[fradenrem]

Please help me!

AVG shows the message "Threat Detected! While opening file: C:\WINDOWS\system32\dmdlg.dll Trojan horse Generic9.AATD" everytime i open a browser-window (e.g. windows explorer or the internet explorer)
I have tried a lot of virus removel programs but they don"t wordk because they can not open the file (dmdlg.dll). I also tried it in protected mode but without succes.

What can i do?. Following is a Deckard's System Scanner an a highjackthis.log.

Deckard's System Scanner v20071014.68
Run by Ikzelf on 2008-02-01 20:07:25
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------



-- Last 5 Restore Point(s) --
96: 2008-02-01 19:02:14 UTC - RP777 - Deckard's System Scanner Restore Point
95: 2008-01-31 20:56:54 UTC - RP776 - Controlepunt van systeem
94: 2008-01-30 19:52:21 UTC - RP775 - Controlepunt van systeem
93: 2008-01-29 19:17:59 UTC - RP774 - Controlepunt van systeem
92: 2008-01-28 19:17:00 UTC - RP773 - Controlepunt van systeem


-- First Restore Point --
1: 2007-11-03 22:04:56 UTC - RP682 - Controlepunt van systeem


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Ikzelf.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:11:31, on 1-2-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
D:\Downloads\dss.exe
D:\DOWNLO~1\Ikzelf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.home.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {BEE01155-E078-4BD4-9D13-B9F626CFE2CE} - C:\WINDOWS\system32\dmdlg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe] C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe
O4 - HKLM\..\Run: [C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe] C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Program Files\Privacy Mantra 2.02\privacymantra.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Search - http://kn.bar.need2f...earch.html?p=KN
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://cache.hyves.n...ageUploader.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn....easeInstall.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 11176 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 tcvtcncy - c:\windows\system32\drivers\fzzfysxv.dat
R2 ElbyCDIO (ElbyCDIO Driver) - c:\windows\system32\drivers\elbycdio.sys <Not Verified; Elaborate Bytes AG; CDRTools>
R3 Afc (PPdus ASPI Shell) - c:\windows\system32\drivers\afc.sys <Not Verified; Arcsoft, Inc.; Arcsoft® ASPI Shell>
R3 ElbyCDFL - c:\windows\system32\drivers\elbycdfl.sys <Not Verified; SlySoft, Inc.; CloneCD>
R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus® ASPI Shell>
R3 RT25USBAP (Nintendo Wi-Fi USB Connector Service) - c:\windows\system32\drivers\rt25usbap.sys <Not Verified; Ralink Technology Inc.; Ralink 802.11g Wireless USB Adapters>

S2 npkcrypt - c:\program files\triglowpictures\pristontale\npkcrypt.sys (file missing)
S3 CardReaderFilter (Card Reader Filter) - c:\windows\system32\drivers\usbcrft.sys <Not Verified; ICSI Technology Ltd.; USB Card Reader and FlashDisk>
S3 EagleNT - c:\windows\system32\drivers\eaglent.sys (file missing)
S3 IIUSBISP (USB Mass Storage for USB ISP) - c:\windows\system32\drivers\iiusbisp.sys (file missing)
S3 npkcusb - c:\program files\triglowpictures\pristontale\npkcusb.sys (file missing)
S3 ovt530 (Webcam Classic) - c:\windows\system32\drivers\ov530vid.sys <Not Verified; OmniVision Technologies, Inc.; Dual Mode USB Camera 530>
S3 SoC PC-Camera Service (CANYON CN-WCAM21 PC-Camera) - c:\windows\system32\drivers\pfc027.sys (file missing)
S3 wandrv (WAN Network Driver) - c:\windows\system32\drivers\wandrv.sys <Not Verified; America Online, Inc.; WAN Network Driver>
S3 XDva002 - c:\windows\system32\xdva002.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Autodata Limited License Service - "c:\program files\common files\autodata limited shared\service\adcdlicsvc.exe"
R2 LogWatch (Event Log Watch) - c:\program files\ca\sharedcomponents\ca_lic\logwatnt.exe <Not Verified; Computer Associates; Computer Associates LogWatNT>
R3 x10nets (X10 Device Network Service) - c:\progra~1\common~1\x10\common\x10nets.exe <Not Verified; X10; x10 Module>

S3 CA_LIC_CLNT (CA License Client) - c:\program files\ca\sharedcomponents\ca_lic\lic98rmt.exe <Not Verified; Computer Associates; Computer Associates lic98rmt>
S3 CA_LIC_SRVR (CA License Server) - c:\program files\ca\sharedcomponents\ca_lic\lic98rmtd.exe <Not Verified; Computer Associates; Computer Associates lic98rmtd>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2008-01-01 and 2008-02-01 -----------------------------

2008-01-28 19:19:54 0 dr-h----- C:\$VAULT$.AVG
2008-01-27 16:40:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-27 15:31:01 0 d-------- C:\Program Files\kav
2008-01-27 14:54:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-27 14:54:53 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-26 11:00:12 0 d-------- C:\Program Files\Eclipse
2008-01-21 20:44:00 65912 --a------ C:\nerodigital.bin
2008-01-20 08:39:39 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-01-19 16:16:32 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-19 16:16:11 0 d-------- C:\Program Files\Spyware Doctor
2008-01-19 16:16:11 0 d-------- C:\Documents and Settings\Ikzelf\Application Data\PC Tools
2008-01-18 21:18:37 0 d-------- C:\rpt
2008-01-11 19:37:54 0 d-------- C:\Documents and Settings\Ikzelf\workspace
2008-01-11 19:34:34 0 d-------- C:\Documents and Settings\Ikzelf\.eclipse
2008-01-11 13:17:30 64000 --a------ C:\WINDOWS\system32\gzmrt.dll
2008-01-08 23:26:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-08 21:48:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-01-08 21:48:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2008-01-08 21:48:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\Help
2008-01-08 21:48:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\CyberLink
2008-01-08 21:48:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\Ahead
2008-01-08 21:48:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2008-01-08 21:48:38 0 dr------- C:\Documents and Settings\Administrator\Favorieten
2008-01-08 21:48:38 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-01-08 21:48:38 0 d-------- C:\Documents and Settings\Administrator\Bureaublad
2008-01-08 21:48:38 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-01-08 21:48:38 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2008-01-08 21:48:38 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
2008-01-08 21:48:38 0 d-------- C:\Documents and Settings\Administrator\Application Data\Musicmatch
2008-01-08 21:48:38 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-01-08 21:48:37 0 d---s---- C:\Documents and Settings\Administrator\UserData
2008-01-08 21:48:37 0 d--h----- C:\Documents and Settings\Administrator\Sjablonen
2008-01-08 21:48:37 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-01-08 21:48:37 0 dr-h----- C:\Documents and Settings\Administrator\Onlangs geopend
2008-01-08 21:48:37 0 d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving
2008-01-08 21:48:37 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-01-08 21:48:37 0 dr------- C:\Documents and Settings\Administrator\Mijn documenten
2008-01-08 21:48:37 0 dr------- C:\Documents and Settings\Administrator\Menu Start
2008-01-08 21:48:37 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-01-08 21:48:35 2031616 --a------ C:\Documents and Settings\Administrator\NTUSER.DAT
2008-01-08 21:48:29 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot


-- Find3M Report ---------------------------------------------------------------

2008-02-01 20:06:40 0 d-------- C:\Program Files\SPAMfighter
2008-02-01 20:05:34 0 d-------- C:\Program Files\SP2 Connection Patcher
2008-02-01 09:41:01 0 d-------- C:\Documents and Settings\Ikzelf\Application Data\AVG7
2008-01-31 20:45:58 0 d-------- C:\Program Files\Morpheus
2008-01-30 00:46:17 0 d-------- C:\Documents and Settings\Ikzelf\Application Data\Canon
2008-01-27 03:36:39 0 d-------- C:\Program Files\PlayMP3z
2008-01-27 02:57:24 0 d-------- C:\Program Files\ContextTool
2008-01-26 10:28:50 0 d-------- C:\Program Files\BearFlix
2008-01-23 18:40:55 0 d-------- C:\Program Files\eMule
2008-01-20 08:39:38 1100 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-01-19 21:41:56 0 d-------- C:\Documents and Settings\Ikzelf\Application Data\Azureus
2008-01-19 16:17:30 437696 --a------ C:\WINDOWS\system32\perfh013.dat
2008-01-19 16:17:30 68206 --a------ C:\WINDOWS\system32\perfc013.dat
2008-01-12 11:49:36 0 d-------- C:\Program Files\Java
2008-01-11 18:01:02 40737 --a------ C:\WINDOWS\system32\rightonadz-uninst.exe
2008-01-06 00:51:46 0 d-------- C:\Program Files\MSN Messenger
2008-01-06 00:51:00 0 d-------- C:\Program Files\Zylom Games
2008-01-03 17:27:38 0 d-------- C:\Program Files\Spellen
2007-12-30 10:59:23 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-29 00:33:56 0 d-------- C:\Program Files\Lavasoft
2007-12-29 00:33:07 0 d-------- C:\Program Files\Common Files
2007-12-29 00:33:07 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-29 00:32:31 0 d-------- C:\Program Files\BearShare
2007-12-28 23:53:34 0 d-------- C:\Program Files\RogueRemover FREE
2007-12-28 21:47:54 0 d-------- C:\Program Files\Hitman Pro
2007-12-20 18:11:52 0 d-------- C:\Program Files\Common Files\Ankiro
2007-12-20 18:11:29 0 d-------- C:\Program Files\Common Files\Application
2007-12-20 17:42:56 0 d-------- C:\Program Files\Windows Media Connect 2
2007-12-20 17:36:12 0 d-------- C:\Program Files\Windows Media Connect
2007-12-13 21:42:43 0 d-------- C:\Program Files\LimeWire
2007-12-08 21:14:56 0 d-------- C:\Program Files\Azureus


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BEE01155-E078-4BD4-9D13-B9F626CFE2CE}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"AGRSMMSG"="AGRSMMSG.exe" [08-10-2004 10:50 C:\WINDOWS\AGRSMMSG.exe]
"PCMService"="C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" [08-10-2004 17:14]
"Dit"="Dit.exe" [20-07-2004 18:18 C:\WINDOWS\Dit.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09-07-2001 10:50]
"CHotkey"="mHotkey.exe" [24-02-2004 13:05 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [03-02-2004 16:15 C:\WINDOWS\CNYHKey.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [24-11-2004 20:10]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [08-05-2003 11:00]
"CloneCDTray"="C:\Program Files\CloneCD\CloneCDTray.exe" [19-05-2005 14:47]
"C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe"="C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe" []
"C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe"="C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe" []
"BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" []
"SPAMfighter Agent"="C:\Program Files\SPAMfighter\SFAgent.exe" [02-01-2008 17:03]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25-09-2007 01:11]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [27-01-2008 16:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [24-09-2004 16:22]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30-03-2006 16:45]
"SP2 Connection Patcher"="C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" [11-07-2005 12:51]
"com.codeode.privacymantra"="C:\Program Files\Privacy Mantra 2.02\privacymantra.exe" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [18-06-2007 16:49]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [02-11-2006 22:53]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23-9-2005 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [17-2-1999 20:05:56]
Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [1-9-2007 13:53:15]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fd73552-5fef-11d9-b978-000c76adb985}]
AutoRun\command- @%systemroot%\explorer.exe /e,.




-- End of Deckard's System Scanner: finished at 2008-02-01 20:12:28 ------------


=======================================================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:33:32, on 30-1-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
D:\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.home.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {BEE01155-E078-4BD4-9D13-B9F626CFE2CE} - C:\WINDOWS\system32\dmdlg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe] C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe
O4 - HKLM\..\Run: [C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe] C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Program Files\Privacy Mantra 2.02\privacymantra.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Search - http://kn.bar.need2f...earch.html?p=KN
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://cache.hyves.n...ageUploader.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn....easeInstall.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 11254 bytes

Edited by fradenrem, 01 February 2008 - 01:14 PM.

[Advertisements]

Hello

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

[Rorschach112]

Hello

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

[fradenrem]

Hello, i am very gratefull for your help.

Here's are the combofix and the highjackthis reports

ComboFix 08-02.03.1 - Ikzelf 2008-02-02 21:29:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.484 [GMT 1:00]
Gestart vanuit: D:\Downloads\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Ikzelf\Application Data\SpyGuardPro
C:\Documents and Settings\Ikzelf\Application Data\SpyGuardPro\avtasks.dat
C:\Documents and Settings\Ikzelf\Application Data\SpyGuardPro\Logs\av.log
C:\Documents and Settings\Ikzelf\Application Data\SpyGuardPro\Logs\ga6Support.log
C:\Documents and Settings\Ikzelf\Application Data\SpyGuardPro\Logs\update.log
C:\Documents and Settings\Ikzelf\Application Data\SpyGuardPro\PGE.dat
C:\Documents and Settings\Ikzelf\ResErrors.log
C:\Program Files\ContextTool
C:\Program Files\ContextTool\pcre3.dll
C:\Program Files\ContextTool\uninstall.exe
C:\Program Files\SpyGuardPro
C:\Program Files\SpyGuardPro\history.db
C:\WINDOWS\system32\gzmrt.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-01-02 to 2008-02-02 ))))))))))))))))))))))))))))))
.

2008-01-27 16:40 . 2008-01-27 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-27 16:25 . 2008-01-27 16:25 <DIR> d-------- C:\Deckard
2008-01-27 15:55 . 2008-01-27 15:55 84 --ahs---- C:\WINDOWS\klif.spi
2008-01-27 15:31 . 2008-01-27 16:38 <DIR> d-------- C:\Program Files\kav
2008-01-27 14:54 . 2008-01-27 14:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-27 14:54 . 2008-01-27 16:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-26 16:03 . 2008-01-27 11:18 <DIR> d-------- C:\Program Files\ESET
2008-01-26 11:00 . 2008-01-26 11:05 <DIR> d-------- C:\Program Files\Eclipse
2008-01-23 20:51 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2008-01-23 20:51 . 2004-08-03 22:31 20,992 --a--c--- C:\WINDOWS\system32\dllcache\rtl8139.sys
2008-01-21 20:44 . 2008-01-21 20:44 65,912 --a------ C:\nerodigital.bin
2008-01-20 08:39 . 2008-01-20 08:39 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-01-19 16:16 . 2008-01-19 16:17 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-01-19 16:16 . 2008-01-19 16:16 <DIR> d-------- C:\Documents and Settings\Ikzelf\Application Data\PC Tools
2008-01-19 16:16 . 2008-01-19 21:31 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-19 16:16 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-19 16:16 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-19 16:16 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-19 16:16 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-01-18 21:18 . 2008-01-19 10:01 <DIR> d-------- C:\rpt
2008-01-12 11:49 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-11 19:37 . 2008-01-26 12:56 <DIR> d-------- C:\Documents and Settings\Ikzelf\workspace
2008-01-11 19:34 . 2008-01-11 19:38 <DIR> d-------- C:\Documents and Settings\Ikzelf\.eclipse
2008-01-08 23:26 . 2008-01-27 15:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-08 21:48 . 2008-01-08 21:48 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-01-08 21:48 . 2004-06-24 15:36 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-01-08 21:48 . 2004-11-08 11:42 <DIR> d--h----- C:\Documents and Settings\Administrator\Sjablonen
2008-01-08 21:48 . 2008-01-08 23:25 <DIR> dr-h----- C:\Documents and Settings\Administrator\Onlangs geopend
2008-01-08 21:48 . 2004-06-24 14:53 <DIR> d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving
2008-01-08 21:48 . 2005-03-29 17:07 <DIR> dr------- C:\Documents and Settings\Administrator\Mijn documenten
2008-01-08 21:48 . 2004-06-24 14:53 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-01-08 21:48 . 2004-11-30 14:27 <DIR> dr------- C:\Documents and Settings\Administrator\Favorieten
2008-01-08 21:48 . 2008-01-27 16:40 <DIR> d-------- C:\Documents and Settings\Administrator\Bureaublad
2008-01-08 21:48 . 2005-03-29 15:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Musicmatch
2008-01-08 21:48 . 2004-11-29 17:11 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\CyberLink
2008-01-08 21:48 . 2004-08-17 17:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Ahead

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 10:20 --------- d-----w C:\Documents and Settings\Ikzelf\Application Data\AVG7
2008-02-02 10:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-02 10:13 --------- d-----w C:\Program Files\SPAMfighter
2008-02-02 10:12 17,408 ----a-w C:\WINDOWS\system32\drivers\USBCRFT.SYS
2008-02-02 10:12 --------- d-----w C:\Program Files\SP2 Connection Patcher
2008-02-01 22:14 --------- d-----w C:\Program Files\eMule
2008-01-31 19:45 --------- d-----w C:\Program Files\Morpheus
2008-01-29 23:46 --------- d-----w C:\Documents and Settings\Ikzelf\Application Data\Canon
2008-01-27 02:36 --------- d-----w C:\Program Files\PlayMP3z
2008-01-26 09:28 --------- d-----w C:\Program Files\BearFlix
2008-01-19 20:41 --------- d-----w C:\Documents and Settings\Ikzelf\Application Data\Azureus
2008-01-12 10:49 --------- d-----w C:\Program Files\Java
2008-01-11 17:01 40,737 ----a-w C:\WINDOWS\system32\rightonadz-uninst.exe
2008-01-08 20:45 360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-01-05 23:51 --------- d-----w C:\Program Files\Zylom Games
2008-01-05 23:51 --------- d-----w C:\Program Files\MSN Messenger
2008-01-03 16:27 --------- d-----w C:\Program Files\Spellen
2007-12-30 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-28 23:33 --------- d-----w C:\Program Files\Lavasoft
2007-12-28 23:33 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-28 23:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-28 23:32 --------- d-----w C:\Program Files\BearShare
2007-12-28 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-28 22:56 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2007-12-28 22:53 --------- d-----w C:\Program Files\RogueRemover FREE
2007-12-28 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com
2007-12-28 20:54 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-28 20:47 --------- d-----w C:\Program Files\Hitman Pro
2007-12-24 12:42 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\X10 Commander
2007-12-20 17:11 --------- d-----w C:\Program Files\Common Files\Application
2007-12-20 17:11 --------- d-----w C:\Program Files\Common Files\Ankiro
2007-12-20 16:42 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-12-20 16:36 --------- d-----w C:\Program Files\Windows Media Connect
2007-12-13 20:42 --------- d-----w C:\Program Files\LimeWire
2007-12-08 20:14 --------- d-----w C:\Program Files\Azureus
2007-12-08 19:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-08 08:22 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Xfire
2007-12-07 20:00 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire
2007-12-06 18:30 19,456 ----a-w C:\WINDOWS\system32\drivers\fzzfysxv.dat
2007-11-07 09:30 727,040 ----a-w C:\WINDOWS\system32\lsasrv.dll
2006-09-13 14:29 0 ----a-w C:\Documents and Settings\Ikzelf\Application Data\wklnhst.dat
2006-02-12 17:28 536,934 ------w C:\Program Files\GunzInternational_20060206.exe
2006-01-29 18:03 483,615 ------w C:\Program Files\GunzInternational_20060125.exe
2005-01-06 14:37 8 --sh--r C:\WINDOWS\system32\FCA6711E28.sys
2005-01-06 14:37 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

<pre>
----a-w			97,892 2004-05-31 07:34:56  C:\Documents and Settings\Ikzelf\Mijn documenten\Mijn muziek\Queen\1989-2 - At the Beeb [MPC Format]\[u]0[/u]0 MPC Format Plugin for Winamp ver. 0.96 .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BEE01155-E078-4BD4-9D13-B9F626CFE2CE}]
2002-09-11 13:00 103168 --a------ C:\WINDOWS\system32\dmdlg.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-24 16:22 1916928]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"SP2 Connection Patcher"="C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" [2005-07-11 12:51 409600]
"com.codeode.privacymantra"="C:\Program Files\Privacy Mantra 2.02\privacymantra.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 16:49 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 22:53 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 10:50 88363 C:\WINDOWS\AGRSMMSG.exe]
"PCMService"="C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" [2004-10-08 17:14 81920]
"Dit"="Dit.exe" [2004-07-20 18:18 90112 C:\WINDOWS\Dit.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"CHotkey"="mHotkey.exe" [2004-02-24 13:05 508416 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2004-02-03 16:15 5794816 C:\WINDOWS\CNYHKey.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 20:10 344064]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 11:00 49152]
"CloneCDTray"="C:\Program Files\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe"="C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe" [ ]
"C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe"="C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe" [ ]
"BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" [ ]
"SPAMfighter Agent"="C:\Program Files\SPAMfighter\SFAgent.exe" [2008-01-02 17:03 308880]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-27 16:42 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-27 16:40 219136]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]
Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-09-01 13:53:15 1073152]

R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS [2007-07-19 21:42]
R0 tcvtcncy;tcvtcncy;C:\WINDOWS\system32\drivers\fzzfysxv.dat []
R2 LogWatch;Event Log Watch;C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe [2002-09-20 17:29]
R2 SPAMfighter Update Service;SPAMfighter Update Service;"C:\Program Files\SPAMfighter\sfus.exe" [2007-12-14 09:57]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-06-05 08:04]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2004-10-01 14:58]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-06-12 08:47]
R3 UKBFLT;UKBFLT;C:\WINDOWS\system32\DRIVERS\UKBFLT.sys [2003-12-19 16:13]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 19:11]
S3 CA_LIC_CLNT;CA License Client;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe [2002-09-20 17:27]
S3 CA_LIC_SRVR;CA License Server;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [2002-09-20 17:41]
S3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2008-02-02 11:12]
S3 IIUSBISP;USB Mass Storage for USB ISP;C:\WINDOWS\system32\Drivers\iiusbisp.sys []
S3 ovt530;Webcam Classic;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 18:04]
S3 XDva002;XDva002;C:\WINDOWS\system32\XDva002.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fd73552-5fef-11d9-b978-000c76adb985}]
\Shell\AutoRun\command - @%systemroot%\explorer.exe /e,.

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 21:33:04
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\\DOCUME~1\\Dennis\\LOCALS~1\\Temp\\update.exe"="C:\\DOCUME~1\\Dennis\\LOCALS~1\\Temp\\update.exe"
"C:\\DOCUME~1\\Ikzelf\\LOCALS~1\\Temp\\update.exe"="C:\\DOCUME~1\\Ikzelf\\LOCALS~1\\Temp\\update.exe"
.
Voltooingstijd: 2008-02-02 21:35:31
ComboFix-quarantined-files.txt 2008-02-02 20:35:27
.
2008-01-08 19:52:42 --- E O F ---





=============================================================================


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:31:50, on 2-2-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\explorer.exe
D:\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.home.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {BEE01155-E078-4BD4-9D13-B9F626CFE2CE} - C:\WINDOWS\system32\dmdlg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe] C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe
O4 - HKLM\..\Run: [C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe] C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Program Files\Privacy Mantra 2.02\privacymantra.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Search - http://kn.bar.need2f...earch.html?p=KN
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://cache.hyves.n...ageUploader.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn....easeInstall.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10616 bytes

[Rorschach112]

Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\rightonadz-uninst.exe
C:\WINDOWS\system32\drivers\fzzfysxv.dat
C:\WINDOWS\system32\dmdlg.dll
C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe

RenV::
----a-w 97,892 2004-05-31 07:34:56 C:\Documents and Settings\Ikzelf\Mijn documenten\Mijn muziek\Queen\1989-2 - At the Beeb [MPC Format]\00 MPC Format Plugin for Winamp ver. 0.96 .exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fd73552-5fef-11d9-b978-000c76adb985}]

Driver::
tcvtcncy

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall




1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: (no name) - {BEE01155-E078-4BD4-9D13-B9F626CFE2CE} - C:\WINDOWS\system32\dmdlg.dll
O4 - HKLM\..\Run: [C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe] C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe
O4 - HKLM\..\Run: [C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe] C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.


Reboot and post a new HijackThis log

[fradenrem]

hello,

At this point AVG does not give me anymore thread-warnings. So it seams the trojan is gone.
I guess i can say "thank you very much" already. Anyway here is the logfile from hijackthis.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:00:46, on 4-2-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
D:\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.home.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Program Files\Privacy Mantra 2.02\privacymantra.exe" -minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O8 - Extra context menu item: &Search - http://kn.bar.need2f...earch.html?p=KN
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://cache.hyves.n...ageUploader.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn....easeInstall.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10009 bytes

[Rorschach112]

Can you post the ComboFix log

[fradenrem]

Hi, of course i can. I didn't know you needed that too. Here it is :


ComboFix 08-02.03.1 - Ikzelf 2008-02-04 20:16:39.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.581 [GMT 1:00]
Gestart vanuit: C:\Installatie\ComboFix.exe
Command switches used :: C:\Installatie\CFScript.txt
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

FILE
C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe
C:\WINDOWS\system32\dmdlg.dll
C:\WINDOWS\system32\drivers\fzzfysxv.dat
C:\WINDOWS\system32\rightonadz-uninst.exe
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dmdlg.dll
C:\WINDOWS\system32\drivers\fzzfysxv.dat
C:\WINDOWS\system32\rightonadz-uninst.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_TCVTCNCY
-------\tcvtcncy


(((((((((((((((((((( Bestanden Gemaakt van 2008-01-04 to 2008-02-04 ))))))))))))))))))))))))))))))
.

2008-01-27 16:40 . 2008-01-27 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-27 16:25 . 2008-01-27 16:25 <DIR> d-------- C:\Deckard
2008-01-27 15:55 . 2008-01-27 15:55 84 --ahs---- C:\WINDOWS\klif.spi
2008-01-27 15:31 . 2008-01-27 16:38 <DIR> d-------- C:\Program Files\kav
2008-01-27 14:54 . 2008-01-27 14:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-27 14:54 . 2008-01-27 16:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-26 16:03 . 2008-01-27 11:18 <DIR> d-------- C:\Program Files\ESET
2008-01-26 11:00 . 2008-01-26 11:05 <DIR> d-------- C:\Program Files\Eclipse
2008-01-23 20:51 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2008-01-23 20:51 . 2004-08-03 22:31 20,992 --a--c--- C:\WINDOWS\system32\dllcache\rtl8139.sys
2008-01-21 20:44 . 2008-01-21 20:44 65,912 --a------ C:\nerodigital.bin
2008-01-20 08:39 . 2008-01-20 08:39 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-01-19 16:16 . 2008-01-19 16:17 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-01-19 16:16 . 2008-01-19 16:16 <DIR> d-------- C:\Documents and Settings\Ikzelf\Application Data\PC Tools
2008-01-19 16:16 . 2008-01-19 21:31 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-19 16:16 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-19 16:16 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-19 16:16 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-19 16:16 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-01-18 21:18 . 2008-01-19 10:01 <DIR> d-------- C:\rpt
2008-01-12 11:49 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-11 19:37 . 2008-01-26 12:56 <DIR> d-------- C:\Documents and Settings\Ikzelf\workspace
2008-01-11 19:34 . 2008-01-11 19:38 <DIR> d-------- C:\Documents and Settings\Ikzelf\.eclipse
2008-01-08 23:26 . 2008-01-27 15:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-08 21:48 . 2008-01-08 21:48 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-01-08 21:48 . 2004-06-24 15:36 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-01-08 21:48 . 2004-11-08 11:42 <DIR> d--h----- C:\Documents and Settings\Administrator\Sjablonen
2008-01-08 21:48 . 2008-01-08 23:25 <DIR> dr-h----- C:\Documents and Settings\Administrator\Onlangs geopend
2008-01-08 21:48 . 2004-06-24 14:53 <DIR> d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving
2008-01-08 21:48 . 2005-03-29 17:07 <DIR> dr------- C:\Documents and Settings\Administrator\Mijn documenten
2008-01-08 21:48 . 2004-06-24 14:53 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-01-08 21:48 . 2004-11-30 14:27 <DIR> dr------- C:\Documents and Settings\Administrator\Favorieten
2008-01-08 21:48 . 2008-01-27 16:40 <DIR> d-------- C:\Documents and Settings\Administrator\Bureaublad
2008-01-08 21:48 . 2005-03-29 15:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Musicmatch
2008-01-08 21:48 . 2004-11-29 17:11 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\CyberLink
2008-01-08 21:48 . 2004-08-17 17:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Ahead

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2005-01-06 14:37 8 --sh--r C:\WINDOWS\system32\FCA6711E28.sys
2005-01-06 14:37 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-24 16:22 1916928]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"SP2 Connection Patcher"="C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" [2005-07-11 12:51 409600]
"com.codeode.privacymantra"="C:\Program Files\Privacy Mantra 2.02\privacymantra.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 16:49 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 22:53 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 10:50 88363 C:\WINDOWS\AGRSMMSG.exe]
"PCMService"="C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" [2004-10-08 17:14 81920]
"Dit"="Dit.exe" [2004-07-20 18:18 90112 C:\WINDOWS\Dit.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"CHotkey"="mHotkey.exe" [2004-02-24 13:05 508416 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2004-02-03 16:15 5794816 C:\WINDOWS\CNYHKey.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 20:10 344064]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 11:00 49152]
"CloneCDTray"="C:\Program Files\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe"="C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe" [ ]
"C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe"="C:\DOCUME~1\Ikzelf\LOCALS~1\Temp\update.exe" [ ]
"BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" [ ]
"SPAMfighter Agent"="C:\Program Files\SPAMfighter\SFAgent.exe" [2008-01-02 17:03 308880]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-27 16:42 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-27 16:40 219136]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]
Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-09-01 13:53:15 1073152]

R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS [2007-07-19 21:42]
R2 LogWatch;Event Log Watch;C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe [2002-09-20 17:29]
R2 SPAMfighter Update Service;SPAMfighter Update Service;"C:\Program Files\SPAMfighter\sfus.exe" [2007-12-14 09:57]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-06-05 08:04]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2004-10-01 14:58]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-06-12 08:47]
R3 UKBFLT;UKBFLT;C:\WINDOWS\system32\DRIVERS\UKBFLT.sys [2003-12-19 16:13]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 19:11]
S3 CA_LIC_CLNT;CA License Client;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe [2002-09-20 17:27]
S3 CA_LIC_SRVR;CA License Server;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [2002-09-20 17:41]
S3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2008-02-04 20:23]
S3 IIUSBISP;USB Mass Storage for USB ISP;C:\WINDOWS\system32\Drivers\iiusbisp.sys []
S3 ovt530;Webcam Classic;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 18:04]
S3 XDva002;XDva002;C:\WINDOWS\system32\XDva002.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 20:23:45
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\DOCUME~1\\Dennis\\LOCALS~1\\Temp\\update.exe"="C:\\DOCUME~1\\Dennis\\LOCALS~1\\Temp\\update.exe"
"C:\\DOCUME~1\\Ikzelf\\LOCALS~1\\Temp\\update.exe"="C:\\DOCUME~1\\Ikzelf\\LOCALS~1\\Temp\\update.exe"
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\HKCYDLL.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\msiexec.exe
.
**************************************************************************
.
Voltooingstijd: 2008-02-04 20:28:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-04 19:28:00
ComboFix2.txt 2008-02-02 20:35:32
.
2008-01-08 19:52:42 --- E O F ---

[Rorschach112]

Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\DOCUME~1\\Dennis\\LOCALS~1\\Temp\\update.exe"=-
"C:\\DOCUME~1\\Ikzelf\\LOCALS~1\\Temp\\update.exe"=-

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall



Download and scan with SUPERAntiSpyware Free for Home Users

• Double-click SUPERAntiSpyware.exe and use the default settings for installation.
• An icon will be created on your desktop. Double-click that icon to launch the program.
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
• Under "Configuration and Preferences", click the Preferences button.
• Click the Scanning Control tab.
• Under Scanner Options make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen.
• Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan.
• Click "Next" to start the scan. Please be patient while it scans your computer.
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes".
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

Also tell me how your PC is running

[fradenrem]

Hello,

Here's th log from Combofix and SUPERAntiSpyware (it run a long time and found a lot of items).

The computer is running a lot faster and there are no more thread warnings.

Seems to me like a job very wel done, but i'am not sure you are finished yet.



ComboFix 08-02.03.1 - Ikzelf 2008-02-05 20:54:04.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.556 [GMT 1:00]
Gestart vanuit: C:\Installatie\ComboFix.exe
Command switches used :: C:\Installatie\CFScript.txt
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

FILE
C:\DOCUME~1\Dennis\LOCALS~1\Temp\update.exe
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\grecorder.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))))))
.

2008-02-05 20:08 . 2008-02-05 20:08 <DIR> d-------- C:\Program Files\Game Recorder
2008-02-05 20:02 . 2008-02-05 20:02 <DIR> d-------- C:\Program Files\fraps
2008-01-27 16:40 . 2008-01-27 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-27 16:25 . 2008-01-27 16:25 <DIR> d-------- C:\Deckard
2008-01-27 15:55 . 2008-01-27 15:55 84 --ahs---- C:\WINDOWS\klif.spi
2008-01-27 15:31 . 2008-01-27 16:38 <DIR> d-------- C:\Program Files\kav
2008-01-27 14:54 . 2008-01-27 14:54 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-27 14:54 . 2008-01-27 16:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-26 16:03 . 2008-01-27 11:18 <DIR> d-------- C:\Program Files\ESET
2008-01-26 11:00 . 2008-01-26 11:05 <DIR> d-------- C:\Program Files\Eclipse
2008-01-23 20:51 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2008-01-23 20:51 . 2004-08-03 22:31 20,992 --a--c--- C:\WINDOWS\system32\dllcache\rtl8139.sys
2008-01-21 20:44 . 2008-01-21 20:44 65,912 --a------ C:\nerodigital.bin
2008-01-20 08:39 . 2008-01-20 08:39 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-01-19 16:16 . 2008-01-19 16:17 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-01-19 16:16 . 2008-01-19 16:16 <DIR> d-------- C:\Documents and Settings\Ikzelf\Application Data\PC Tools
2008-01-19 16:16 . 2008-02-05 20:03 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-19 16:16 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-01-19 16:16 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-01-19 16:16 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-01-19 16:16 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-01-18 21:18 . 2008-01-19 10:01 <DIR> d-------- C:\rpt
2008-01-14 13:52 . 2008-01-14 13:52 81,920 --a------ C:\WINDOWS\system32\frapsvid.dll
2008-01-12 11:49 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-11 19:37 . 2008-01-26 12:56 <DIR> d-------- C:\Documents and Settings\Ikzelf\workspace
2008-01-11 19:34 . 2008-01-11 19:38 <DIR> d-------- C:\Documents and Settings\Ikzelf\.eclipse
2008-01-08 23:26 . 2008-01-27 15:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-08 21:48 . 2008-01-08 21:48 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-01-08 21:48 . 2004-06-24 15:36 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-01-08 21:48 . 2004-11-08 11:42 <DIR> d--h----- C:\Documents and Settings\Administrator\Sjablonen
2008-01-08 21:48 . 2008-01-08 23:25 <DIR> dr-h----- C:\Documents and Settings\Administrator\Onlangs geopend
2008-01-08 21:48 . 2004-06-24 14:53 <DIR> d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving
2008-01-08 21:48 . 2005-03-29 17:07 <DIR> dr------- C:\Documents and Settings\Administrator\Mijn documenten
2008-01-08 21:48 . 2004-06-24 14:53 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2008-01-08 21:48 . 2004-11-30 14:27 <DIR> dr------- C:\Documents and Settings\Administrator\Favorieten
2008-01-08 21:48 . 2008-01-27 16:40 <DIR> d-------- C:\Documents and Settings\Administrator\Bureaublad
2008-01-08 21:48 . 2005-03-29 15:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Musicmatch
2008-01-08 21:48 . 2004-11-29 17:11 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\CyberLink
2008-01-08 21:48 . 2004-08-17 17:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Ahead

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-05 19:22 17,408 ----a-w C:\WINDOWS\system32\drivers\USBCRFT.SYS
2008-02-05 19:21 --------- d-----w C:\Program Files\eMule
2008-02-05 16:35 --------- d-----w C:\Program Files\SPAMfighter
2008-02-05 16:34 --------- d-----w C:\Program Files\SP2 Connection Patcher
2008-02-02 10:20 --------- d-----w C:\Documents and Settings\Ikzelf\Application Data\AVG7
2008-02-02 10:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-01-31 19:45 --------- d-----w C:\Program Files\Morpheus
2008-01-29 23:46 --------- d-----w C:\Documents and Settings\Ikzelf\Application Data\Canon
2008-01-27 02:36 --------- d-----w C:\Program Files\PlayMP3z
2008-01-26 09:28 --------- d-----w C:\Program Files\BearFlix
2008-01-19 20:41 --------- d-----w C:\Documents and Settings\Ikzelf\Application Data\Azureus
2008-01-12 10:49 --------- d-----w C:\Program Files\Java
2008-01-08 20:45 360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-01-05 23:51 --------- d-----w C:\Program Files\Zylom Games
2008-01-05 23:51 --------- d-----w C:\Program Files\MSN Messenger
2008-01-03 16:27 --------- d-----w C:\Program Files\Spellen
2007-12-30 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-28 23:33 --------- d-----w C:\Program Files\Lavasoft
2007-12-28 23:33 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-28 23:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-28 23:32 --------- d-----w C:\Program Files\BearShare
2007-12-28 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-28 22:56 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2007-12-28 22:53 --------- d-----w C:\Program Files\RogueRemover FREE
2007-12-28 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com
2007-12-28 20:54 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-28 20:47 --------- d-----w C:\Program Files\Hitman Pro
2007-12-24 12:42 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\X10 Commander
2007-12-20 17:11 --------- d-----w C:\Program Files\Common Files\Application
2007-12-20 17:11 --------- d-----w C:\Program Files\Common Files\Ankiro
2007-12-20 16:42 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-12-20 16:36 --------- d-----w C:\Program Files\Windows Media Connect
2007-12-13 20:42 --------- d-----w C:\Program Files\LimeWire
2007-12-08 20:14 --------- d-----w C:\Program Files\Azureus
2007-12-08 19:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-08 08:22 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Xfire
2007-12-07 20:00 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire
2007-11-07 09:30 727,040 ----a-w C:\WINDOWS\system32\lsasrv.dll
2006-09-13 14:29 0 ----a-w C:\Documents and Settings\Ikzelf\Application Data\wklnhst.dat
2006-02-12 17:28 536,934 ------w C:\Program Files\GunzInternational_20060206.exe
2006-01-29 18:03 483,615 ------w C:\Program Files\GunzInternational_20060125.exe
2005-01-06 14:37 8 --sh--r C:\WINDOWS\system32\FCA6711E28.sys
2005-01-06 14:37 4,184 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-24 16:22 1916928]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"SP2 Connection Patcher"="C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" [2005-07-11 12:51 409600]
"com.codeode.privacymantra"="C:\Program Files\Privacy Mantra 2.02\privacymantra.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 16:49 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 22:53 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 10:50 88363 C:\WINDOWS\AGRSMMSG.exe]
"PCMService"="C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" [2004-10-08 17:14 81920]
"Dit"="Dit.exe" [2004-07-20 18:18 90112 C:\WINDOWS\Dit.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"CHotkey"="mHotkey.exe" [2004-02-24 13:05 508416 C:\WINDOWS\mHotkey.exe]
"ledpointer"="CNYHKey.exe" [2004-02-03 16:15 5794816 C:\WINDOWS\CNYHKey.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 20:10 344064]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 11:00 49152]
"CloneCDTray"="C:\Program Files\CloneCD\CloneCDTray.exe" [2005-05-19 14:47 57344]
"BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" [ ]
"SPAMfighter Agent"="C:\Program Files\SPAMfighter\SFAgent.exe" [2008-01-02 17:03 308880]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-27 16:42 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-27 16:40 219136]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]
Nintendo Wi-Fi USB Connector registratiesoftware uitvoeren.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-09-01 13:53:15 1073152]

R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS [2007-07-19 21:42]
R2 LogWatch;Event Log Watch;C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe [2002-09-20 17:29]
R2 SPAMfighter Update Service;SPAMfighter Update Service;"C:\Program Files\SPAMfighter\sfus.exe" [2007-12-14 09:57]
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2003-06-05 08:04]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2004-10-01 14:58]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2003-06-12 08:47]
R3 UKBFLT;UKBFLT;C:\WINDOWS\system32\DRIVERS\UKBFLT.sys [2003-12-19 16:13]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 19:11]
S3 CA_LIC_CLNT;CA License Client;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe [2002-09-20 17:27]
S3 CA_LIC_SRVR;CA License Server;C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [2002-09-20 17:41]
S3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2008-02-05 20:22]
S3 IIUSBISP;USB Mass Storage for USB ISP;C:\WINDOWS\system32\Drivers\iiusbisp.sys []
S3 ovt530;Webcam Classic;C:\WINDOWS\system32\Drivers\ov530vid.sys [2005-03-15 18:04]
S3 XDva002;XDva002;C:\WINDOWS\system32\XDva002.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 20:58:09
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2008-02-05 20:58:54
ComboFix-quarantined-files.txt 2008-02-05 19:58:51
ComboFix2.txt 2008-02-04 19:28:05
ComboFix3.txt 2008-02-02 20:35:32
.
2008-01-08 19:52:42 --- E O F ---


=======================================================================

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/05/2008 at 11:50 PM

Application Version : 3.9.1008

Core Rules Database Version : 3395
Trace Rules Database Version: 1387

Scan type : Complete Scan
Total Scan Time : 02:40:13

Memory items scanned : 424
Memory threats detected : 0
Registry items scanned : 6847
Registry threats detected : 28
File items scanned : 189510
File threats detected : 472

Adware.ContextHelper
HKLM\Software\Classes\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}#AppID
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}\InprocServer32
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}\InprocServer32#ThreadingModel
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}\ProgID
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}\Programmable
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}\TypeLib
HKCR\CLSID\{0D39A900-0F3A-4C29-A254-3E65244FDC34}\VersionIndependentProgID
C:\PROGRAM FILES\CONTEXTTOOL\CONTEXTTOOL-1.DLL

Unclassified.Unknown Origin
HKLM\Software\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}
HKCR\CLSID\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3}
HKCR\CLSID\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3}
HKCR\CLSID\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3}\InprocServer32
HKCR\CLSID\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3}\InprocServer32#ThreadingModel
HKCR\CLSID\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3}\Programmable
HKCR\CLSID\{4D1C4E89-A32A-416B-BCDB-33B3EF3617D3}\TypeLib
C:\PROGRAM FILES\NEED2FIND\BAR\1.BIN\ND2FNBAR.DLL

Adware.Tracking Cookie
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@asxmedia[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@casalemedia[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@revsci[3].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@hotlog[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@mediaplex[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@keywordmax[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@bluestreak[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@torrent-finder[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@adbrite[3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@tradedoubler[3].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@2o7[3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@adrevolver[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@weborama[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][4].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@enhance[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@advertising[4].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][6].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@need2find[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@zedo[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@doubleclick[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@tacoda[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@clicksor[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@adlegend[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@tribalfusion[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@pornhub[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][5].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@overture[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@fastclick[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@atwola[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@checkstat[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@apmebf[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@usenext[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][7].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][9].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][10].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@adtech[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@emediate[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@xiti[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@spyguardpro[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@leadtrack[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][9].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@precisionclick[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][8].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@statcounter[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@adecn[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@atdmt[3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][11].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@burstnet[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@dealtime[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][4].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@serving-sys[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@hitbox[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@indextools[3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][6].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected]
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@19searchfeed[2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@2o7[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@2o7[2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@adbrite[1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][3].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@advertising[2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@advertising[3].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@apmebf[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@atdmt[2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@atdmt[3].txt
C:\Documents and Settings\Dennis\Cookies\dennis@atwola[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@azjmp[2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@bluestreak[1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@clickaider[1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@clicktorrent[1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@doubleclick[2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@drivecleaner[2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@fastclick[2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@goclick[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@hitbox[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@indextools[2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@linksynergy[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@mediaplex[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@mediaplex[3].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@need2find[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@netmediagroup[1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@realmedia[2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@revsci[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@revsci[3].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][3].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@serving-sys[1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@smartadserver[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@specificclick[2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][3].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][3].txt
C:\Documents and Settings\Dennis\Cookies\dennis@superstats[1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@tradedoubler[2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@trafficmp[2].txt
C:\Documents and Settings\Dennis\Cookies\dennis@winantivirus[2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][2].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][6].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\[email protected][1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@zedo[1].txt
C:\Documents and Settings\Dennis\Cookies\dennis@zedo[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@247realmedia[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@2o7[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@adrevolver[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@adtech[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@advertising[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@apmebf[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@atdmt[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@banner[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@belnk[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@bluestreak[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@casalemedia[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@doubleclick[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@fastclick[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@hitbox[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@interclick[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@mediaplex[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@mtrack[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@paypopup[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@realmedia[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@revenue[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@serving-sys[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@spylog[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@statcounter[2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@tradedoubler[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@tribalfusion[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@tripod[1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Bureaublad\Cookies\ikzelf@zedo[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@2o7[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@adbrite[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][4].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@advertising[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@advertising[3].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@asxmedia[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@atdmt[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@atwola[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@azjmp[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@clickaider[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@clicktorrent[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@dealtime[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@doubleclick[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@hackerclick[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@imrworldwide[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@indextools[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@need2find[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@q-find[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@realmedia[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@revenue[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@revsci[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@serving-sys[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@smartadserver[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@specificclick[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@statcounter[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@tradedoubler[2].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@trafficmp[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@tribalfusion[1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@weborama[1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@windowsmedia[2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][2].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][3].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][4].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][5].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][6].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\[email protected][1].txt
C:\Documents and Settings\Ikzelf\Cookies\ikzelf@zedo[1].txt
C:\Documents and Settings\Remco\Cookies\[email protected][2].txt
C:\Documents and Settings\Remco\Cookies\[email protected][2].txt
C:\Documents and Settings\Remco\Cookies\remco@adrevolver[1].txt
C:\Documents and Settings\Remco\Cookies\[email protected][2].txt
C:\Documents and Settings\Remco\Cookies\[email protected][2].txt
C:\Documents and Settings\Remco\Cookies\[email protected][1].txt
C:\Documents and Settings\Remco\Cookies\[email protected][1].txt
C:\Documents and Settings\Remco\Cookies\remco@asxmedia[1].txt
C:\Documents and Settings\Remco\Cookies\remco@atdmt[2].txt
C:\Documents and Settings\Remco\Cookies\[email protected][1].txt
C:\Documents and Settings\Remco\Cookies\remco@drivecleaner[2].txt
C:\Documents and Settings\Remco\Cookies\[email protected][1].txt
C:\Documents and Settings\Remco\Cookies\remco@exigomedia[1].txt
C:\Documents and Settings\Remco\Cookies\[email protected][1].txt
C:\Documents and Settings\Remco\Cookies\[email protected][2].txt
C:\Documents and Settings\Remco\Cookies\[email protected][3].txt
C:\Documents and Settings\Remco\Cookies\remco@need2find[1].txt
C:\Documents and Settings\Remco\Cookies\[email protected][1].txt
C:\Documents and Settings\Remco\Cookies\[email protected][1].txt
C:\Documents and Settings\Remco\Cookies\[email protected][2].txt
C:\Documents and Settings\Remco\Cookies\remco@tradedoubler[1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\saskia@adbrite[2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\saskia@doubleclick[2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\saskia@fastclick[2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\saskia@indextools[2].txt
C:\Documents and Settings\saskia\Cookies\saskia@intermediairfw[1].txt
C:\Documents and Settings\saskia\Cookies\saskia@leadtrack[1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\saskia@revsci[2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\saskia@tradedoubler[2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][8].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][1].txt
C:\Documents and Settings\saskia\Cookies\[email protected][2].txt

Trojan.ErrorSafe
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000#DeviceDesc
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000#Capabilities
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ERSSDD\0000\LogConf

Malware.LocusSoftware Inc/BestSellerAntivirus
C:\DECKARD\SYSTEM SCANNER\BACKUP\DOCUME~1\IKZELF\LOCALS~1\TEMP\~UGA6PSETUP.EXE

BearShare File Sharing Client
C:\DOCUMENTS AND SETTINGS\DENNIS\BUREAUBLAD\BEARSHARE.EXE
C:\DOCUMENTS AND SETTINGS\DENNIS\BUREAUBLAD\_VTI_CNF\BEARSHARE.EXE

Adware.Need2Find
C:\PROGRAM FILES\NEED2FIND\BAR\1.BIN\NPND2FN.DLL

Adware.AdRotator/RightOnz
C:\SYSTEM VOLUME INFORMATION\_RESTORE{7CC8744D-9734-4FA4-9B1F-A7AE1C2F0B79}\RP690\A0124825.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{7CC8744D-9734-4FA4-9B1F-A7AE1C2F0B79}\RP695\A0125012.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{7CC8744D-9734-4FA4-9B1F-A7AE1C2F0B79}\RP702\A0126365.EXE

Trojan.Unclassified/FukuRuku
C:\SYSTEM VOLUME INFORMATION\_RESTORE{7CC8744D-9734-4FA4-9B

[Rorschach112]

Your logs are clean ! We need to do a few things

You can delete the tools that we used


Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com.../readstep2.html



You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here



Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

[fradenrem]

Hi,

I installed all the things you advised.
Up till now everything is still running fine.

Thanks again, you did a great job

Frans

[Rorschach112]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.