PDA

View Full Version : Please help!



Th4K3y
2006-06-20, 00:05
I recently downloaded a file and that file downloaded viruses and trojans. I reformatted my HD and reinstalled Windows, but at the Documents and Settings directory still were the directory's LocalService and NetworkService which start a process named svchost.exe under the Username NetworkService and LocalService. I've tried many things to delete those directories but each time they are replaced immediately. I just scanned with Dr. Web and it found A0016368.dll and A0049118.exe in C:\System Volume Information\_restore which it deleted. But those svchost.exe's are still started. Please help me!

These are the files that are in use in the directories:

http://img183.imageshack.us/img183/5035/spyware6fj.jpg

Here's my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 21:35:23, on 19/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINXP\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINXP\system32\nvsvc32.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINXP\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINXP\SOUNDMAN.EXE
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\Applications\SpywareGuard\sgmain.exe
C:\Program Files\Applications\SpywareGuard\sgbhp.exe
C:\WINXP\system32\wuauclt.exe
C:\WINXP\system32\wuauclt.exe
C:\Downloads\Applications\Spyware\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://companyweb
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Applications\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\Applications\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 -lock
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\Applications\SpywareGuard\sgmain.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\Applications\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ontvang alles met FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Ontvang met FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\Applications\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://companyweb
O15 - Trusted Zone: *.gmail.com
O15 - Trusted Zone: http://www.peid.tk
O15 - Trusted Zone: http://www.peidforums.tk
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1142811761343
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Waalen-Ansems.local
O17 - HKLM\Software\..\Telephony: DomainName = Waalen-Ansems.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB028783-0D5D-4D49-96F9-8346913B3761}: NameServer = 10.0.29.101,10.0.29.138
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Waalen-Ansems.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = Waalen-Ansems.local
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: NavLogon - C:\WINXP\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

Th4K3y
2006-06-20, 00:05
And here my Panda ActiveScan log:


Incident Status Location

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@ad.yieldmanager[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@ad.yieldmanager[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@ad.yieldmanager[3].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@ad.yieldmanager[4].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@ad.yieldmanager[5].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@ad.yieldmanager[6].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@burstnet[1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@burstnet[2].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@burstnet[3].txt
Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@c2.gostats[2].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@cgi-bin[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@com[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@com[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@com[3].txt
Spyware:Cookie/360i Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@ct.360i[1].txt
Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@fe.lea.lycos[1].txt
Spyware:Cookie/Kmpads Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@kmpads[2].txt
Spyware:Cookie/Mp3search Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@mp3search[2].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@searchportal.information[1].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@searchportal.information[2].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@searchportal.information[3].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@searchportal.information[4].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@searchportal.information[5].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@statcounter[1].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@statcounter[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@statcounter[3].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@statcounter[4].txt
Spyware:Cookie/Tucows Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@tucows[1].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@www.burstbeacon[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@xiti[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@xiti[2].txt
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@yadro[1].txt
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@yadro[2].txt
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\thijs\Cookies\thijs@yadro[3].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Downloads\Applications\Spyware\SmitfraudFix\Process.exe

Th4K3y
2006-06-21, 00:26
I found some more info on those directories and processes with RunAlyzer:

http://img175.imageshack.us/img175/1794/spyware29ea.jpg

LonnyRJones
2006-06-23, 17:06
Welcome Th4K3y

You did search on the internet to find more information on ctfmon and svchost i hope ? Both are of cource lagit windows files, and so is everything in those screenshots.

Th4K3y
2006-06-27, 23:47
I already knew they are windows FILES, but those directories weren't there before I got infected and they aren't on my father's PC and not on my brother's.
And would you please have a look at my ComboFix log, because I think it has found something (could be wrong about that).
And do you know why I can't, even if I'm logged in as admin, access System Restore?
Oh yeah, and why are those directories in the documents and settings directory and have a User ID, but don't show up in the place where you can make users?

Th4K3y
2006-06-27, 23:49
My ComboFix log:

Start Time= 27/06/2006 19:22:59.71

(((((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))))))


HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NavLogon
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wzcnotif


* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\internet settings\user agent\post platform]
"sv1"=""

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions\approved]
"{00022613-0000-0000-C000-000000000046}"="Eigenschappenvenster van multimediabestand"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-scannerbeheer"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Het tabblad Beveiliging"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Eigenschappenblad voor OLE-docbestand"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell-uitbreidingen voor delen"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Beeldschermadapter"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Monitor"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Configuratiescherm-uitbreiding Beeldscherm-panning"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Het tabblad Beveiliging"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibiliteitspagina"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Knipselgegevensverwerker van shell"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Schijfkopieer-uitbreiding"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell-uitbreidingen voor Microsoft Windows Network-objecten"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-monitorbeheer"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-printerbeheer"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell-uitbreidingen voor bestandscompressie"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Shell-uitbreiding voor Web Printer"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Snelmenu Codering"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Werkmap"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal-pictogramuitbreiding"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profiel"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Het tabblad Beveiliging voor printers"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell-uitbreidingen voor delen"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-extensie"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto-handtekeningextensie"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netwerkverbindingen"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Netwerkverbindingen"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners en camera's"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners en camera's"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners en camera's"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners en camera's"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners en camera's"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell-uitbreidingen voor Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Geplande taken"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taakbalk en menu Start"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Zoeken"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help en ondersteuning"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help en ondersteuning"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Uitvoeren..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Lettertypen"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Systeembeheer"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet-werkbalk"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Downloadstatus"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Uitgebreide shell-map"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Uitgebreide shell-map 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft-browserbalk"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Zoekbalk"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Mediabalk"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Zoeken binnen deelvenster"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Zoeken op het web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Hulpprogramma met opties voor registerboomstructuur"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adres"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoAanvullen"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU-lijst voor AutoAanvullen"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Aangepaste MRU-lijst voor AutoAanvullen"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Toegankelijk"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Pop-upbalk Volgen"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Parser voor adresbalk"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lijst voor AutoAanvullen: Microsoft Geschiedenis"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Lijst voor AutoAanvullen: Microsoft Shell-map"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft-container met meervoudige lijst voor AutoAanvullen"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Sitemenu van shell-band"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Gebruikersondersteuning"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Globale mapinstellingen"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url-geschiedenisservice"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Geschiedenis"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Tijdelijke Internet-bestanden"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Tijdelijke Internet-bestanden"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url-zoeken Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite-welkomstscherm"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Het Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Cachemap van ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Map met abonnementen"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Toepassingsbeheer"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Programma voor inventarisatie van geïnstalleerde toepassingen"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI- en bestandsextractieprogramma voor miniaturen"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Informatie over de handler voor miniatuurweergaven (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML-extractie voor miniatuurweergaven"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Wizard Webpublicaties"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Afdrukken via het web bestellen"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell-object voor publicatiewizard"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Wizard Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Gebruikersaccounts"
"{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}"="Gecomprimeerde map"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanaal-bestand"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Kanaal-snelkoppeling"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Handler-object voor kanalen"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Map Off line bestanden"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Personen..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}"="ShellLink for Application References"
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}"="Shell Icon Handler for Application References"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{0561EC90-CE54-4f0c-9C55-E226110A740C}"="Haali Column Provider"
"{E4D8441D-F89C-4b5c-90AC-A857E1768F1F}"="Haali Matroska Thumbnail Exctractor"
"{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}"="History Band"
"{6DEA92E9-8682-4b6a-97DE-354772FE5727}"="Autodesk DWF Preview"
"{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}"="UnlockerShellExtension"
"{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"="PowerISO"
"{81559C35-8464-49F7-BB0E-07A383BEF910}"="SpywareGuard"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Th4K3y
2006-06-27, 23:49
My ComboFix log(continued):



REGISTRY ENTRIES REMOVED:

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


FILES REMOVED:



Granting sedebugprivilege to Administrators ... successful


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-06-26 22:12:12 81920 ( ....R ) "C:\WINXP\bwUnin-6.1.4.36-8876480L.exe"
2006-06-26 22:10:20 ( .D... ) "C:\Program Files\Common Files\Logitech"
2006-06-26 22:10:18 ( .D... ) "C:\Program Files\Logitech"
2006-06-23 19:47:00 ( .D... ) "C:\Program Files\Unreal Tournament 2000"
2006-06-23 17:49:04 ( .D... ) "C:\Program Files\Steam"
2006-06-20 23:03:08 ( .D... ) "C:\Program Files\PepiMK Software"
2006-06-20 23:02:54 ( .D... ) "C:\Program Files\Safer Networking"
2006-06-19 14:51:14 ( .D... ) "C:\Program Files\Windows Defender"
2006-06-19 13:31:20 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\Sun"
2006-06-19 13:22:56 ( .D... ) "C:\Program Files\Java"
2006-06-19 13:21:26 ( .D... ) "C:\Program Files\Common Files\Java"
2006-06-10 13:56:50 ( .D... ) "C:\Program Files\SG Corp"
2006-06-09 03:19:50 5967776 ( A.... ) "C:\WINXP\system32\MRT.exe"
2006-06-05 17:19:50 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\AdobeUM"
2006-06-05 17:16:20 869 ( A.... ) "C:\Documents and Settings\Thijs_ADM\Application Data\AdobeDLM.log"
2006-06-05 17:16:20 0 ( A.... ) "C:\Documents and Settings\Thijs_ADM\Application Data\dm.ini"
2006-06-05 17:11:28 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\InterTrust"
2006-06-02 13:39:54 579888 ( A.... ) "C:\WINXP\system32\LegitCheckControl.dll"
2006-06-02 13:39:46 402736 ( ..... ) "C:\WINXP\system32\WgaLogon.dll"
2006-06-02 13:39:46 286000 ( ..... ) "C:\WINXP\system32\WgaTray.exe"
2006-06-01 23:54:58 ( .D... ) "C:\Program Files\Spyware Doctor"
2006-06-01 23:42:04 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\Webroot"
2006-06-01 23:33:34 ( .D... ) "C:\Program Files\Lavasoft"
2006-06-01 22:18:32 14048 ( ..... ) "C:\WINXP\system32\spmsg.dll"
2006-06-01 20:49:44 163840 ( A.... ) "C:\WINXP\system32\jgdw400.dll"
2006-06-01 20:49:44 27648 ( A.... ) "C:\WINXP\system32\jgpl400.dll"
2006-05-29 17:32:20 1494016 ( A.... ) "C:\WINXP\system32\shdocvw.dll"
2006-05-24 22:22:18 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\PC Tools"
2006-05-23 16:25:52 ( .D... ) "C:\Program Files\America's Army"
2006-05-19 17:10:26 3073536 ( A.... ) "C:\WINXP\system32\mshtml.dll"
2006-05-18 13:14:24 18359 ( A.... ) "C:\WINXP\system32\Ntaccess.sys"
2006-05-18 13:14:24 18359 ( A.... ) "C:\WINXP\system32\Ntaccess.sys"
2006-05-18 07:41:42 450560 ( A.... ) "C:\WINXP\system32\jscript.dll"
2006-05-16 21:24:54 356352 ( A.... ) "C:\WINXP\eSellerateEngine.dll"
2006-05-14 10:52:36 181248 ( A.... ) "C:\WINXP\system32\rasmans.dll"
2006-05-11 10:57:48 25600 ( A.... ) "C:\WINXP\system32\xpsp3res.dll"
2006-05-10 07:25:26 661504 ( A.... ) "C:\WINXP\system32\wininet.dll"
2006-05-10 07:25:26 615424 ( A.... ) "C:\WINXP\system32\urlmon.dll"
2006-05-10 07:25:26 532480 ( A.... ) "C:\WINXP\system32\mstime.dll"
2006-05-10 07:25:26 474624 ( A.... ) "C:\WINXP\system32\shlwapi.dll"
2006-05-10 07:25:26 39424 ( A.... ) "C:\WINXP\system32\pngfilt.dll"
2006-05-10 07:25:24 1057280 ( A.... ) "C:\WINXP\system32\danim.dll"
2006-05-10 07:25:24 1022976 ( A.... ) "C:\WINXP\system32\browseui.dll"
2006-05-10 07:25:24 448512 ( A.... ) "C:\WINXP\system32\mshtmled.dll"
2006-05-10 07:25:24 357888 ( A.... ) "C:\WINXP\system32\dxtmsft.dll"
2006-05-10 07:25:24 251392 ( A.... ) "C:\WINXP\system32\iepeers.dll"
2006-05-10 07:25:24 205312 ( A.... ) "C:\WINXP\system32\dxtrans.dll"
2006-05-10 07:25:24 151552 ( A.... ) "C:\WINXP\system32\cdfview.dll"
2006-05-10 07:25:24 146432 ( A.... ) "C:\WINXP\system32\msrating.dll"
2006-05-10 07:25:24 96768 ( A.... ) "C:\WINXP\system32\inseng.dll"
2006-05-10 07:25:24 55808 ( ..... ) "C:\WINXP\system32\extmgr.dll"
2006-05-10 07:25:24 16384 ( A.... ) "C:\WINXP\system32\jsproxy.dll"
2006-05-09 23:32:02 ( .D... ) "C:\Program Files\JFK Reloaded"
2006-05-08 21:53:32 ( .D... ) "C:\Program Files\Common Files\MAGIX Shared"
2006-05-07 02:26:04 95239 ( A.... ) "C:\WINXP\PixtopianBook Uninstaller.exe"
2006-05-06 23:01:46 ( .D... ) "C:\Program Files\Common Files\Autodesk Shared"
2006-05-06 23:01:38 ( .D... ) "C:\Program Files\Autodesk"
2006-05-06 19:21:22 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\My Battle for Middle-earth(tm) II Files"
2006-05-06 15:06:12 49604 ( A.... ) "C:\WINXP\system32\RadLightOFRUninstall.exe"
2006-05-06 15:01:36 51600 ( A.... ) "C:\WINXP\system32\RadLightMPCUninstall.exe"
2006-05-06 15:00:32 33533 ( A.... ) "C:\WINXP\system32\CoreVorbis-uninstall.exe"
2006-05-06 14:50:18 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\Real"
2006-05-06 14:31:12 ( .D... ) "C:\Program Files\DVBPortal"
2006-05-06 14:30:04 ( .D... ) "C:\Program Files\Codecs"
2006-05-06 14:05:04 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\Media Player Classic"
2006-05-03 02:56:58 127078 ( A.... ) "C:\WINXP\system32\javaws.exe"
2006-05-03 01:19:40 53346 ( A.... ) "C:\WINXP\system32\javaw.exe"
2006-05-03 01:19:30 49248 ( A.... ) "C:\WINXP\system32\java.exe"
2006-05-01 01:24:12 ( .D... ) "C:\Documents and Settings\Thijs_ADM\Application Data\Help"
2006-04-29 06:07:48 5533696 ( A.... ) "C:\WINXP\system32\wmp.dll"
2006-04-06 10:54:38 73728 ( A.... ) "C:\WINXP\system32\asuninst.exe"
2006-03-20 01:34:26 11209 ( A..H. ) "C:\Program Files\folder.htt"
2006-03-20 01:34:26 266 ( ..SH. ) "C:\Program Files\desktop.ini"


((((((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~2\\VPTray.exe"
"DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033 -lock"
"SoundMan"="SOUNDMAN.EXE"
"Synchronization Manager"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,\
73,74,65,6d,33,32,5c,6d,6f,62,73,79,6e,63,2e,65,78,65,20,2f,6c,6f,67,6f,6e,\
00
"NvCplDaemon"="RUNDLL32.EXE C:\\WINXP\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINXP\\system32\\NvMcTray.dll,NvTaskbarInit"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"flags"=dword:00000008

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex\000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRemoteRecursiveEvents"=dword:00000001
"NoStrCmpLogical"=dword:00000001
"NoClose"=dword:00000000
"NoWelcomeScreen"="1"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"AWMON"="\"C:\\PROGRA~1\\Lavasoft\\AD-AWA~1\\Ad-Watch.exe\""
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoDispSettingsPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoSizeChoice"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,c4,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,d2,03,00,00,23,00,00,00,1c,01,00,00,27,01,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{81559C35-8464-49F7-BB0E-07A383BEF910}"="SpywareGuard"
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINXP\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\APPLIC~1\\Adobe\\ACROBA~2.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CloneCDTray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="UnlockerAssistant"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Applications\\Unlocker\\UnlockerAssistant.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mi-raysat_3dsmax8"=dword:00000002
"MDM"=dword:00000002
"FileChecker"=dword:00000002

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SW24"="C:\\WINXP\\system32\\sw24.exe"
"SW20"="C:\\WINXP\\system32\\sw20.exe"


Contents of the 'Scheduled Tasks' folder
C:\WINXP\tasks\At1.job
C:\WINXP\tasks\MP Scheduled Scan.job
C:\WINXP\tasks\Symantec NetDetect.job

Completion time: 27/06/2006 22:36:57.18
ComboFix ver 06.06.19 - This logfile is located at C:\ComboFix.txt

LonnyRJones
2006-06-28, 03:30
Nothing in that log either, but these are odd
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SW24"="C:\\WINXP\\system32\\sw24.exe"
"SW20"="C:\\WINXP\\system32\\sw20.exe"
Do those files exist ?

localservice and NetworkService exist here, possibly they are hidden on your father's and brother's
PC's
C:\Documents and Settings\NetworkService\Application Data (9/23/2004 11:17:21 PM)
C:\Documents and Settings\NetworkService\Cookies (7/30/2005 2:06:54 AM)
C:\Documents and Settings\NetworkService\Local Settings (9/23/2004 11:17:22 PM)
C:\Documents and Settings\NetworkService\NTUSER.DAT (768 KB, 6/27/2006 11:52:12 AM)
C:\Documents and Settings\NetworkService\ntuser.dat.LOG (1 KB, 6/27/2006 5:04:18 PM)
C:\Documents and Settings\NetworkService\ntuser.ini (1 KB, 9/23/2004 11:17:22 PM)
C:\Documents and Settings\LocalService\Application Data (5/30/2005 2:10:51 PM)
C:\Documents and Settings\LocalService\Cookies (9/23/2004 11:17:36 PM)
C:\Documents and Settings\LocalService\Local Settings (9/23/2004 11:17:24 PM)
C:\Documents and Settings\LocalService\NTUSER.DAT (768 KB, 6/27/2006 11:52:12 AM)
C:\Documents and Settings\LocalService\ntuser.dat.LOG (1 KB, 6/27/2006 5:04:17 PM)
C:\Documents and Settings\LocalService\ntuser.ini (1 KB, 9/23/2004 11:17:24 PM)
C:\Documents and Settings\LocalService\Start Menu (2/19/2005 11:15:57 PM)



"And do you know why I can't, even if I'm logged in as admin, access System Restore? "
When antivirus/antispyware tools remove items from system restore it usualy breaks it, exactly what happens where ?

"I just scanned with Dr. Web and it found A0016368.dll and A0049118.exe in C:\System Volume Information\_restore which it deleted."
Have you tried disabling system restore, reboot your pc and enable it again ?

Th4K3y
2006-06-30, 21:58
On my father's PC show hidden files is always on. And they're not there.
And the problem is I can't even turn off system restore, because it then says that I'm not an admin (And I definitely am an admin). And yes sw20.exe and sw24.exe are there, and I know why. (They're from my video card driver)

LonnyRJones
2006-07-01, 06:37
Try it from safe mode adinistrators account, or perhaps you've disabled some service's.

And the problem is I can't even turn off system restore, because it then says that I'm not an admin (
It helps if you quote the exact error messages word for word, that way we can do a search

Th4K3y
2006-07-02, 00:57
NVM, tried it again to write down the error and it was working again. Weird.

LonnyRJones
2006-07-02, 03:21
Good
Your pc is malware free

I recently downloaded a file and that file downloaded viruses and trojans. I reformatted my HD and reinstalled Windows
You do realize virus/trojans and spyware cannot survive a reformat.(on NT systems)

Th4K3y
2006-07-03, 00:12
Yeah I do, but I found it odd that those directories were still there. 'Cause Norton said before the reformat that the viruses and trojans were operating from those directories.

LonnyRJones
2006-07-03, 03:52
Perhaps your confusing a reformat then a fresh windows install with a
OEM PC's reinstall of wiindows/ or windows repair install.

Please do not try deleting files like you have without either asking other's or more research next time.


surf safe

tashi
2006-07-11, 01:20
As the problem appears to be resolved this topic will be archived.

If you need it re-opened please send me a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.

Glad we could help, thank you Lonny