pages: (none)
(7-28-05 17:14:49) Stealth-String not found
(7-28-05 17:14:49) No locked Files to delete. End without Reboot
(7-28-05 17:14:53) Disinfection started
(7-28-05 17:14:53) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:53) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:53) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:53) Bad IE-pages: (none)
(7-28-05 17:14:53) Stealth-String not found
(7-28-05 17:14:53) No locked Files to delete. End without Reboot
(7-28-05 17:14:55) Disinfection started
(7-28-05 17:14:55) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:55) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:55) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:55) Bad IE-pages: (none)
(7-28-05 17:14:55) Stealth-String not found
(7-28-05 17:14:55) No locked Files to delete. End without Reboot
(7-28-05 17:14:55) Disinfection started
(7-28-05 17:14:55) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:55) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:55) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:55) Bad IE-pages: (none)
(7-28-05 17:14:55) Stealth-String not found
(7-28-05 17:14:55) No locked Files to delete. End without Reboot
(7-28-05 17:14:55) Disinfection started
(7-28-05 17:14:55) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:55) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:55) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:55) Bad IE-pages: (none)
(7-28-05 17:14:55) Stealth-String not found
(7-28-05 17:14:55) No locked Files to delete. End without Reboot
(7-28-05 17:14:58) Disinfection started
(7-28-05 17:14:58) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:58) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:58) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:58) Bad IE-pages: (none)
(7-28-05 17:14:58) Stealth-String not found
(7-28-05 17:14:58) No locked Files to delete. End without Reboot
(7-28-05 17:14:58) Disinfection started
(7-28-05 17:14:58) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:58) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:58) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:58) Bad IE-pages: (none)
(7-28-05 17:14:58) Stealth-String not found
(7-28-05 17:14:58) No locked Files to delete. End without Reboot
(7-28-05 17:14:59) Disinfection started
(7-28-05 17:14:59) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:59) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:59) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:59) Bad IE-pages: (none)
(7-28-05 17:14:59) Stealth-String not found
(7-28-05 17:14:59) No locked Files to delete. End without Reboot
(7-28-05 17:14:59) Disinfection started
(7-28-05 17:14:59) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:59) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:59) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:59) Bad IE-pages: (none)
(7-28-05 17:14:59) Stealth-String not found
(7-28-05 17:14:59) No locked Files to delete. End without Reboot
(7-28-05 17:14:59) Disinfection started
(7-28-05 17:14:59) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:59) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:59) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:59) Bad IE-pages: (none)
(7-28-05 17:14:59) Stealth-String not found
(7-28-05 17:14:59) No locked Files to delete. End without Reboot
(7-28-05 17:14:59) Disinfection started
(7-28-05 17:14:59) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:14:59) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:59) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:14:59) Bad IE-pages: (none)
(7-28-05 17:14:59) Stealth-String not found
(7-28-05 17:14:59) No locked Files to delete. End without Reboot
(7-28-05 17:15:15) Disinfection started
(7-28-05 17:15:15) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) Bad IE-pages: (none)
(7-28-05 17:15:15) Stealth-String not found
(7-28-05 17:15:15) No locked Files to delete. End without Reboot
(7-28-05 17:15:15) Disinfection started
(7-28-05 17:15:15) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) Bad IE-pages: (none)
(7-28-05 17:15:15) Stealth-String not found
(7-28-05 17:15:15) No locked Files to delete. End without Reboot
(7-28-05 17:15:15) Disinfection started
(7-28-05 17:15:15) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) Bad IE-pages: (none)
(7-28-05 17:15:15) Stealth-String not found
(7-28-05 17:15:15) No locked Files to delete. End without Reboot
(7-28-05 17:15:15) Disinfection started
(7-28-05 17:15:15) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) Bad IE-pages: (none)
(7-28-05 17:15:15) Stealth-String not found
(7-28-05 17:15:15) No locked Files to delete. End without Reboot
(7-28-05 17:15:15) Disinfection started
(7-28-05 17:15:15) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) Bad IE-pages: (none)
(7-28-05 17:15:15) Stealth-String not found
(7-28-05 17:15:15) No locked Files to delete. End without Reboot
(7-28-05 17:15:15) Disinfection started
(7-28-05 17:15:15) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:15) Bad IE-pages: (none)
(7-28-05 17:15:15) Stealth-String not found
(7-28-05 17:15:15) No locked Files to delete. End without Reboot
(7-28-05 17:15:16) Disinfection started
(7-28-05 17:15:16) Bad-Dll(IEP): c:\docume~1\fritsw~1\locals~1\temp\se.dll
(7-28-05 17:15:16) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:16) UBF: 4 - UBB: 0 - UBR: 24
(7-28-05 17:15:16) Bad IE-pages: (none)
(7-28-05 17:15:16) Stealth-String not found
(7-28-05 17:15:16) No locked Files to delete. End without Reboot


(7-29-05 16:17:51) SPSeHjFix started v1.1.2
(7-29-05 16:17:51) OS: WinXP Service Pack 2 (5.1.2600)
(7-29-05 16:17:51) Language: nederlands
(7-29-05 16:17:51) Win-Path: C:\WINDOWS
(7-29-05 16:17:51) System-Path: C:\WINDOWS\System32
(7-29-05 16:17:51) Temp-Path: C:\DOCUME~1\LUCASW~1\LOCALS~1\Temp\
(7-29-05 16:17:52) Disinfection started
(7-29-05 16:17:52) Bad-Dll(IEP): (not found)
(7-29-05 16:17:52) Bad-Dll(IEP) in BHO: (not found)
(7-29-05 16:17:52) UBF: 4 - UBB: 0 - UBR: 28
(7-29-05 16:17:52) UBF: 4 - UBB: 0 - UBR: 28
(7-29-05 16:17:52) Bad IE-pages: (none)
(7-29-05 16:17:52) Stealth-String not found
(7-29-05 16:17:52) Not infected->END




HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 17:29:08, on 29-7-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.exe
c:\windows\system32\zgrfjw.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\6560.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lucas Woudstra\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {2C504918-55E1-B9BF-3461-B183CBF58396} - C:\DOCUME~1\LUCASW~1\APPLIC~1\COPYCR~1\DriveClock.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NetPumper] "C:\Program Files\NetPumper\NetPumperIEProxy.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Type Debug Rdr Store] C:\Documents and Settings\All Users\Application Data\intergreytypedebug\KeepVga.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\Run: [ondjip] c:\windows\system32\zgrfjw.exe r
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HitwarePKLite] C:\Program Files\Hitware Popup Killer Lite\HitwarePKLite.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Apwheel] C:\WINDOWS\System32\6560.exe
O4 - HKCU\..\Run: [Cmt101] c:\windows\system32\cmt101.exe
O4 - HKCU\..\Run: [Msmon] c:\windows\system32\msmon.exe
O4 - HKCU\..\Run: [debug plus] C:\DOCUME~1\LUCASW~1\APPLIC~1\GRIMBI~1\hole dead.exe
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\symcsvc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
O9 - Extra button: Microsoft® JavaScript® Console - {19F17D7C-654C-49B5-B162-49D6A9157D82} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {52FAA6BF-7EC8-4B05-A458-21F7BD6D7491} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\PLUGINS\NPFinale.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://nl.browserupd...01/nliq0001.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c18.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://rimmel.ai-med...ve/makeover.cab
O16 - DPF: {225CDD95-6F20-4DE4-8680-4F8F14882229} (NDiamonds Class) - http://hosting0.game...ll/diamonds.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webca...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab32846.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom....gamesplayer.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...1/Installer.exe
O16 - DPF: {D27CDB6E-0000-0000-0000-000000000000} - https://download.mac...ash/swflash.cab
O16 - DPF: {E1E0FB30-7830-4DC2-8443-0EAB9695A421} (BaseRunner Class) - http://82.168.191.52/WebGuard.cab
O16 - DPF: {E3E34A32-3A6A-47CC-B4E3-B8B86715D388} (MBoom Class) - http://hosting0.game...in/dll/boom.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot....ownload/kdx.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E04CD814-9982-4A39-B1FE-4BC7218F9294}: NameServer = 194.134.5.5 194.134.0.97
O21 - SSODL: Adobe Acrobat 5.0 - {55E57B4A-1389-C49F-BC70-7C2A6736D7AF} - c:\program files\common files\adobe\acrobat 5.0\nt\winfcbsgv32.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe




Thanks for helping

[ScHwErV]

We still have some work to do.

Right click Here and select Save As to download WinHelp2002's DelDomains.inf. Please save the file somewhere you can find it like on the desktop. To run the inf file, right click on it and select Install.

Then reboot.

This next part will be quite important. I am going to try to tell you how to read enough of your HiJackThis log to get rid of the aurora infection.

O4 - HKLM\..\Run: [ondjip] c:\windows\system32\zgrfjw.exe r

This is the entry that keeps reinstalling aurora. It changes every time you reboot your computer. It is a random name but you can always tell it by the r after the entry.

In this instance, you would use killbox and check Delete on Reboot for this file.

c:\windows\system32\zgrfjw.exe

You would also need to get

C:\WINDOWS\Nail.exe

This file will not change.

So here is how it will go. open HiJackThis. Find the file name. Put the 2 file names in killbox and tell it to kill them both on reboot. Then Fix the entries in HiJackThis and then reboot.

If this is too confusing what I will need you to do is submit a new HiJackThis log. Do no reboot your computer until after you hear back from me. That way the file name will be the same and we can get it.

ScHwErV

[ocelot]

Hey ScHwErV,
thanks for your help once again
I did what u told me to, now when I started up my pc I got an error about Windows not being able to find Nail.exe, which is good I think.
I did another HijackThis scan and found that the F2 entry of Nail.exe and the O4 entry with the random filename are still there.

Here is my new HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 15:57:10, on 31-7-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.exe
c:\windows\system32\ilaeqqw.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\6560.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Lucas Woudstra\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 127.0.0.3 n-glx.s-redirect.com
O1 - Hosts: 127.0.0.3 x.full-tgp.net
O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
O1 - Hosts: 127.0.0.3 autoescrowpay.com
O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 buldog-stats.com
O1 - Hosts: 127.0.0.3 www.buldog-stats.com
O1 - Hosts: 127.0.0.3 fregat.drocherway.com
O1 - Hosts: 127.0.0.3 slutmania.biz
O1 - Hosts: 127.0.0.3 www.slutmania.biz
O1 - Hosts: 127.0.0.3 toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.megapornix.com
O1 - Hosts: 127.0.0.3 megapornix.com
O1 - Hosts: 127.0.0.3 www.sp2[bleep]ed.biz
O1 - Hosts: 127.0.0.3 sp2[bleep]ed.biz
O1 - Hosts: 127.0.0.3 greg-tut.com
O1 - Hosts: 127.0.0.3 www.greg-tut.com
O1 - Hosts: 127.0.0.3 nylonsexy.com
O1 - Hosts: 127.0.0.3 www.nylonsexy.com
O1 - Hosts: 127.0.0.3 vparivalka.com
O1 - Hosts: 127.0.0.3 www.vparivalka.com
O1 - Hosts: 127.0.0.3 iframeprofit.com
O1 - Hosts: 127.0.0.3 www.iframeprofit.com
O1 - Hosts: 127.0.0.3 topsearch10.com
O1 - Hosts: 127.0.0.3 www.topsearch10.com
O1 - Hosts: 127.0.0.3 statscash.biz
O1 - Hosts: 127.0.0.3 www.statscash.biz
O1 - Hosts: 127.0.0.3 vxiframe.biz
O1 - Hosts: 127.0.0.3 www.vxiframe.biz
O1 - Hosts: 127.0.0.3 crazy-toolbar.com
O1 - Hosts: 127.0.0.3 www.crazy-toolbar.com
O1 - Hosts: 127.0.0.3 topcash.biz
O1 - Hosts: 127.0.0.3 www.topcash.biz
O1 - Hosts: 127.0.0.3 loadcash.biz
O1 - Hosts: 127.0.0.3 www.loadcash.biz
O1 - Hosts: 127.0.0.3 txiframe.biz
O1 - Hosts: 127.0.0.3 www.txiframe.biz
O1 - Hosts: 127.0.0.3 procounter.biz
O1 - Hosts: 127.0.0.3 www.procounter.biz
O1 - Hosts: 127.0.0.3 advadmin.biz
O1 - Hosts: 127.0.0.3 www.advadmin.biz
O1 - Hosts: 127.0.0.3 trafficbest.net
O1 - Hosts: 127.0.0.3 www.trafficbest.net
O1 - Hosts: 127.0.0.3 besthvac.com
O1 - Hosts: 127.0.0.3 www.besthvac.com
O2 - BHO: (no name) - {2C504918-55E1-B9BF-3461-B183CBF58396} - C:\DOCUME~1\LUCASW~1\APPLIC~1\COPYCR~1\DriveClock.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NetPumper] "C:\Program Files\NetPumper\NetPumperIEProxy.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Type Debug Rdr Store] C:\Documents and Settings\All Users\Application Data\intergreytypedebug\KeepVga.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\Run: [siufik] c:\windows\system32\ilaeqqw.exe r
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HitwarePKLite] C:\Program Files\Hitware Popup Killer Lite\HitwarePKLite.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Apwheel] C:\WINDOWS\System32\6560.exe
O4 - HKCU\..\Run: [Cmt101] c:\windows\system32\cmt101.exe
O4 - HKCU\..\Run: [Msmon] c:\windows\system32\msmon.exe
O4 - HKCU\..\Run: [debug plus] C:\DOCUME~1\LUCASW~1\APPLIC~1\GRIMBI~1\hole dead.exe
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\symcsvc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
O9 - Extra button: Microsoft® JavaScript® Console - {19F17D7C-654C-49B5-B162-49D6A9157D82} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {52FAA6BF-7EC8-4B05-A458-21F7BD6D7491} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\PLUGINS\NPFinale.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://nl.browserupd...01/nliq0001.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c18.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://rimmel.ai-med...ve/makeover.cab
O16 - DPF: {225CDD95-6F20-4DE4-8680-4F8F14882229} (NDiamonds Class) - http://hosting0.game...ll/diamonds.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webca...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab32846.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom....gamesplayer.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...1/Installer.exe
O16 - DPF: {D27CDB6E-0000-0000-0000-000000000000} - https://download.mac...ash/swflash.cab
O16 - DPF: {E1E0FB30-7830-4DC2-8443-0EAB9695A421} (BaseRunner Class) - http://82.168.191.52/WebGuard.cab
O16 - DPF: {E3E34A32-3A6A-47CC-B4E3-B8B86715D388} (MBoom Class) - http://hosting0.game...in/dll/boom.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot....ownload/kdx.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E04CD814-9982-4A39-B1FE-4BC7218F9294}: NameServer = 194.134.5.5 194.134.0.97
O21 - SSODL: Adobe Acrobat 5.0 - {55E57B4A-1389-C49F-BC70-7C2A6736D7AF} - c:\program files\common files\adobe\acrobat 5.0\nt\winfcbsgv32.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe


Thanks for your help

[ScHwErV]

Actually, that error is a good thing!

lets go after it again.

Download the Hoster.

• Unzip Hoster to a convenient folder such as C:\Hoster.
• Run Hoster.exe from its new home
• Click "Make Hosts Writable?" in the upper right corner (If available).
• Click Restore Original Hosts and then click OK.
• Click the X to exit the program.
• Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [NetPumper] "C:\Program Files\NetPumper\NetPumperIEProxy.exe"
O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Type Debug Rdr Store] C:\Documents and Settings\All Users\Application Data\intergreytypedebug\KeepVga.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\Run: [siufik] c:\windows\system32\ilaeqqw.exe r
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [Cmt101] c:\windows\system32\cmt101.exe
O4 - HKCU\..\Run: [Msmon] c:\windows\system32\msmon.exe
O4 - HKCU\..\Run: [debug plus] C:\DOCUME~1\LUCASW~1\APPLIC~1\GRIMBI~1\hole dead.exe
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\symcsvc.exe
O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c18.cab

Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Please remove these entries from Add/Remove Programs in the Control Panel(if present):

NetPumper
ISRVS

Please note any other programs that you dont recognize in that list in your next response

Please delete these folders using Windows Explorer(if present):

C:\WINDOWS\isrvs\
C:\Program Files\NetPumper\
C:\Documents and Settings\All Users\Application Data\intergreytypedebug\

Folders and files with a tilde (~), means that there is a file/folder that starts with the six characters in front of the tilde, note that there may be spaces in the name. If there are more than one, please report them back and do not delete!


C:\DOCUME~1\LUCASW~1\APPLIC~1\GRIMBI~1\

Please delete these files using Windows Explorer(if present):

C:\WINDOWS\ewupdater.exe
C:\WINDOWS\System32\kernels32.exe
C:\WINDOWS\System\svchost.exe
c:\windows\system32\ilaeqqw.exe
c:\windows\system32\cmt101.exe
c:\windows\system32\msmon.exe
C:\WINDOWS\System32\symcsvc.exe

After that, Reboot.

After that, report back with any files that you couldnt find. Also a new HiJackThis log and a second log from HiJackThis.

Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.

ScHwErV

[ocelot]

Hey,
thanks for your help
In the Add/Remove Programs manager I couldn't find ISRVS.
You can find the rest of the programs in the uninstall_list.txt on the bottom of my post.
I don't really understand the part with the tilde files.
I see C:\DOCUME~1\LUCASW~1\APPLIC~1\GRIMBI~1\ as C:\Documents and Settings\Lucas Woudstra\Application Data\grim bike\
Also, I couldn't find any of these files:

C:\WINDOWS\ewupdater.exe
C:\WINDOWS\System32\kernels32.exe
C:\WINDOWS\System\svchost.exe
c:\windows\system32\ilaeqqw.exe
c:\windows\system32\cmt101.exe
c:\windows\system32\msmon.exe
C:\WINDOWS\System32\symcsvc.exe

That I couldn't find c:\windows\system32\ilaeqqw.exe, is something I think I understand. Because I rebooted, the filename change again. So I did a HijackThis scan and saw that the filename had changed to raidzr.exe. I tried to delete it but wasn't able to because it was in use.
By the way, I saw a svchost.exe file in C:\WINDOWS\System32 (not in C:\WINDOWS\System).




Here is my HijackThis log:


Logfile of HijackThis v1.99.1
Scan saved at 16:57:31, on 1-8-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.exe
c:\windows\system32\mnugbw.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\6560.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Microsoft Works\WksWP.exe
C:\Program Files\Microsoft Works\MSWorks.exe
C:\Program Files\Microsoft Works\wkgdcach.exe
C:\Documents and Settings\Lucas Woudstra\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {2C504918-55E1-B9BF-3461-B183CBF58396} - C:\DOCUME~1\LUCASW~1\APPLIC~1\COPYCR~1\DriveClock.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [hppwrsav] C:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [pddayn] c:\windows\system32\mnugbw.exe r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HitwarePKLite] C:\Program Files\Hitware Popup Killer Lite\HitwarePKLite.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Apwheel] C:\WINDOWS\System32\6560.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Microsoft® JavaScript® Console - {19F17D7C-654C-49B5-B162-49D6A9157D82} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {346604B3-D095-4BC5-B550-F2BBE7C32A2B} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {4814E8D5-D34A-41FF-A541-CA4348B356ED} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {52FAA6BF-7EC8-4B05-A458-21F7BD6D7491} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft® JavaScript® Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {C1C5B390-7677-4EDB-BBFF-8E16F9CCBE2E} - C:\WINDOWS\SYSTEM32\comdlg32.ocx (HKCU)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\PLUGINS\NPFinale.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://nl.browserupd...01/nliq0001.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://rimmel.ai-med...ve/makeover.cab
O16 - DPF: {225CDD95-6F20-4DE4-8680-4F8F14882229} (NDiamonds Class) - http://hosting0.game...ll/diamonds.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://activex.webca...sCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab32846.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom....gamesplayer.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...1/Installer.exe
O16 - DPF: {D27CDB6E-0000-0000-0000-000000000000} - https://download.mac...ash/swflash.cab
O16 - DPF: {E1E0FB30-7830-4DC2-8443-0EAB9695A421} (BaseRunner Class) - http://82.168.191.52/WebGuard.cab
O16 - DPF: {E3E34A32-3A6A-47CC-B4E3-B8B86715D388} (MBoom Class) - http://hosting0.game...in/dll/boom.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot....ownload/kdx.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E04CD814-9982-4A39-B1FE-4BC7218F9294}: NameServer = 194.134.5.5 194.134.0.97
O21 - SSODL: Adobe Acrobat 5.0 - {55E57B4A-1389-C49F-BC70-7C2A6736D7AF} - c:\program files\common files\adobe\acrobat 5.0\nt\winfcbsgv32.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe



Here is my uninstall_list.txt file:


3ds max 4
AC3Filter (remove only)
Ad-Aware SE Personal
Adobe Acrobat 4.0, 5.0
Adobe Illustrator CS
Adobe Photoshop 7.0
Adobe Premiere 6.0
Adobe Premiere Pro
Adobe SVG Viewer 3.0
Advanced RealMedia Export Plug-in for Premiere 6.0
Ahead Nero Burning ROM
Alcatel SpeedTouch USB Software
AntiVir/XP
Apophysis
BCM V.92 56K Modem
BitTorrent 4.0.3
CCleaner (remove only)
Classic PhoneTools
Cleaner 5 EZ
CleanUp!
Coiffeur
Core FTP Lite 1.3
de Volkskrant Nieuwsklikker (remove only)
Dell Picture Studio - Dell Image Expert
Dell Solution Center
DiamondCS TDS-3
DivX Codec
Doorzien
DVDSentry
Easy CD Creator 5 Basic
EDUROM Geschiedenis voor de basisvorming
Encarta 99 Encyclopedie
EPN werkboek-i getal en ruimte/1 havo-vwo 1
EPN werkboek-i Getal en Ruimte/vwo AB dl 1 en 2
ewido security suite
ffdshow (remove only)
Final Fantasy VII - Ultima Edition
Finale NotePad
GameSpy Arcade
HammerHead Rhythm Station
Heroes Chronicles: Clash of the Dragons
Heroes Chronicles: Warlords of the Wasteland
Heroes of Might and Magic® III
HijackThis 1.99.1
Hotfix voor DirectX 9 - KB839643
Hotfix voor Windows Media Player [zie wm828026 voor meer informatie]
HP PrecisionScan LT-software
idrop
Intel® PRO Network Adapters and Drivers
Intel® PROSet
InterActual Player
Italy Minutes
Jasc Paint Shop Pro 8
Kaspersky Anti-Virus Web Scanner
KaZaA Lite v2.1.0 [K++ Edition]
Kazaa Media Desktop 2.5
Lexmark Supplies Monitor
Lexmark Z25-Z35
Little Fighter 2 v1.9
LiveUpdate 1.90 (Symantec Corporation)
Macromedia Dreamweaver 4
Macromedia Extension Manager
Macromedia Flash 5
Macromedia Flash MX 2004
Macromedia Shockwave Player
Matroska Pack - Lazy Man's MKV 0.9.7
Maxon Cinema 4D XL incl. BodyPaint 3D v7.20 Multilanguage
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Data Access Components KB870669
Microsoft Works 7.0
mIRC
Modem Helper
MOXYVCUP
MSI MS-551X MEGA STICK
MSN Gaming Zone
MSN Messenger 7.0
MSN Toolbar
NVIDIA Display Driver
NVIDIA Windows 2000/XP Display Drivers
P2P Networking
Paint Shop Pro 7
PCFriendly
PowerDVD
Quake III Arena
QuickTime
RealPlayer
RichFX Player
Secure Delivery
Shockwave
Spybot - Search & Destroy 1.3
The ABI Network- A Division of Direct Revenue
Tony Hawk's Pro Skater 3®
Total Annihilation
VU Grafiek Leerling
VU Leerling Bovenbouw EPN
WinAce Archiver 2.0
Windows Media Format Runtime
Windows SA
Windows XP Hotfix - KB823182
Windows XP Hotfix - KB824105
Windows XP Hotfix - KB824141
Windows XP Hotfix - KB825119
Windows XP Hotfix - KB826939
Windows XP Hotfix - KB828028
Windows XP Hotfix - KB828035
Windows XP Hotfix - KB828741
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB837001
Windows XP Hotfix - KB839645
Windows XP Hotfix - KB840315
Windows XP Hotfix - KB840374
Windows XP Hotfix - KB840987
Windows XP Hotfix - KB841873
Windows XP Hotfix - KB842773
Windows XP Service Pack 2
WindowsBC
WinISO 5.3
WinMX
WinRAR archiver
XviD MPEG-4 Video Codec
Yahoo! Companion
Zylom Games Player Plugin


Thanks for the help

[ScHwErV]

Ok, the first thing we need to do is uninstall some programs.

Please reboot into safe mode and uninstall these from add/remove programs in the control panel.

P2P Networking
Kazaa Media Desktop
The ABI Network- A Division of Direct Revenue

If any of them ask you to reboot afterwards or connect to the internet, tell them no.

While still in safe mode, run HiJackThis and find that random entry. You should be able to delete it in safe mode. You might have to show hidden files.

Reconfigure Windows XP to show hidden files:
Click Start. Open My Computer.
Select the Tools menu and click Folder Options. Select the View Tab.

Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.

While you have hidden files shown, you might take a peek around and see if you can find those other files that you couldnt find previously.

While still in safe mode, please run Ewido again and allow it to fix everything it finds.

Then reboot and lets see a new HiJackThis log.

[ocelot]

thanks for your help, but I will be on vacation for the next 3 weeks so don't expect a reply from me soon
So I'll follow up your help then and post the results...
thanks

[ScHwErV]

To keep things tidy, after 2 weeks the forum closes the threads. When you come back, just send me a PM and Ill re-open your thread and we can continue.

Have fun on your break.

ScHwErV

[ScHwErV]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.