Radio Virus!?? Noone seems to know it on the net yet....

shaft23 · Jan 23, 2010

hey guys,

I found another topic by someone on this board that seemed to have the same problem as i do, but noone had adresed the issue. I also couldn't post in that thread so i made anotherone here with my specific problem.

Well, last week i was on a blog and i got a pop up from a program called Malware Defender or Windows Defender , can't remember.....It looked like it was a windows thing, but it was a virus that had installed some nasty virus on my pc. Quickly i had 3 or 4 porntube, youporn sor some other x-rated icons on my desktop. I managed to remove all the Programs stuff including the registry stuff and ran a scan that removed some virus. BUT the big thing is since then my Avast Resident Protection has been disabled. My cpu is now open to any virus. i got Zonealarm installed today and have done the Trendmicro and ad-aware scans, but i still have a weird radio station ad starting up onc in a while on the background of my computer, i can;t find anything unusual in the taskmanager when the sound is playing. I'm gonna try to get the log running while the radio add is running, but it's hard. There are always the same adds or parts of radioprograms.

can't access some sites like bleepingcomputer and also i got pop ups of a site called luxe-software.net once in a hur orso.
My cpu is extremely slow at times and it sometimes doesn;t start the first time and i have to press restart for it to work.
Today i couldn't send an email with hotmil, cause the explorer window shuts down by itself. it only does this with hotmail so far.

i couldn't download or install some programs like ijjack this and i also have ran an older version of smitfraudfix, cause the new version gives me an error.
I also can't download combofix from certain sites, cause it shows that the sites are non existent.

Help a guy out here, i can't be the only one with this problem.

here is a log, i couldn;t manage to get it while the radio thing was playing, cause it hasn't played yet today.

Logfile of HijackThis v1.99.1
Scan saved at 13:51:21, on 23-1-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\windows\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\nvsvc32.exe
C:\windows\System32\svchost.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\windows\system32\RUNDLL32.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\hijackthis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\Program Files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: Ãâ·Ñ¾«²ÊÊÓÆµ³¬Á÷³©ÔÚÏß¹Û¿´ - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: ²¥°ÔµçÊÓ - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} (EARTPatch8X Class) - http://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} (tcast control) - http://nba.tom.com/video/tcastV1.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - http://www.vexcast.com/download/vexcast.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - AppInit_DLLs: pavwait.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Blade81 · Jan 28, 2010

Hello,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
Save both reports to your desktop. Post them back to your topic.

shaft23 · Jan 29, 2010

hi blade,

the radio ads have been more frequent as of late...it has to do with an extra iexplorer that is opening up on its own and running in the background........So i managed to run Hijackthis in the middle of one of the ads and it gave me some warning about a virus then it gave me a hijackthis log. THis is the latest Hijackthis log followed by the two logs you wanted to see.

Logfile of HijackThis v1.99.1
Scan saved at 20:57:01, on 23-1-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\windows\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\nvsvc32.exe
C:\windows\System32\svchost.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\windows\system32\RUNDLL32.EXE
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Hijack This\hijackthis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\Program Files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: Ãâ·Ñ¾«²ÊÊÓÆµ³¬Á÷³©ÔÚÏß¹Û¿´ - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: ²¥°ÔµçÊÓ - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} (EARTPatch8X Class) - http://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} (tcast control) - http://nba.tom.com/video/tcastV1.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - http://www.vexcast.com/download/vexcast.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - AppInit_DLLs: pavwait.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 7-2-2004 10:53:25
System Uptime: 28-1-2010 23:24:35 (1 hours ago)

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-6570
Processor: AMD Athlon(tm) XP 2600+ | Socket A | 1913/166mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 1,471 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is CDROM ()
K: is CDROM ()
L: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

7-Zip 4.64
AAC Decoder
Aangifte inkomstenbelasting 2007
Aangifte inkomstenbelasting 2008
AC3Filter (remove only)
Ad-Aware SE Personal
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 ActiveX
Adobe Photoshop 6.0
Adobe Reader 8.1.2 - Nederlands
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
µTorrent
AutoUpdate
avast! Antivirus
AVI/MPEG/ASF/WMV Splitter 3.25
AVIcodec (remove only)
Beveiligingsupdate for Windows Media Player 10 (KB911565)
Beveiligingsupdate for Windows Media Player 10 (KB917734)
Beveiligingsupdate for Windows XP (KB941569)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB928090)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB929969)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB931768)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB933566)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB937143)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB938127)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB939653)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB942615)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB944533)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB950759)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB953838)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB956390)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB958215)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB960714)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB961260)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB963027)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB971961)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB972260)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB974455)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB976325)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB978207)
Beveiligingsupdate voor Windows Media Player (KB911564)
Beveiligingsupdate voor Windows Media Player (KB952069)
Beveiligingsupdate voor Windows Media Player (KB954155)
Beveiligingsupdate voor Windows Media Player (KB968816)
Beveiligingsupdate voor Windows Media Player (KB973540)
Beveiligingsupdate voor Windows Media Player 11 (KB936782)
Beveiligingsupdate voor Windows Media Player 11 (KB954154)
Beveiligingsupdate voor Windows Media Player 6.4 (KB925398)
Beveiligingsupdate voor Windows XP (KB883939)
Beveiligingsupdate voor Windows XP (KB896688)
Beveiligingsupdate voor Windows XP (KB899588)
Beveiligingsupdate voor Windows XP (KB923561)
Beveiligingsupdate voor Windows XP (KB938464-v2)
Beveiligingsupdate voor Windows XP (KB938464)
Beveiligingsupdate voor Windows XP (KB946648)
Beveiligingsupdate voor Windows XP (KB950760)
Beveiligingsupdate voor Windows XP (KB950762)
Beveiligingsupdate voor Windows XP (KB950974)
Beveiligingsupdate voor Windows XP (KB951066)
Beveiligingsupdate voor Windows XP (KB951376-v2)
Beveiligingsupdate voor Windows XP (KB951376)
Beveiligingsupdate voor Windows XP (KB951698)
Beveiligingsupdate voor Windows XP (KB951748)
Beveiligingsupdate voor Windows XP (KB952004)
Beveiligingsupdate voor Windows XP (KB952954)
Beveiligingsupdate voor Windows XP (KB953839)
Beveiligingsupdate voor Windows XP (KB954211)
Beveiligingsupdate voor Windows XP (KB954459)
Beveiligingsupdate voor Windows XP (KB954600)
Beveiligingsupdate voor Windows XP (KB955069)
Beveiligingsupdate voor Windows XP (KB956391)
Beveiligingsupdate voor Windows XP (KB956572)
Beveiligingsupdate voor Windows XP (KB956744)
Beveiligingsupdate voor Windows XP (KB956802)
Beveiligingsupdate voor Windows XP (KB956803)
Beveiligingsupdate voor Windows XP (KB956841)
Beveiligingsupdate voor Windows XP (KB956844)
Beveiligingsupdate voor Windows XP (KB957095)
Beveiligingsupdate voor Windows XP (KB957097)
Beveiligingsupdate voor Windows XP (KB958644)
Beveiligingsupdate voor Windows XP (KB958687)
Beveiligingsupdate voor Windows XP (KB958690)
Beveiligingsupdate voor Windows XP (KB958869)
Beveiligingsupdate voor Windows XP (KB959426)
Beveiligingsupdate voor Windows XP (KB960225)
Beveiligingsupdate voor Windows XP (KB960715)
Beveiligingsupdate voor Windows XP (KB960803)
Beveiligingsupdate voor Windows XP (KB960859)
Beveiligingsupdate voor Windows XP (KB961371)
Beveiligingsupdate voor Windows XP (KB961373)
Beveiligingsupdate voor Windows XP (KB961501)
Beveiligingsupdate voor Windows XP (KB968537)
Beveiligingsupdate voor Windows XP (KB969059)
Beveiligingsupdate voor Windows XP (KB969898)
Beveiligingsupdate voor Windows XP (KB969947)
Beveiligingsupdate voor Windows XP (KB970238)
Beveiligingsupdate voor Windows XP (KB970430)
Beveiligingsupdate voor Windows XP (KB971486)
Beveiligingsupdate voor Windows XP (KB971557)
Beveiligingsupdate voor Windows XP (KB971633)
Beveiligingsupdate voor Windows XP (KB971657)
Beveiligingsupdate voor Windows XP (KB972270)
Beveiligingsupdate voor Windows XP (KB973346)
Beveiligingsupdate voor Windows XP (KB973354)
Beveiligingsupdate voor Windows XP (KB973507)
Beveiligingsupdate voor Windows XP (KB973525)
Beveiligingsupdate voor Windows XP (KB973869)
Beveiligingsupdate voor Windows XP (KB973904)
Beveiligingsupdate voor Windows XP (KB974112)
Beveiligingsupdate voor Windows XP (KB974318)
Beveiligingsupdate voor Windows XP (KB974392)
Beveiligingsupdate voor Windows XP (KB974571)
Beveiligingsupdate voor Windows XP (KB975025)
Beveiligingsupdate voor Windows XP (KB975467)
BULLFROG GAMEPAD
Canon MP Navigator EX 1.2
Canon MP190 series MP Drivers
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
CCleaner (remove only)
CDisplay 1.8
Compatibiliteitspakket voor het 2007 Microsoft Office system
CoreAAC Audio Decoder (remove only)
DAEMON Tools
DC++ 0.698
Direct Show Ogg Vorbis Filter (remove only)
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Download Accelerator Plus
DVD X Ghost 1.5
EA SPORTS online 2007
Essentiële update voor Windows Media Player 11 (KB959772)
ffdshow (remove only)
FLV Player 1.3.3
FLV Player 2.0 (build 25)
Gebruikersregistratie voor Canon MP190 series
GSA Delphi.Induc Cleaner v1.00
H.264 Decoder
Hijack This 1.99.1
HijackThis 1.99.1
hkSFV (remove only)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix voor Windows Internet Explorer 7 (KB947864)
Hotfix voor Windows Media Player 11 (KB939683)
Hotfix voor Windows XP (KB952287)
Hotfix voor Windows XP (KB970653-v3)
Hotfix voor Windows XP (KB976098-v2)
Huffyuv AVI lossless video codec (Remove Only)
ImTOO MPEG Encoder
InterVideo DeviceService
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2_05
Java Auto Updater
Java(TM) 6 Update 18
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1
Junk Mail filter update
MainConcept MPEG Encoder
MakeTorrent v2.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Editie 2003
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
mIRC
MKV Splitter
Move Networks Media Player for Internet Explorer
MP3 Player Utilities 4.05
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Musicmatch® Jukebox
Nero - Burning Rom
Nero 7 Premium
NVIDIA Drivers
NvMixer
oggcodecs 0.71.0946
Orange Livebox
Parche Stats NBA Live 07
PartyPoker
PokerStars
Pop-Up Stopper Professional
PPStream V2.6.86.8989 Final
Proxy Changer
QuickTime
RealPlayer
RegistryBooster 2
Roster Season 06-07 for NBA live 06
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile Composite Device Software
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
Security Update for CAPICOM (KB931906)
Segoe UI
SLD CODEC PACK 1.3
SopCast 3.2.4
Stream Torrent 1.0
The KMPlayer (remove only)
TigerGame Superjoy Box Series
Trillian
TVAnts 1.0
TVUPlayer 2.4.9.1
TypingMaster Pro
Update voor Windows Internet Explorer 8 (KB971930)
Update voor Windows Internet Explorer 8 (KB976749)
Update voor Windows XP (KB894391)
Update voor Windows XP (KB896727)
Update voor Windows XP (KB898461)
Update voor Windows XP (KB951072-v2)
Update voor Windows XP (KB951978)
Update voor Windows XP (KB955759)
Update voor Windows XP (KB955839)
Update voor Windows XP (KB961503)
Update voor Windows XP (KB967715)
Update voor Windows XP (KB968389)
Update voor Windows XP (KB971737)
Update voor Windows XP (KB973687)
Update voor Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
Veetle TV 0.9.15
Video to Audio Converter 1.00
VidGIF
VidGIF 2.3.0.1
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 3
WinRAR archiver
WinZip
Xilisoft MP4 Converter
XviD 1.1 final uninstall
ZoneAlarm Pro
ZoneAlarm Toolbar

==== End Of File ===========================

DDS (Ver_09-06-26.01) - NTFSx86
Run by K. Kuord at 0:56:18,95 on vr 29-01-2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.189 [GMT 1:00]

AV: Malware Defense *On-access scanning enabled* (Outdated) {28e00e3b-806e-4533-925c-f4c3d79514b9}
AV: *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

============== Running Processes ===============

C:\windows\system32\svchost -k DcomLaunch
svchost.exe
C:\windows\System32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\windows\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\windows\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\nvsvc32.exe
C:\windows\System32\svchost.exe -k imgsvc
C:\windows\system32\ctfmon.exe
C:\windows\system32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\K. Kuord\Bureaublad\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
uURLSearchHooks: H - No File
BHO: DAPHelper Class: {0000cc75-acf3-4cac-a0a9-dd3868e06852} - c:\program files\dap\DAPBHO.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: ZoneAlarm Toolbar Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live Aanmelden - Help: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: {00000000-5736-4205-0008-F7ED0776FB27} - No File
uRun: [PopUpStopperProfessional] "c:\program files\panicware\pop-up stopper professional\PopUpStopperProfessional.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NeroCheck] c:\windows\system32\\NeroCheck.exe
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [NWEReboot]
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [MimBoot] c:\progra~1\musicm~1\musicm~1\mimboot.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\menust~1\progra~1\opstar~1\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: &Download with &DAP - c:\progra~1\dap\dapextie.htm
IE: Add to AMV Converter... - c:\program files\mp3 player utilities 4.05\amvconverter\grab.html
IE: Download &all with DAP - c:\progra~1\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\mp3 player utilities 4.05\mediamanager\grab.html
IE: {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {669695BC-A811-4A9D-8CDF-BA8C795F261C} - c:\progra~1\dap\DAP.EXE
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java
DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - hxxp://p3p.sogou.com/MMCShell.cab
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} - hxxp://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} - hxxp://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} - hxxp://www.streamplug.com/StreamPlug/beta/SP.cab
DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} - hxxp://www.windowsecurity.com/trojanscan/TDECntrl.CAB
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} - hxxp://nba.tom.com/video/tcastV1.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} - hxxp://www.live365.com/players/play365.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - hxxp://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
AppInit_DLLs: pavwait.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli scecli scecli

============= SERVICES / DRIVERS ===============

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [2004-5-13 156800]
R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [2004-5-13 5248]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-1-14 114768]
R1 Cinemsup;Cinemsup;c:\windows\system32\drivers\cinemsup.sys [2002-7-19 6656]
R1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [2007-9-8 33824]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-1-22 482696]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-1-14 20560]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2009-9-4 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2009-9-4 435568]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2007-2-4 2368]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2010-1-14 138680]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2010-1-22 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2010-1-22 352920]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\pavsrk.sys --> c:\windows\system32\PavSRK.sys [?]
S4 cdawdm;CDAWDM;c:\windows\system32\drivers\cdawdm.sys --> c:\windows\system32\drivers\CDAWDM.sys [?]

=============== Created Last 30 ================

2010-01-27 22:38 <DIR> --d-hr-- c:\documents and settings\k. kuord\Onlangs geopend
2010-01-24 02:49 60 a------- c:\windows\MediaList.ini
2010-01-24 02:49 140 a------- c:\windows\powerlist.ini
2010-01-24 02:46 1,557 a------- c:\windows\psnetwork.ini
2010-01-24 02:46 849 a------- c:\windows\powerplayer.ini
2010-01-23 03:16 <DIR> --d----- c:\documents and settings\k. kuord\Downloads
2010-01-22 18:43 <DIR> --d----- c:\docume~1\k49eb~1.kuo\applic~1\CheckPoint
2010-01-22 18:42 <DIR> --d----- c:\program files\CheckPoint
2010-01-22 18:42 4,212 a---h--- c:\windows\system32\zllictbl.dat
2010-01-22 18:42 1,238,408 a------- c:\windows\system32\zpeng25.dll
2010-01-22 18:42 <DIR> --d----- c:\windows\system32\ZoneLabs
2010-01-22 18:42 418,012 a------- c:\windows\system32\vsconfig.xml
2010-01-22 18:42 <DIR> --d----- c:\program files\Zone Labs
2010-01-22 18:41 <DIR> --d----- c:\windows\Internet Logs
2010-01-21 00:09 <DIR> --d----- c:\program files\GSA Delphi.Induc Cleaner
2010-01-16 21:47 490 a---h--- C:\aaw7boot.cmd
2010-01-13 10:25 471,552 -c------ c:\windows\system32\dllcache\aclayers.dll
2010-01-12 23:37 <DIR> --d----- c:\windows\SxsCaPendDel
2010-01-12 23:22 53,248 a------- c:\windows\system32\Process.exe

==================== Find3M ====================

2010-01-23 01:28 411,368 a------- c:\windows\system32\deploytk.dll
2009-12-21 20:10 916,480 a------- c:\windows\system32\wininet.dll
2009-12-09 20:52 444,960 a------- c:\windows\system32\perfh013.dat
2009-12-09 20:52 70,426 a------- c:\windows\system32\perfc013.dat
2009-11-21 17:03 471,552 a------- c:\windows\apppatch\aclayers.dll
2009-11-01 20:42 39,916,560 a------- c:\docume~1\k49eb~1.kuo\applic~1\setupengpro.exe
2007-09-08 01:22 744 a------- c:\docume~1\k49eb~1.kuo\applic~1\filterclsid.dat
2004-02-14 15:44 457 a------- c:\program files\INSTALL.LOG
2006-06-15 20:24 56 ---shr-- c:\windows\system32\562AD544BF.sys
2008-10-25 22:01 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\geschiedenis\history.ie5\mshist012008102520081026\index.dat

============= FINISH: 0:59:10,26 ===============

Blade81 · Jan 29, 2010

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

µTorrent
MakeTorrent

I'd like you to read this thread.

Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).

After that:

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

shaft23 · Jan 31, 2010

hi blade..........i have removed the two programs, but the virus is not letting me visit the site you listed. Bleepincomputer gives me an empty explorer page.

Blade81 · Jan 31, 2010

Hi,

In that case, you have to download the file using other system and then transfer ComboFix to this infected system.

shaft23 · Feb 1, 2010

hi blade,

i have spent a while doing all of this, cause my system just refuses to work with me. I had to run combofix under another name: thunder.exe
I downloaded and uninstalled malwarebytes, cause it did not work at all on my system.

i finally got combofix to work and i have the 3 logs: combofix log, attatch.txt and dss.txt

NOTE; my combofix file is in Dutch, cause i'm in the netherlands.

ComboFix 10-01-31.03 - K. Kuord 01-02-2010 18:05:56.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.236 [GMT 1:00]
Gestart vanuit: c:\documents and settings\K. Kuord\Bureaublad\thunder.exe
AV: *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\h8srtkrl32mainweq.dll
c:\documents and settings\All Users\Application Data\h8srtmainqt.dll
C:\LOG.TXT
c:\program files\INSTALL.LOG
c:\program files\PC-Cleaner
c:\program files\PC-Cleaner\PCCleaner.exe
c:\program files\temp
c:\program files\temp\Riverdeep_ESD_03040717\0x0409.ini
c:\program files\temp\Riverdeep_ESD_03040717\1033.mst
c:\program files\temp\Riverdeep_ESD_03040717\409\about.bmp
c:\program files\temp\Riverdeep_ESD_03040717\409\About_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\Building_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\BuildProcess_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\BuildVCD_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\BuildVCDFromCD_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\chkmes_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\Create_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\Display_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\ESD\evalbg.bmp
c:\program files\temp\Riverdeep_ESD_03040717\409\EULA.TXT
c:\program files\temp\Riverdeep_ESD_03040717\409\Eval_rc.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\FsVcdCntntRc.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\IsoGenRc.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\Mgr.CHM
c:\program files\temp\Riverdeep_ESD_03040717\409\MGR_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\RcacheRC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\Readme.txt
c:\program files\temp\Riverdeep_ESD_03040717\409\Reseller\evalbg.bmp
c:\program files\temp\Riverdeep_ESD_03040717\409\VCDPROPRC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\VCkNFSRC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\VDIErrorRC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\vdrive_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\VDShellRc.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\vdtask_RC.dll
c:\program files\temp\Riverdeep_ESD_03040717\409\WebRegRC.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\About.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\atl.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Building.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\BuildProcess.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\BuildVCD.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\BuildVCDFromCD.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Chkmes.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\COMCTL32.DLL
c:\program files\temp\Riverdeep_ESD_03040717\Files\Create.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\Display.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Drivers\SmartCd.sys
c:\program files\temp\Riverdeep_ESD_03040717\Files\Drivers\Win2kXP\cdawdm.sys
c:\program files\temp\Riverdeep_ESD_03040717\Files\Drivers\WinNT\cdawdm.sys
c:\program files\temp\Riverdeep_ESD_03040717\Files\DxpApp.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\EJECT.AVI
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\AOLOffer.bmp
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\AOLOffer.htm
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd1.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd10.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd2.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd3.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd4.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd5.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd6.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd7.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd8.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\bbd9.jpg
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\broderbund.bmp
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\broderbund.css
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\Broderbund.gif
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\Broderbund.ico
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\browser.htm
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\Connect.htm
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\Cou_sta.ini
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\DontForget.htm
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\Edmark.bmp
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\edmark.css
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\edmark.gif
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\Edmark.ico
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\EPost.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\EReg32.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\ereg32.ini
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\EREGLB32.DLL
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\EregMain.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\eregmodem.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\ErrorPage.htm
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\include.js
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\LocalReg.htm
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\MailFax.ini
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\privacy.txt
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\StartPage.htm
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\SuELUSAr.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\ThankYou12.htm
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\TLC.bmp
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\tlc.css
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\tlc.gif
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\TLC.ICO
c:\program files\temp\Riverdeep_ESD_03040717\Files\Ereg\WebReg.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\ESD\Eval.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\farstone.avi
c:\program files\temp\Riverdeep_ESD_03040717\Files\FarTCP.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\FsGetVcdInfo.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\FSHotKey.VXD
c:\program files\temp\Riverdeep_ESD_03040717\Files\FsLoadLibrary.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\FsVcdCntnt.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\GOEMs\Eval.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\hhupd.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\INF\Win2k\cdawdm.inf
c:\program files\temp\Riverdeep_ESD_03040717\Files\INF\Win9x\CDAWDM.inf
c:\program files\temp\Riverdeep_ESD_03040717\Files\INF\WINNTXP\cdawdm.inf
c:\program files\temp\Riverdeep_ESD_03040717\Files\INSERT.AVI
c:\program files\temp\Riverdeep_ESD_03040717\Files\Iosubsys\CDAWDM.MPD
c:\program files\temp\Riverdeep_ESD_03040717\Files\Iosubsys\CDIO32X.VXD
c:\program files\temp\Riverdeep_ESD_03040717\Files\Iosubsys\RCACHEX.VXD
c:\program files\temp\Riverdeep_ESD_03040717\Files\IsoGen.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Logo.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\MGR.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\MGR.ico
c:\program files\temp\Riverdeep_ESD_03040717\Files\MM10.cab
c:\program files\temp\Riverdeep_ESD_03040717\Files\MM77.cab
c:\program files\temp\Riverdeep_ESD_03040717\Files\msvcp60.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\NFlist.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\OLEAUT32.DLL
c:\program files\temp\Riverdeep_ESD_03040717\Files\psapi.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\rc5_cmp.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\asycfilt.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\comcat.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\comct232.ocx
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\comctl32.ocx
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\mfc42.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\mscomctl.ocx
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\msvcirt.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\msvcp60.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\msvcrt.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\oleaut32.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\olepro32.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\Redist\MS\System\stdole2.tlb
c:\program files\temp\Riverdeep_ESD_03040717\Files\REFRESH.DLL
c:\program files\temp\Riverdeep_ESD_03040717\Files\Refresh32.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\REGSVR32.EXE
c:\program files\temp\Riverdeep_ESD_03040717\Files\Reseller\Eval.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\Setup.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\ShowCpyr.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\SndFmt.sav
c:\program files\temp\Riverdeep_ESD_03040717\Files\vcdplayx.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\VCDPROP.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\VCkNFS.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\VDFiles.cab
c:\program files\temp\Riverdeep_ESD_03040717\Files\VDIError.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\VDrive.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\VDShell.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\vdtask.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\WebReg.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\Win9x\rCache.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\WinNT\comctl32.dll
c:\program files\temp\Riverdeep_ESD_03040717\Files\WinNT\rCache.EXE
c:\program files\temp\Riverdeep_ESD_03040717\Files\WMFASetup.exe
c:\program files\temp\Riverdeep_ESD_03040717\Files\WNASPI32.DLL
c:\program files\temp\Riverdeep_ESD_03040717\instmsia.exe
c:\program files\temp\Riverdeep_ESD_03040717\instmsiw.exe
c:\program files\temp\Riverdeep_ESD_03040717\isscript.msi
c:\program files\temp\Riverdeep_ESD_03040717\logo.bmp
c:\program files\temp\Riverdeep_ESD_03040717\setup.exe
c:\program files\temp\Riverdeep_ESD_03040717\Setup.ini
c:\program files\temp\Riverdeep_ESD_03040717\vdp.cab
c:\program files\temp\Riverdeep_ESD_03040717\VirtualDrive.msi
c:\windows\BackUp
c:\windows\Downloaded Program Files\rave
c:\windows\Downloaded Program Files\rave\avirexe.vdm
c:\windows\Downloaded Program Files\rave\avirscr.vdm
c:\windows\Downloaded Program Files\rave\base.vdm
c:\windows\Downloaded Program Files\rave\daily.vdm
c:\windows\Downloaded Program Files\rave\daily.vdt
c:\windows\Downloaded Program Files\rave\filters.vdm
c:\windows\Downloaded Program Files\rave\kernel.vdk
c:\windows\Downloaded Program Files\rave\keyring.vdk
c:\windows\Downloaded Program Files\rave\mapi_vdm.vdm
c:\windows\Downloaded Program Files\rave\modules.vdk
c:\windows\Downloaded Program Files\rave\rav8def.vdm
c:\windows\Downloaded Program Files\rave\rufs.vdm
c:\windows\Downloaded Program Files\rave\rufsplg.vdm
c:\windows\Downloaded Program Files\rave\unarch.vdm
c:\windows\Downloaded Program Files\rave\unmail.vdm
c:\windows\Downloaded Program Files\rave\unpack.vdm
c:\windows\EventSystem.log
c:\windows\patch.exe
c:\windows\Readme.txt
c:\windows\struct~.ini
c:\windows\system32\drivers\H8SRTymxbnevppx.sys
c:\windows\system32\H8SRTdamdiybwve.dll
c:\windows\system32\H8SRTigouhtapqj.dat
c:\windows\system32\h8srtkrl32mainweq.dll
c:\windows\system32\H8SRTngqltqsmpl.dll
c:\windows\system32\h8srtshsyst.dll
c:\windows\system32\H8SRTuwuruunrhp.dll
c:\windows\system32\H8SRTxjeltcbvdy.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys
-------\Legacy_OREANS32
-------\Service_oreans32

(((((((((((((((((((( Bestanden Gemaakt van 2010-01-01 to 2010-02-01 ))))))))))))))))))))))))))))))
.

2010-02-01 13:32 . 2010-02-01 13:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-31 03:08 . 2010-01-31 03:08 -------- d--h--r- c:\documents and settings\K. Kuord\Onlangs geopend
2010-01-23 02:16 . 2010-01-23 02:16 -------- d-----w- c:\documents and settings\K. Kuord\Downloads
2010-01-22 17:43 . 2010-01-22 17:43 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\CheckPoint
2010-01-22 17:41 . 2010-02-01 17:30 -------- d-----w- c:\windows\Internet Logs
2010-01-20 23:09 . 2010-01-20 23:09 -------- d-----w- c:\program files\GSA Delphi.Induc Cleaner
2010-01-16 20:47 . 2010-01-16 20:47 490 ---ha-w- C:\aaw7boot.cmd
2010-01-16 15:16 . 2010-01-16 15:16 -------- d-----w- c:\documents and settings\LocalService\Bureaublad
2010-01-15 13:06 . 2010-01-18 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-13 09:25 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-12 22:37 . 2010-01-12 22:54 -------- d-----w- c:\windows\SxsCaPendDel
2010-01-12 17:11 . 2010-01-12 17:11 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-01 12:32 . 2005-11-24 23:11 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\uTorrent
2010-01-31 03:07 . 2009-08-09 15:20 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\vlc
2010-01-28 16:55 . 2007-12-04 14:24 -------- d-----w- c:\program files\PartyGaming
2010-01-28 09:56 . 2006-10-08 20:36 -------- d-----w- c:\program files\Hijack This
2010-01-27 12:26 . 2006-04-11 23:54 -------- d-----w- c:\program files\PPStream
2010-01-24 01:47 . 2005-12-26 01:26 -------- d-----w- c:\program files\tvants
2010-01-24 01:46 . 2006-12-15 02:25 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\ppStream
2010-01-23 00:28 . 2004-11-10 14:18 -------- d-----w- c:\program files\Common Files\Java
2010-01-23 00:28 . 2008-12-18 11:47 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-22 17:50 . 2010-01-22 17:42 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-01-22 17:42 . 2010-01-22 17:42 -------- d-----w- c:\program files\CheckPoint
2010-01-22 17:42 . 2010-01-22 17:42 -------- d-----w- c:\program files\Zone Labs
2010-01-21 22:16 . 2007-08-01 10:11 -------- d-----w- c:\program files\AVI MPEG ASF WMV Splitter
2010-01-20 14:42 . 2009-02-18 19:29 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-18 15:24 . 2006-04-05 13:41 -------- d-----w- c:\program files\Lavasoft
2009-12-28 20:24 . 2009-12-18 13:31 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\Belastingdienst
2009-12-21 19:10 . 2005-10-21 14:51 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-18 20:22 . 2008-04-22 02:12 -------- d-----w- c:\program files\PokerStars
2009-12-13 19:50 . 2007-02-18 01:42 -------- d-----w- c:\program files\SopCast
2009-12-09 19:52 . 2003-04-08 12:00 70426 ----a-w- c:\windows\system32\perfc013.dat
2009-12-09 19:52 . 2003-04-08 12:00 444960 ----a-w- c:\windows\system32\perfh013.dat
2009-11-17 19:38 . 2008-03-11 21:23 87512 ----a-w- c:\documents and settings\shahla en dawood\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-06-15 19:24 . 2004-05-05 16:54 56 --sh--r- c:\windows\system32\562AD544BF.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpStopperProfessional"="c:\program files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe" [2005-06-02 516096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\\NeroCheck.exe" [2001-07-09 155648]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 131072]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2005-05-10 11776]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-10-25 652624]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-09-13 1603152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-09-22 1011080]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2009-09-04 722288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-2-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PPStream\\PPStream.exe"=
"c:\\Program Files\\Trillian\\trillian.exe"=
"c:\\Program Files\\tvants\\Tvants.exe"=
"c:\\Documents and Settings\\K. Kuord\\Mijn documenten\\appz\\utorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\PPStream\\PPSAP.exe"=
"c:\\Documents and Settings\\K. Kuord\\Local Settings\\Application Data\\RayV\\RayV.dll"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3594:TCP"= 3594:TCP

pLive
"2186:UDP"= 2186:UDP

pLive

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [13-5-2004 16:02 156800]
R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [13-5-2004 16:02 5248]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [4-9-2009 13:53 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [4-9-2009 13:54 435568]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [4-2-2007 18:43 2368]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
S4 cdawdm;CDAWDM;c:\windows\system32\DRIVERS\CDAWDM.sys --> c:\windows\system32\DRIVERS\CDAWDM.sys [?]
.
Inhoud van de 'Gedeelde Taken' map

2010-01-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
IE: &Download with &DAP - c:\progra~1\DAP\dapextie.htm
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.05\AMVConverter\grab.html
IE: Download &all with DAP - c:\progra~1\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.05\MediaManager\grab.html
IE: {{022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java
DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - hxxp://p3p.sogou.com/MMCShell.cab
DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} - hxxp://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} - hxxp://nba.tom.com/video/tcastV1.cab
DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - hxxp://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
.
- - - - ORPHANS VERWIJDERD - - - -

HKLM-Run-NWEReboot - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-01 18:31
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x82BADF00]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf8725f28
\Driver\ACPI -> ACPI.sys @ 0xf8640cb8
\Driver\atapi -> atapi.sys @ 0xf85e0852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
user & kernel MBR OK

**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-1409082233-606747145-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8A13AB9F-0214-342E-0FA0-CAA388CD5A84}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iahegomlhbmgnoeojc"=hex:6b,61,67,68,6c,61,68,63,6d,6f,6c,62,69,70,61,6e,64,6d,
70,68,66,62,00,82
"hancebfpikekmpha"=hex:6b,61,67,68,6c,61,68,63,6d,6f,6c,62,69,70,61,6e,64,6d,
70,68,66,62,00,82

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(576)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'lsass.exe'(632)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'explorer.exe'(3964)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\RUNDLL32.EXE
c:\progra~1\MUSICM~1\MUSICM~1\MMDiag.exe
c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Voltooingstijd: 2010-02-01 18:48:02 - machine werd herstart
ComboFix-quarantined-files.txt 2010-02-01 17:47

Pre-Run: 2.069.479.424 bytes beschikbaar
Post-Run: 2.014.486.528 bytes beschikbaar

- - End Of File - - 2F832F862FD02D65558E7DD8EF1261FA

DDS (Ver_09-06-26.01) - NTFSx86
Run by K. Kuord at 18:51:20,79 on ma 01-02-2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.225 [GMT 1:00]

AV: *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: ZoneAlarm Pro Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\windows\system32\svchost -k DcomLaunch
svchost.exe
C:\windows\System32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\windows\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\nvsvc32.exe
C:\windows\System32\svchost.exe -k imgsvc
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\windows\system32\wscntfy.exe
C:\windows\system32\RUNDLL32.EXE
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\explorer.exe
C:\windows\system32\notepad.exe
C:\windows\system32\ctfmon.exe
C:\Documents and Settings\K. Kuord\Bureaublad\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
uURLSearchHooks: H - No File
BHO: DAPHelper Class: {0000cc75-acf3-4cac-a0a9-dd3868e06852} - c:\program files\dap\DAPBHO.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: ZoneAlarm Toolbar Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live Aanmelden - Help: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: {00000000-5736-4205-0008-F7ED0776FB27} - No File
uRun: [PopUpStopperProfessional] "c:\program files\panicware\pop-up stopper professional\PopUpStopperProfessional.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NeroCheck] c:\windows\system32\\NeroCheck.exe
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [MimBoot] c:\progra~1\musicm~1\musicm~1\mimboot.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\menust~1\progra~1\opstar~1\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: &Download with &DAP - c:\progra~1\dap\dapextie.htm
IE: Add to AMV Converter... - c:\program files\mp3 player utilities 4.05\amvconverter\grab.html
IE: Download &all with DAP - c:\progra~1\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\mp3 player utilities 4.05\mediamanager\grab.html
IE: {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {669695BC-A811-4A9D-8CDF-BA8C795F261C} - c:\progra~1\dap\DAP.EXE
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java
DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - hxxp://p3p.sogou.com/MMCShell.cab
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} - hxxp://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} - hxxp://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} - hxxp://www.streamplug.com/StreamPlug/beta/SP.cab
DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} - hxxp://www.windowsecurity.com/trojanscan/TDECntrl.CAB
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} - hxxp://nba.tom.com/video/tcastV1.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} - hxxp://www.live365.com/players/play365.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - hxxp://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [2004-5-13 156800]
R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [2004-5-13 5248]
R1 Cinemsup;Cinemsup;c:\windows\system32\drivers\cinemsup.sys [2002-7-19 6656]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-1-22 482696]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2009-9-4 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2009-9-4 435568]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2007-2-4 2368]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\pavsrk.sys --> c:\windows\system32\PavSRK.sys [?]
S4 cdawdm;CDAWDM;c:\windows\system32\drivers\cdawdm.sys --> c:\windows\system32\drivers\CDAWDM.sys [?]

=============== Created Last 30 ================

2010-02-01 17:11 261,632 a------- c:\windows\PEV.exe
2010-02-01 17:11 161,792 a------- c:\windows\SWREG.exe
2010-02-01 17:11 98,816 a------- c:\windows\sed.exe
2010-02-01 17:11 77,312 a------- c:\windows\MBR.exe
2010-02-01 14:32 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2010-01-31 04:08 <DIR> --d-hr-- c:\documents and settings\k. kuord\Onlangs geopend
2010-01-24 02:49 60 a------- c:\windows\MediaList.ini
2010-01-24 02:49 140 a------- c:\windows\powerlist.ini
2010-01-24 02:46 1,557 a------- c:\windows\psnetwork.ini
2010-01-24 02:46 849 a------- c:\windows\powerplayer.ini
2010-01-23 03:16 <DIR> --d----- c:\documents and settings\k. kuord\Downloads
2010-01-22 18:43 <DIR> --d----- c:\docume~1\k49eb~1.kuo\applic~1\CheckPoint
2010-01-22 18:42 <DIR> --d----- c:\program files\CheckPoint
2010-01-22 18:42 4,212 a---h--- c:\windows\system32\zllictbl.dat
2010-01-22 18:42 1,238,408 a------- c:\windows\system32\zpeng25.dll
2010-01-22 18:42 <DIR> --d----- c:\windows\system32\ZoneLabs
2010-01-22 18:42 418,012 a------- c:\windows\system32\vsconfig.xml
2010-01-22 18:42 <DIR> --d----- c:\program files\Zone Labs
2010-01-22 18:41 <DIR> --d----- c:\windows\Internet Logs
2010-01-21 00:09 <DIR> --d----- c:\program files\GSA Delphi.Induc Cleaner
2010-01-16 21:47 490 a---h--- C:\aaw7boot.cmd
2010-01-13 10:25 471,552 -c------ c:\windows\system32\dllcache\aclayers.dll
2010-01-12 23:37 <DIR> --d----- c:\windows\SxsCaPendDel

==================== Find3M ====================

2010-01-23 01:28 411,368 a------- c:\windows\system32\deploytk.dll
2009-12-21 20:10 916,480 -------- c:\windows\system32\wininet.dll
2009-12-09 20:52 444,960 a------- c:\windows\system32\perfh013.dat
2009-12-09 20:52 70,426 a------- c:\windows\system32\perfc013.dat
2009-11-21 17:03 471,552 a------- c:\windows\apppatch\aclayers.dll
2009-11-01 20:42 39,916,560 a------- c:\docume~1\k49eb~1.kuo\applic~1\setupengpro.exe
2007-09-08 01:22 744 a------- c:\docume~1\k49eb~1.kuo\applic~1\filterclsid.dat
2006-06-15 20:24 56 ---shr-- c:\windows\system32\562AD544BF.sys
2008-10-25 22:01 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\geschiedenis\history.ie5\mshist012008102520081026\index.dat

============= FINISH: 18:51:48,78 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 7-2-2004 10:53:25
System Uptime: 2-1-2010 18:27:16 (720 hours ago)

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-6570
Processor: AMD Athlon(tm) XP 2600+ | Socket A | 1913/166mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 1,911 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is CDROM ()
K: is CDROM ()
L: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

7-Zip 4.64
AAC Decoder
Aangifte inkomstenbelasting 2007
Aangifte inkomstenbelasting 2008
AC3Filter (remove only)
Ad-Aware SE Personal
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 ActiveX
Adobe Photoshop 6.0
Adobe Reader 8.1.2 - Nederlands
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVI/MPEG/ASF/WMV Splitter 3.25
AVIcodec (remove only)
Beveiligingsupdate for Windows Media Player 10 (KB911565)
Beveiligingsupdate for Windows Media Player 10 (KB917734)
Beveiligingsupdate for Windows XP (KB941569)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB928090)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB929969)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB931768)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB933566)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB937143)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB938127)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB939653)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB942615)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB944533)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB950759)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB953838)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB956390)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB958215)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB960714)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB961260)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB963027)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB971961)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB972260)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB974455)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB976325)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB978207)
Beveiligingsupdate voor Windows Media Player (KB911564)
Beveiligingsupdate voor Windows Media Player (KB952069)
Beveiligingsupdate voor Windows Media Player (KB954155)
Beveiligingsupdate voor Windows Media Player (KB968816)
Beveiligingsupdate voor Windows Media Player (KB973540)
Beveiligingsupdate voor Windows Media Player 11 (KB936782)
Beveiligingsupdate voor Windows Media Player 11 (KB954154)
Beveiligingsupdate voor Windows Media Player 6.4 (KB925398)
Beveiligingsupdate voor Windows XP (KB883939)
Beveiligingsupdate voor Windows XP (KB896688)
Beveiligingsupdate voor Windows XP (KB899588)
Beveiligingsupdate voor Windows XP (KB923561)
Beveiligingsupdate voor Windows XP (KB938464-v2)
Beveiligingsupdate voor Windows XP (KB938464)
Beveiligingsupdate voor Windows XP (KB946648)
Beveiligingsupdate voor Windows XP (KB950760)
Beveiligingsupdate voor Windows XP (KB950762)
Beveiligingsupdate voor Windows XP (KB950974)
Beveiligingsupdate voor Windows XP (KB951066)
Beveiligingsupdate voor Windows XP (KB951376-v2)
Beveiligingsupdate voor Windows XP (KB951376)
Beveiligingsupdate voor Windows XP (KB951698)
Beveiligingsupdate voor Windows XP (KB951748)
Beveiligingsupdate voor Windows XP (KB952004)
Beveiligingsupdate voor Windows XP (KB952954)
Beveiligingsupdate voor Windows XP (KB953839)
Beveiligingsupdate voor Windows XP (KB954211)
Beveiligingsupdate voor Windows XP (KB954459)
Beveiligingsupdate voor Windows XP (KB954600)
Beveiligingsupdate voor Windows XP (KB955069)
Beveiligingsupdate voor Windows XP (KB956391)
Beveiligingsupdate voor Windows XP (KB956572)
Beveiligingsupdate voor Windows XP (KB956744)
Beveiligingsupdate voor Windows XP (KB956802)
Beveiligingsupdate voor Windows XP (KB956803)
Beveiligingsupdate voor Windows XP (KB956841)
Beveiligingsupdate voor Windows XP (KB956844)
Beveiligingsupdate voor Windows XP (KB957095)
Beveiligingsupdate voor Windows XP (KB957097)
Beveiligingsupdate voor Windows XP (KB958644)
Beveiligingsupdate voor Windows XP (KB958687)
Beveiligingsupdate voor Windows XP (KB958690)
Beveiligingsupdate voor Windows XP (KB958869)
Beveiligingsupdate voor Windows XP (KB959426)
Beveiligingsupdate voor Windows XP (KB960225)
Beveiligingsupdate voor Windows XP (KB960715)
Beveiligingsupdate voor Windows XP (KB960803)
Beveiligingsupdate voor Windows XP (KB960859)
Beveiligingsupdate voor Windows XP (KB961371)
Beveiligingsupdate voor Windows XP (KB961373)
Beveiligingsupdate voor Windows XP (KB961501)
Beveiligingsupdate voor Windows XP (KB968537)
Beveiligingsupdate voor Windows XP (KB969059)
Beveiligingsupdate voor Windows XP (KB969898)
Beveiligingsupdate voor Windows XP (KB969947)
Beveiligingsupdate voor Windows XP (KB970238)
Beveiligingsupdate voor Windows XP (KB970430)
Beveiligingsupdate voor Windows XP (KB971486)
Beveiligingsupdate voor Windows XP (KB971557)
Beveiligingsupdate voor Windows XP (KB971633)
Beveiligingsupdate voor Windows XP (KB971657)
Beveiligingsupdate voor Windows XP (KB972270)
Beveiligingsupdate voor Windows XP (KB973346)
Beveiligingsupdate voor Windows XP (KB973354)
Beveiligingsupdate voor Windows XP (KB973507)
Beveiligingsupdate voor Windows XP (KB973525)
Beveiligingsupdate voor Windows XP (KB973869)
Beveiligingsupdate voor Windows XP (KB973904)
Beveiligingsupdate voor Windows XP (KB974112)
Beveiligingsupdate voor Windows XP (KB974318)
Beveiligingsupdate voor Windows XP (KB974392)
Beveiligingsupdate voor Windows XP (KB974571)
Beveiligingsupdate voor Windows XP (KB975025)
Beveiligingsupdate voor Windows XP (KB975467)
BULLFROG GAMEPAD
Canon MP Navigator EX 1.2
Canon MP190 series MP Drivers
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
CCleaner (remove only)
CDisplay 1.8
Compatibiliteitspakket voor het 2007 Microsoft Office system
CoreAAC Audio Decoder (remove only)
DC++ 0.698
Direct Show Ogg Vorbis Filter (remove only)
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Download Accelerator Plus
DVD X Ghost 1.5
EA SPORTS online 2007
Essentiële update voor Windows Media Player 11 (KB959772)
ffdshow (remove only)
FLV Player 1.3.3
FLV Player 2.0 (build 25)
Gebruikersregistratie voor Canon MP190 series
GSA Delphi.Induc Cleaner v1.00
H.264 Decoder
Hijack This 1.99.1
HijackThis 1.99.1
hkSFV (remove only)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix voor Windows Internet Explorer 7 (KB947864)
Hotfix voor Windows Media Player 11 (KB939683)
Hotfix voor Windows XP (KB952287)
Hotfix voor Windows XP (KB970653-v3)
Hotfix voor Windows XP (KB976098-v2)
Huffyuv AVI lossless video codec (Remove Only)
ImTOO MPEG Encoder
InterVideo DeviceService
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2_05
Java Auto Updater
Java(TM) 6 Update 18
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1
Junk Mail filter update
MainConcept MPEG Encoder
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Editie 2003
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
mIRC
MKV Splitter
Move Networks Media Player for Internet Explorer
MP3 Player Utilities 4.05
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Musicmatch® Jukebox
Nero - Burning Rom
Nero 7 Premium
NVIDIA Drivers
NvMixer
oggcodecs 0.71.0946
Orange Livebox
Parche Stats NBA Live 07
PartyPoker
PokerStars
Pop-Up Stopper Professional
PPStream V2.6.86.8989 Final
Proxy Changer
QuickTime
RealPlayer
RegistryBooster 2
Roster Season 06-07 for NBA live 06
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile Composite Device Software
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
Security Update for CAPICOM (KB931906)
Segoe UI
SLD CODEC PACK 1.3
SopCast 3.2.4
Stream Torrent 1.0
The KMPlayer (remove only)
TigerGame Superjoy Box Series
Trillian
TVAnts 1.0
TVUPlayer 2.4.9.1
TypingMaster Pro
Update voor Windows Internet Explorer 8 (KB971930)
Update voor Windows Internet Explorer 8 (KB976749)
Update voor Windows XP (KB894391)
Update voor Windows XP (KB896727)
Update voor Windows XP (KB898461)
Update voor Windows XP (KB951072-v2)
Update voor Windows XP (KB951978)
Update voor Windows XP (KB955759)
Update voor Windows XP (KB955839)
Update voor Windows XP (KB961503)
Update voor Windows XP (KB967715)
Update voor Windows XP (KB968389)
Update voor Windows XP (KB971737)
Update voor Windows XP (KB973687)
Update voor Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
Veetle TV 0.9.15
Video to Audio Converter 1.00
VidGIF
VidGIF 2.3.0.1
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 3
WinRAR archiver
WinZip
Xilisoft MP4 Converter
XviD 1.1 final uninstall
ZoneAlarm Pro
ZoneAlarm Toolbar

==== End Of File ===========================

Blade81 · Feb 1, 2010

Hi,

Seems that I missed DC++ in my previous post. Please uninstall it. Run ComboFix again and let it install recovery console if asked for a permission.

shaft23 · Feb 1, 2010

hi blade,

haven't had the radio ads today yet and the extra iexplorer.exe isn't running on its own anymore.

Here are the logs again:

ComboFix 10-02-01.02 - K. Kuord 01-02-2010 22:59:09.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.258 [GMT 1:00]
Gestart vanuit: c:\documents and settings\K. Kuord\Bureaublad\thunder.exe
AV: *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: ZoneAlarm Pro Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((( Bestanden Gemaakt van 2010-01-01 to 2010-02-01 ))))))))))))))))))))))))))))))
.

2010-02-01 13:32 . 2010-02-01 13:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-31 03:08 . 2010-02-01 17:57 -------- d--h--r- c:\documents and settings\K. Kuord\Onlangs geopend
2010-01-23 02:16 . 2010-01-23 02:16 -------- d-----w- c:\documents and settings\K. Kuord\Downloads
2010-01-22 17:43 . 2010-01-22 17:43 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\CheckPoint
2010-01-22 17:41 . 2010-02-01 20:27 -------- d-----w- c:\windows\Internet Logs
2010-01-20 23:09 . 2010-01-20 23:09 -------- d-----w- c:\program files\GSA Delphi.Induc Cleaner
2010-01-16 20:47 . 2010-01-16 20:47 490 ---ha-w- C:\aaw7boot.cmd
2010-01-16 15:16 . 2010-01-16 15:16 -------- d-----w- c:\documents and settings\LocalService\Bureaublad
2010-01-15 13:06 . 2010-01-18 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-13 09:25 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-12 22:37 . 2010-01-12 22:54 -------- d-----w- c:\windows\SxsCaPendDel
2010-01-12 17:11 . 2010-01-12 17:11 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-01 12:32 . 2005-11-24 23:11 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\uTorrent
2010-01-31 03:07 . 2009-08-09 15:20 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\vlc
2010-01-28 16:55 . 2007-12-04 14:24 -------- d-----w- c:\program files\PartyGaming
2010-01-28 09:56 . 2006-10-08 20:36 -------- d-----w- c:\program files\Hijack This
2010-01-27 12:26 . 2006-04-11 23:54 -------- d-----w- c:\program files\PPStream
2010-01-24 01:47 . 2005-12-26 01:26 -------- d-----w- c:\program files\tvants
2010-01-24 01:46 . 2006-12-15 02:25 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\ppStream
2010-01-23 00:28 . 2004-11-10 14:18 -------- d-----w- c:\program files\Common Files\Java
2010-01-23 00:28 . 2008-12-18 11:47 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-22 17:50 . 2010-01-22 17:42 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-01-22 17:42 . 2010-01-22 17:42 -------- d-----w- c:\program files\CheckPoint
2010-01-22 17:42 . 2010-01-22 17:42 -------- d-----w- c:\program files\Zone Labs
2010-01-21 22:16 . 2007-08-01 10:11 -------- d-----w- c:\program files\AVI MPEG ASF WMV Splitter
2010-01-20 14:42 . 2009-02-18 19:29 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-18 15:24 . 2006-04-05 13:41 -------- d-----w- c:\program files\Lavasoft
2009-12-28 20:24 . 2009-12-18 13:31 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\Belastingdienst
2009-12-21 19:10 . 2005-10-21 14:51 916480 ------w- c:\windows\system32\wininet.dll
2009-12-18 20:22 . 2008-04-22 02:12 -------- d-----w- c:\program files\PokerStars
2009-12-13 19:50 . 2007-02-18 01:42 -------- d-----w- c:\program files\SopCast
2009-12-09 19:52 . 2003-04-08 12:00 70426 ----a-w- c:\windows\system32\perfc013.dat
2009-12-09 19:52 . 2003-04-08 12:00 444960 ----a-w- c:\windows\system32\perfh013.dat
2009-11-21 16:03 . 2004-11-30 09:44 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-17 19:38 . 2008-03-11 21:23 87512 ----a-w- c:\documents and settings\shahla en dawood\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-06-15 19:24 . 2004-05-05 16:54 56 --sh--r- c:\windows\system32\562AD544BF.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpStopperProfessional"="c:\program files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe" [2005-06-02 516096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\\NeroCheck.exe" [2001-07-09 155648]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 131072]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2005-05-10 11776]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-10-25 652624]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-09-13 1603152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-09-22 1011080]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2009-09-04 722288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-2-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PPStream\\PPStream.exe"=
"c:\\Program Files\\Trillian\\trillian.exe"=
"c:\\Program Files\\tvants\\Tvants.exe"=
"c:\\Documents and Settings\\K. Kuord\\Mijn documenten\\appz\\utorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\PPStream\\PPSAP.exe"=
"c:\\Documents and Settings\\K. Kuord\\Local Settings\\Application Data\\RayV\\RayV.dll"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3594:TCP"= 3594:TCP

pLive
"2186:UDP"= 2186:UDP

pLive

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [13-5-2004 16:02 156800]
R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [13-5-2004 16:02 5248]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [4-9-2009 13:53 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [4-9-2009 13:54 435568]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [4-2-2007 18:43 2368]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
S4 cdawdm;CDAWDM;c:\windows\system32\DRIVERS\CDAWDM.sys --> c:\windows\system32\DRIVERS\CDAWDM.sys [?]
.
Inhoud van de 'Gedeelde Taken' map

2010-01-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
IE: &Download with &DAP - c:\progra~1\DAP\dapextie.htm
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.05\AMVConverter\grab.html
IE: Download &all with DAP - c:\progra~1\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.05\MediaManager\grab.html
IE: {{022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java
DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - hxxp://p3p.sogou.com/MMCShell.cab
DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} - hxxp://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} - hxxp://nba.tom.com/video/tcastV1.cab
DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - hxxp://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-01 23:14
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x82BADF00]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf8725f28
\Driver\ACPI -> ACPI.sys @ 0xf8640cb8
\Driver\atapi -> atapi.sys @ 0xf85e0852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
user & kernel MBR OK

**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-1409082233-606747145-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8A13AB9F-0214-342E-0FA0-CAA388CD5A84}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iahegomlhbmgnoeojc"=hex:6b,61,67,68,6c,61,68,63,6d,6f,6c,62,69,70,61,6e,64,6d,
70,68,66,62,00,82
"hancebfpikekmpha"=hex:6b,61,67,68,6c,61,68,63,6d,6f,6c,62,69,70,61,6e,64,6d,
70,68,66,62,00,82

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(576)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'lsass.exe'(632)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'explorer.exe'(3528)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\program files\Panicware\Pop-Up Stopper Professional\XAHook.dll
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.NLD
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Voltooingstijd: 2010-02-01 23:25:45
ComboFix-quarantined-files.txt 2010-02-01 22:25

Pre-Run: 2.018.332.672 bytes beschikbaar
Post-Run: 2.017.058.816 bytes beschikbaar

- - End Of File - - C52FA121B71F8CEBA8B849D4E5CFBADD

DDS (Ver_09-06-26.01) - NTFSx86
Run by K. Kuord at 23:27:27,64 on ma 01-02-2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.211 [GMT 1:00]

AV: *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: ZoneAlarm Pro Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\windows\system32\svchost -k DcomLaunch
svchost.exe
C:\windows\System32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\windows\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\nvsvc32.exe
C:\windows\System32\svchost.exe -k imgsvc
C:\windows\system32\wscntfy.exe
C:\windows\system32\RUNDLL32.EXE
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\system32\ctfmon.exe
C:\windows\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\K. Kuord\Bureaublad\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
uURLSearchHooks: H - No File
BHO: DAPHelper Class: {0000cc75-acf3-4cac-a0a9-dd3868e06852} - c:\program files\dap\DAPBHO.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: ZoneAlarm Toolbar Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live Aanmelden - Help: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: {00000000-5736-4205-0008-F7ED0776FB27} - No File
uRun: [PopUpStopperProfessional] "c:\program files\panicware\pop-up stopper professional\PopUpStopperProfessional.exe"
mRun: [NeroCheck] c:\windows\system32\\NeroCheck.exe
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [MimBoot] c:\progra~1\musicm~1\musicm~1\mimboot.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\menust~1\progra~1\opstar~1\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: &Download with &DAP - c:\progra~1\dap\dapextie.htm
IE: Add to AMV Converter... - c:\program files\mp3 player utilities 4.05\amvconverter\grab.html
IE: Download &all with DAP - c:\progra~1\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\mp3 player utilities 4.05\mediamanager\grab.html
IE: {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {669695BC-A811-4A9D-8CDF-BA8C795F261C} - c:\progra~1\dap\DAP.EXE
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java
DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - hxxp://p3p.sogou.com/MMCShell.cab
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} - hxxp://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} - hxxp://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} - hxxp://www.streamplug.com/StreamPlug/beta/SP.cab
DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} - hxxp://www.windowsecurity.com/trojanscan/TDECntrl.CAB
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} - hxxp://nba.tom.com/video/tcastV1.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} - hxxp://www.live365.com/players/play365.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - hxxp://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [2004-5-13 156800]
R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [2004-5-13 5248]
R1 Cinemsup;Cinemsup;c:\windows\system32\drivers\cinemsup.sys [2002-7-19 6656]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-1-22 482696]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2009-9-4 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2009-9-4 435568]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2007-2-4 2368]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\pavsrk.sys --> c:\windows\system32\PavSRK.sys [?]
S4 cdawdm;CDAWDM;c:\windows\system32\drivers\cdawdm.sys --> c:\windows\system32\drivers\CDAWDM.sys [?]

=============== Created Last 30 ================

2010-02-01 17:11 261,632 a------- c:\windows\PEV.exe
2010-02-01 17:11 161,792 a------- c:\windows\SWREG.exe
2010-02-01 17:11 98,816 a------- c:\windows\sed.exe
2010-02-01 17:11 77,312 a------- c:\windows\MBR.exe
2010-02-01 14:32 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2010-01-31 04:08 <DIR> --d-hr-- c:\documents and settings\k. kuord\Onlangs geopend
2010-01-24 02:49 60 a------- c:\windows\MediaList.ini
2010-01-24 02:49 140 a------- c:\windows\powerlist.ini
2010-01-24 02:46 1,557 a------- c:\windows\psnetwork.ini
2010-01-24 02:46 849 a------- c:\windows\powerplayer.ini
2010-01-23 03:16 <DIR> --d----- c:\documents and settings\k. kuord\Downloads
2010-01-22 18:43 <DIR> --d----- c:\docume~1\k49eb~1.kuo\applic~1\CheckPoint
2010-01-22 18:42 <DIR> --d----- c:\program files\CheckPoint
2010-01-22 18:42 4,212 a---h--- c:\windows\system32\zllictbl.dat
2010-01-22 18:42 1,238,408 a------- c:\windows\system32\zpeng25.dll
2010-01-22 18:42 <DIR> --d----- c:\windows\system32\ZoneLabs
2010-01-22 18:42 418,012 a------- c:\windows\system32\vsconfig.xml
2010-01-22 18:42 <DIR> --d----- c:\program files\Zone Labs
2010-01-22 18:41 <DIR> --d----- c:\windows\Internet Logs
2010-01-21 00:09 <DIR> --d----- c:\program files\GSA Delphi.Induc Cleaner
2010-01-16 21:47 490 a---h--- C:\aaw7boot.cmd
2010-01-13 10:25 471,552 -c------ c:\windows\system32\dllcache\aclayers.dll
2010-01-12 23:37 <DIR> --d----- c:\windows\SxsCaPendDel

==================== Find3M ====================

2010-01-23 01:28 411,368 a------- c:\windows\system32\deploytk.dll
2009-12-21 20:10 916,480 -------- c:\windows\system32\wininet.dll
2009-12-09 20:52 444,960 a------- c:\windows\system32\perfh013.dat
2009-12-09 20:52 70,426 a------- c:\windows\system32\perfc013.dat
2009-11-21 17:03 471,552 a------- c:\windows\apppatch\aclayers.dll
2009-11-01 20:42 39,916,560 a------- c:\docume~1\k49eb~1.kuo\applic~1\setupengpro.exe
2007-09-08 01:22 744 a------- c:\docume~1\k49eb~1.kuo\applic~1\filterclsid.dat
2006-06-15 20:24 56 ---shr-- c:\windows\system32\562AD544BF.sys
2008-10-25 22:01 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\geschiedenis\history.ie5\mshist012008102520081026\index.dat

============= FINISH: 23:27:55,15 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 7-2-2004 10:53:25
System Uptime: 2-1-2010 18:26:14 (725 hours ago)

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-6570
Processor: AMD Athlon(tm) XP 2600+ | Socket A | 1913/166mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 1,905 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is CDROM ()
K: is CDROM ()
L: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1592: 1-2-2010 21:13:50 - Controlepunt van systeem

==== Installed Programs ======================

7-Zip 4.64
AAC Decoder
Aangifte inkomstenbelasting 2007
Aangifte inkomstenbelasting 2008
AC3Filter (remove only)
Ad-Aware SE Personal
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 ActiveX
Adobe Photoshop 6.0
Adobe Reader 8.1.2 - Nederlands
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVI/MPEG/ASF/WMV Splitter 3.25
AVIcodec (remove only)
Beveiligingsupdate for Windows Media Player 10 (KB911565)
Beveiligingsupdate for Windows Media Player 10 (KB917734)
Beveiligingsupdate for Windows XP (KB941569)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB928090)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB929969)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB931768)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB933566)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB937143)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB938127)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB939653)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB942615)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB944533)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB950759)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB953838)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB956390)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB958215)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB960714)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB961260)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB963027)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB971961)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB972260)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB974455)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB976325)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB978207)
Beveiligingsupdate voor Windows Media Player (KB911564)
Beveiligingsupdate voor Windows Media Player (KB952069)
Beveiligingsupdate voor Windows Media Player (KB954155)
Beveiligingsupdate voor Windows Media Player (KB968816)
Beveiligingsupdate voor Windows Media Player (KB973540)
Beveiligingsupdate voor Windows Media Player 11 (KB936782)
Beveiligingsupdate voor Windows Media Player 11 (KB954154)
Beveiligingsupdate voor Windows Media Player 6.4 (KB925398)
Beveiligingsupdate voor Windows XP (KB883939)
Beveiligingsupdate voor Windows XP (KB896688)
Beveiligingsupdate voor Windows XP (KB899588)
Beveiligingsupdate voor Windows XP (KB923561)
Beveiligingsupdate voor Windows XP (KB938464-v2)
Beveiligingsupdate voor Windows XP (KB938464)
Beveiligingsupdate voor Windows XP (KB946648)
Beveiligingsupdate voor Windows XP (KB950760)
Beveiligingsupdate voor Windows XP (KB950762)
Beveiligingsupdate voor Windows XP (KB950974)
Beveiligingsupdate voor Windows XP (KB951066)
Beveiligingsupdate voor Windows XP (KB951376-v2)
Beveiligingsupdate voor Windows XP (KB951376)
Beveiligingsupdate voor Windows XP (KB951698)
Beveiligingsupdate voor Windows XP (KB951748)
Beveiligingsupdate voor Windows XP (KB952004)
Beveiligingsupdate voor Windows XP (KB952954)
Beveiligingsupdate voor Windows XP (KB953839)
Beveiligingsupdate voor Windows XP (KB954211)
Beveiligingsupdate voor Windows XP (KB954459)
Beveiligingsupdate voor Windows XP (KB954600)
Beveiligingsupdate voor Windows XP (KB955069)
Beveiligingsupdate voor Windows XP (KB956391)
Beveiligingsupdate voor Windows XP (KB956572)
Beveiligingsupdate voor Windows XP (KB956744)
Beveiligingsupdate voor Windows XP (KB956802)
Beveiligingsupdate voor Windows XP (KB956803)
Beveiligingsupdate voor Windows XP (KB956841)
Beveiligingsupdate voor Windows XP (KB956844)
Beveiligingsupdate voor Windows XP (KB957095)
Beveiligingsupdate voor Windows XP (KB957097)
Beveiligingsupdate voor Windows XP (KB958644)
Beveiligingsupdate voor Windows XP (KB958687)
Beveiligingsupdate voor Windows XP (KB958690)
Beveiligingsupdate voor Windows XP (KB958869)
Beveiligingsupdate voor Windows XP (KB959426)
Beveiligingsupdate voor Windows XP (KB960225)
Beveiligingsupdate voor Windows XP (KB960715)
Beveiligingsupdate voor Windows XP (KB960803)
Beveiligingsupdate voor Windows XP (KB960859)
Beveiligingsupdate voor Windows XP (KB961371)
Beveiligingsupdate voor Windows XP (KB961373)
Beveiligingsupdate voor Windows XP (KB961501)
Beveiligingsupdate voor Windows XP (KB968537)
Beveiligingsupdate voor Windows XP (KB969059)
Beveiligingsupdate voor Windows XP (KB969898)
Beveiligingsupdate voor Windows XP (KB969947)
Beveiligingsupdate voor Windows XP (KB970238)
Beveiligingsupdate voor Windows XP (KB970430)
Beveiligingsupdate voor Windows XP (KB971486)
Beveiligingsupdate voor Windows XP (KB971557)
Beveiligingsupdate voor Windows XP (KB971633)
Beveiligingsupdate voor Windows XP (KB971657)
Beveiligingsupdate voor Windows XP (KB972270)
Beveiligingsupdate voor Windows XP (KB973346)
Beveiligingsupdate voor Windows XP (KB973354)
Beveiligingsupdate voor Windows XP (KB973507)
Beveiligingsupdate voor Windows XP (KB973525)
Beveiligingsupdate voor Windows XP (KB973869)
Beveiligingsupdate voor Windows XP (KB973904)
Beveiligingsupdate voor Windows XP (KB974112)
Beveiligingsupdate voor Windows XP (KB974318)
Beveiligingsupdate voor Windows XP (KB974392)
Beveiligingsupdate voor Windows XP (KB974571)
Beveiligingsupdate voor Windows XP (KB975025)
Beveiligingsupdate voor Windows XP (KB975467)
BULLFROG GAMEPAD
Canon MP Navigator EX 1.2
Canon MP190 series MP Drivers
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
CCleaner (remove only)
CDisplay 1.8
Compatibiliteitspakket voor het 2007 Microsoft Office system
CoreAAC Audio Decoder (remove only)
Direct Show Ogg Vorbis Filter (remove only)
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Download Accelerator Plus
DVD X Ghost 1.5
EA SPORTS online 2007
Essentiële update voor Windows Media Player 11 (KB959772)
ffdshow (remove only)
FLV Player 1.3.3
FLV Player 2.0 (build 25)
Gebruikersregistratie voor Canon MP190 series
GSA Delphi.Induc Cleaner v1.00
H.264 Decoder
Hijack This 1.99.1
HijackThis 1.99.1
hkSFV (remove only)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix voor Windows Internet Explorer 7 (KB947864)
Hotfix voor Windows Media Player 11 (KB939683)
Hotfix voor Windows XP (KB952287)
Hotfix voor Windows XP (KB970653-v3)
Hotfix voor Windows XP (KB976098-v2)
Huffyuv AVI lossless video codec (Remove Only)
ImTOO MPEG Encoder
InterVideo DeviceService
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2_05
Java Auto Updater
Java(TM) 6 Update 18
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1
Junk Mail filter update
MainConcept MPEG Encoder
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Editie 2003
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
mIRC
MKV Splitter
Move Networks Media Player for Internet Explorer
MP3 Player Utilities 4.05
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Musicmatch® Jukebox
Nero - Burning Rom
Nero 7 Premium
NVIDIA Drivers
NvMixer
oggcodecs 0.71.0946
Orange Livebox
Parche Stats NBA Live 07
PartyPoker
PokerStars
Pop-Up Stopper Professional
PPStream V2.6.86.8989 Final
Proxy Changer
QuickTime
RealPlayer
RegistryBooster 2
Roster Season 06-07 for NBA live 06
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile Composite Device Software
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
Security Update for CAPICOM (KB931906)
Segoe UI
SLD CODEC PACK 1.3
SopCast 3.2.4
Stream Torrent 1.0
The KMPlayer (remove only)
TigerGame Superjoy Box Series
Trillian
TVAnts 1.0
TVUPlayer 2.4.9.1
TypingMaster Pro
Update voor Windows Internet Explorer 8 (KB971930)
Update voor Windows Internet Explorer 8 (KB976749)
Update voor Windows XP (KB894391)
Update voor Windows XP (KB896727)
Update voor Windows XP (KB898461)
Update voor Windows XP (KB951072-v2)
Update voor Windows XP (KB951978)
Update voor Windows XP (KB955759)
Update voor Windows XP (KB955839)
Update voor Windows XP (KB961503)
Update voor Windows XP (KB967715)
Update voor Windows XP (KB968389)
Update voor Windows XP (KB971737)
Update voor Windows XP (KB973687)
Update voor Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
Veetle TV 0.9.15
Video to Audio Converter 1.00
VidGIF
VidGIF 2.3.0.1
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 3
WinRAR archiver
WinZip
Xilisoft MP4 Converter
XviD 1.1 final uninstall
ZoneAlarm Pro
ZoneAlarm Toolbar

==== End Of File ===========================

Blade81 · Feb 2, 2010

Hi again,

Good to hear that things have improved. There's some work left to do though

Open notepad and copy/paste the text in the quotebox below into it:

Code:

Folder::
c:\documents and settings\K. Kuord\Application Data\uTorrent
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000000

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Uninstall ZoneAlarm Toolbar if not installed on purpose.

Ad-Aware SE Personal is not supported anymore. You may get the latest version here if you want.

Uninstall old Adobe Reader versions and get the latest one (9.3) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.

Uninstall your current Adobe shockwave player and get the fresh one here if needed.

Check here to see if your Flash is up-to-date (do it separately with each of your browsers). If not, uninstall vulnerable versions by following instructions here. Fresh version can be obtained here.

Uninstall these old Javas:
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2_05
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

shaft23 · Feb 2, 2010

hi blade,

i'm doing it now. i have to leave soon though. my combofix log gave me all the ames of all the torrents i have downloaded ever........don't know if i'm comfortable with that, you really need me to post it? I will if i have to...it basically stated that it deleted all the resulting torrent files in the utorrent folder.

let me know please.

Blade81 · Feb 2, 2010

You may leave that part of cf log away if there're personal things there. However, if you have downloaded copyrighted material you know how you have to deal with them.

Post also those other logs when ready.

shaft23 · Feb 2, 2010

hi,

well it's safer to just leave that part off then. but the scan is taking forever. it's been on for hours and it's just on 42 % and seems to be stuck too.

not sure what to do with it, cause so far it found 13 infected files and 10 threats

shaft23 · Feb 3, 2010

hi blade,

i tried to run the KAS. Scan, but it stopped at 42% and i couldn't get a log from it.

i reduced the log from combofix for copyright reasons. it look something like this:

ComboFix 10-02-01.05 - K. Kuord 02-02-2010 18:03:17.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.266 [GMT 1:00]
Gestart vanuit: c:\documents and settings\K. Kuord\Bureaublad\thunder.exe
gebruikte Opdracht switches :: c:\documents and settings\K. Kuord\Bureaublad\CFScript.txt
AV: *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\K. Kuord\Application Data\setup.exe
c:\documents and settings\K. Kuord\Application Data\uTorrent
c:\documents and settings\K. Kuord\Application Data\uTorrent\-^mininova[1].org^- 2006 NBA Playoffs - Phoenix Suns vs LA Lakers 6.torrent
c:\documents and settings\K. Kuord\Application Data\uTorrent\-^mininova[1].org^- NBA.03.24.06.Bucks-Lakers.TVRiP.XviD.torrent
c:\documents and settings\K. Kuord\Application Data\uTorrent\????.torrent
c:\documents and settings\K. Kuord\Application Data\uTorrent\[????][01.15][NBA??? ??VS???]by ?????.torrent
c:\documents and settings\K. Kuord\Application Data\uTorrent\[????][02.16][NBA??? ??VS??]by JasonFeng.torrent

*it goes on like that and ends with*

c:\documents and settings\K. Kuord\Application Data\uTorrent\Zab Judah vs Joshua Clottey (TZ).avi.torrent

.
(((((((((((((((((((( Bestanden Gemaakt van 2010-01-02 to 2010-02-02 ))))))))))))))))))))))))))))))
.

2010-02-02 16:43 . 2010-02-02 16:43 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-02-02 16:36 . 2010-02-02 16:54 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-02-02 16:33 . 2010-02-02 16:33 -------- d-----w- c:\windows\system32\Adobe
2010-02-02 01:59 . 2010-02-02 16:24 -------- d--h--r- c:\documents and settings\K. Kuord\Onlangs geopend
2010-02-01 13:32 . 2010-02-01 13:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-23 02:16 . 2010-01-23 02:16 -------- d-----w- c:\documents and settings\K. Kuord\Downloads
2010-01-22 17:43 . 2010-02-02 16:44 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\CheckPoint
2010-01-22 17:42 . 2010-02-02 16:45 -------- d-----w- c:\program files\CheckPoint
2010-01-22 17:42 . 2010-01-22 17:50 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-01-16 20:47 . 2010-01-16 20:47 490 ---ha-w- C:\aaw7boot.cmd
2010-01-16 15:16 . 2010-01-16 15:16 -------- d-----w- c:\documents and settings\LocalService\Bureaublad
2010-01-15 13:06 . 2010-01-18 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-13 09:25 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-12 22:37 . 2010-01-12 22:54 -------- d-----w- c:\windows\SxsCaPendDel
2010-01-12 17:11 . 2010-01-12 17:11 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-02 16:42 . 2004-02-14 18:26 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-02 16:32 . 2004-11-10 14:19 -------- d-----w- c:\program files\Java
2010-02-02 16:32 . 2004-11-10 14:18 -------- d-----w- c:\program files\Common Files\Java
2010-02-02 16:20 . 2006-04-05 13:41 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\Lavasoft
2010-02-02 02:12 . 2006-04-11 23:54 -------- d-----w- c:\program files\PPStream
2010-02-02 01:57 . 2009-08-09 15:20 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\vlc
2010-02-01 23:21 . 2004-08-04 13:15 -------- d-----w- c:\program files\mIRC
2010-01-28 16:55 . 2007-12-04 14:24 -------- d-----w- c:\program files\PartyGaming
2010-01-28 09:56 . 2006-10-08 20:36 -------- d-----w- c:\program files\Hijack This
2010-01-24 01:47 . 2005-12-26 01:26 -------- d-----w- c:\program files\tvants
2010-01-24 01:46 . 2006-12-15 02:25 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\ppStream
2010-01-23 00:28 . 2008-12-18 11:47 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-21 22:16 . 2007-08-01 10:11 -------- d-----w- c:\program files\AVI MPEG ASF WMV Splitter
2010-01-20 14:42 . 2009-02-18 19:29 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-28 20:24 . 2009-12-18 13:31 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\Belastingdienst
2009-12-21 19:10 . 2005-10-21 14:51 916480 ------w- c:\windows\system32\wininet.dll
2009-12-18 20:22 . 2008-04-22 02:12 -------- d-----w- c:\program files\PokerStars
2009-12-13 19:50 . 2007-02-18 01:42 -------- d-----w- c:\program files\SopCast
2009-12-09 19:52 . 2003-04-08 12:00 70426 ----a-w- c:\windows\system32\perfc013.dat
2009-12-09 19:52 . 2003-04-08 12:00 444960 ----a-w- c:\windows\system32\perfh013.dat
2009-11-17 19:38 . 2008-03-11 21:23 87512 ----a-w- c:\documents and settings\shahla en dawood\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-06-15 19:24 . 2004-05-05 16:54 56 --sh--r- c:\windows\system32\562AD544BF.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpStopperProfessional"="c:\program files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe" [2005-06-02 516096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\\NeroCheck.exe" [2001-07-09 155648]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 131072]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2005-05-10 11776]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-10-25 652624]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-09-13 1603152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-2-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PPStream\\PPStream.exe"=
"c:\\Program Files\\Trillian\\trillian.exe"=
"c:\\Program Files\\tvants\\Tvants.exe"=
"c:\\Documents and Settings\\K. Kuord\\Mijn documenten\\appz\\utorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\PPStream\\PPSAP.exe"=
"c:\\Documents and Settings\\K. Kuord\\Local Settings\\Application Data\\RayV\\RayV.dll"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3594:TCP"= 3594:TCP

pLive
"2186:UDP"= 2186:UDP

pLive

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [13-5-2004 16:02 156800]
R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [13-5-2004 16:02 5248]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [4-2-2007 18:43 2368]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
S4 cdawdm;CDAWDM;c:\windows\system32\DRIVERS\CDAWDM.sys --> c:\windows\system32\DRIVERS\CDAWDM.sys [?]
.
Inhoud van de 'Gedeelde Taken' map

2010-01-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
IE: &Download with &DAP - c:\progra~1\DAP\dapextie.htm
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.05\AMVConverter\grab.html
IE: Download &all with DAP - c:\progra~1\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.05\MediaManager\grab.html
IE: {{022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java
DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - hxxp://p3p.sogou.com/MMCShell.cab
DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} - hxxp://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} - hxxp://nba.tom.com/video/tcastV1.cab
DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - hxxp://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
.
- - - - ORPHANS VERWIJDERD - - - -

HKLM-Run-ISW - c:\program files\CheckPoint\ZAForceField\ForceField.exe
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
AddRemove-ZoneAlarm Toolbar - c:\program files\CheckPoint\ZAForceField\Uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-02 18:22
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x82B92998]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf86eaf28
\Driver\ACPI -> ACPI.sys @ 0xf8605cb8
\Driver\atapi -> atapi.sys @ 0xf85a5852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf847ebd4
PacketIndicateHandler -> NDIS.sys @ 0xf848aa21
SendHandler -> NDIS.sys @ 0xf847ed44
user & kernel MBR OK

**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-1409082233-606747145-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8A13AB9F-0214-342E-0FA0-CAA388CD5A84}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iahegomlhbmgnoeojc"=hex:6b,61,67,68,6c,61,68,63,6d,6f,6c,62,69,70,61,6e,64,6d,
70,68,66,62,00,82
"hancebfpikekmpha"=hex:6b,61,67,68,6c,61,68,63,6d,6f,6c,62,69,70,61,6e,64,6d,
70,68,66,62,00,82

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(1976)
c:\program files\Panicware\Pop-Up Stopper Professional\XAHook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.NLD
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\DAP\DAPBHO.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\MUSICM~1\MUSICM~1\MMDiag.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Voltooingstijd: 2010-02-02 18:39:44 - machine werd herstart
ComboFix-quarantined-files.txt 2010-02-02 17:39
ComboFix2.txt 2010-02-01 22:25

Pre-Run: 1.351.983.104 bytes beschikbaar
Post-Run: 1.737.105.408 bytes beschikbaar

- - End Of File - - F8A2E81900371FECA6E917D6018B8713

DDS (Ver_09-06-26.01) - NTFSx86
Run by K. Kuord at 4:34:01,92 on wo 03-02-2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.363 [GMT 1:00]

AV: *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

============== Running Processes ===============

C:\windows\system32\svchost -k DcomLaunch
svchost.exe
C:\windows\System32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\windows\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\nvsvc32.exe
C:\windows\System32\svchost.exe -k imgsvc
C:\windows\system32\wscntfy.exe
C:\windows\system32\RUNDLL32.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\explorer.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\windows\system32\NOTEPAD.EXE
C:\Documents and Settings\K. Kuord\Bureaublad\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
uURLSearchHooks: H - No File
BHO: DAPHelper Class: {0000cc75-acf3-4cac-a0a9-dd3868e06852} - c:\program files\dap\DAPBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Aanmelden - Help: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {00000000-5736-4205-0008-F7ED0776FB27} - No File
TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
uRun: [PopUpStopperProfessional] "c:\program files\panicware\pop-up stopper professional\PopUpStopperProfessional.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NeroCheck] c:\windows\system32\\NeroCheck.exe
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [MimBoot] c:\progra~1\musicm~1\musicm~1\mimboot.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\menust~1\progra~1\opstar~1\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: &Download with &DAP - c:\progra~1\dap\dapextie.htm
IE: Add to AMV Converter... - c:\program files\mp3 player utilities 4.05\amvconverter\grab.html
IE: Download &all with DAP - c:\progra~1\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\mp3 player utilities 4.05\mediamanager\grab.html
IE: {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {669695BC-A811-4A9D-8CDF-BA8C795F261C} - c:\progra~1\dap\DAP.EXE
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java
DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - hxxp://p3p.sogou.com/MMCShell.cab
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} - hxxp://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} - hxxp://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} - hxxp://www.streamplug.com/StreamPlug/beta/SP.cab
DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} - hxxp://www.windowsecurity.com/trojanscan/TDECntrl.CAB
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} - hxxp://nba.tom.com/video/tcastV1.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} - hxxp://www.live365.com/players/play365.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - hxxp://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [2004-5-13 156800]
R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [2004-5-13 5248]
R1 Cinemsup;Cinemsup;c:\windows\system32\drivers\cinemsup.sys [2002-7-19 6656]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2007-2-4 2368]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\pavsrk.sys --> c:\windows\system32\PavSRK.sys [?]
S4 cdawdm;CDAWDM;c:\windows\system32\drivers\cdawdm.sys --> c:\windows\system32\drivers\CDAWDM.sys [?]

=============== Created Last 30 ================

2010-02-02 17:33 <DIR> --d----- c:\windows\system32\Adobe
2010-02-02 02:59 <DIR> --d-hr-- c:\documents and settings\k. kuord\Onlangs geopend
2010-02-01 17:11 261,632 a------- c:\windows\PEV.exe
2010-02-01 17:11 161,792 a------- c:\windows\SWREG.exe
2010-02-01 17:11 98,816 a------- c:\windows\sed.exe
2010-02-01 17:11 77,312 a------- c:\windows\MBR.exe
2010-02-01 14:32 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2010-01-24 02:49 60 a------- c:\windows\MediaList.ini
2010-01-24 02:49 140 a------- c:\windows\powerlist.ini
2010-01-24 02:46 1,599 a------- c:\windows\psnetwork.ini
2010-01-24 02:46 879 a------- c:\windows\powerplayer.ini
2010-01-23 03:16 <DIR> --d----- c:\documents and settings\k. kuord\Downloads
2010-01-22 18:43 <DIR> --d----- c:\docume~1\k49eb~1.kuo\applic~1\CheckPoint
2010-01-22 18:42 <DIR> --d----- c:\program files\CheckPoint
2010-01-22 18:42 4,212 a---h--- c:\windows\system32\zllictbl.dat
2010-01-16 21:47 490 a---h--- C:\aaw7boot.cmd
2010-01-13 10:25 471,552 -c------ c:\windows\system32\dllcache\aclayers.dll
2010-01-12 23:37 <DIR> --d----- c:\windows\SxsCaPendDel

==================== Find3M ====================

2010-01-23 01:28 411,368 a------- c:\windows\system32\deploytk.dll
2009-12-21 20:10 916,480 -------- c:\windows\system32\wininet.dll
2009-12-09 20:52 444,960 a------- c:\windows\system32\perfh013.dat
2009-12-09 20:52 70,426 a------- c:\windows\system32\perfc013.dat
2009-11-21 17:03 471,552 a------- c:\windows\apppatch\aclayers.dll
2009-11-01 20:42 39,916,560 a------- c:\docume~1\k49eb~1.kuo\applic~1\setupengpro.exe
2007-09-08 01:22 744 a------- c:\docume~1\k49eb~1.kuo\applic~1\filterclsid.dat
2006-06-15 20:24 56 ---shr-- c:\windows\system32\562AD544BF.sys
2008-10-25 22:01 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\geschiedenis\history.ie5\mshist012008102520081026\index.dat

============= FINISH: 4:35:18,62 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 7-2-2004 10:53:25
System Uptime: 2-2-2010 18:17:26 (10 hours ago)

Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-6570
Processor: AMD Athlon(tm) XP 2600+ | Socket A | 1913/166mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 3,367 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is CDROM ()
K: is CDROM ()
L: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1592: 1-2-2010 21:13:50 - Controlepunt van systeem
RP1593: 2-2-2010 0:17:57 - Removed MP3 Player Utilities 4.05
RP1594: 2-2-2010 17:22:38 - Verwijderd: Adobe Reader 8.1.2 - Nederlands
RP1595: 2-2-2010 17:25:25 - Removed J2SE Runtime Environment 5.0 Update 10
RP1596: 2-2-2010 17:26:08 - Removed J2SE Runtime Environment 5.0 Update 11
RP1597: 2-2-2010 17:26:46 - Removed J2SE Runtime Environment 5.0 Update 2
RP1598: 2-2-2010 17:27:35 - Removed J2SE Runtime Environment 5.0 Update 6
RP1599: 2-2-2010 17:28:14 - Removed J2SE Runtime Environment 5.0 Update 9
RP1600: 2-2-2010 17:28:52 - Removed Java 2 Runtime Environment, SE v1.4.2_05
RP1601: 2-2-2010 17:29:37 - Removed Java(TM) SE Runtime Environment 6 Update 1
RP1602: 2-2-2010 17:30:17 - Removed Java(TM) 6 Update 2
RP1603: 2-2-2010 17:30:53 - Removed Java(TM) 6 Update 3
RP1604: 2-2-2010 17:31:36 - Removed Java(TM) 6 Update 5
RP1605: 2-2-2010 17:32:19 - Removed Java(TM) 6 Update 7
RP1606: 2-2-2010 17:41:16 - Installed Adobe Reader 9.3 - Nederlands.

==== Installed Programs ======================

7-Zip 4.64
AAC Decoder
Aangifte inkomstenbelasting 2007
Aangifte inkomstenbelasting 2008
AC3Filter (remove only)
Adobe Flash Player 10 ActiveX
Adobe Photoshop 6.0
Adobe Reader 9.3 - Nederlands
Adobe Shockwave Player 11.5
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVI/MPEG/ASF/WMV Splitter 3.25
AVIcodec (remove only)
Beveiligingsupdate for Windows Media Player 10 (KB911565)
Beveiligingsupdate for Windows Media Player 10 (KB917734)
Beveiligingsupdate for Windows XP (KB941569)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB928090)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB929969)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB931768)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB933566)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB937143)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB938127)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB939653)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB942615)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB944533)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB950759)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB953838)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB956390)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB958215)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB960714)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB961260)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB963027)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB971961)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB972260)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB974455)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB976325)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB978207)
Beveiligingsupdate voor Windows Media Player (KB911564)
Beveiligingsupdate voor Windows Media Player (KB952069)
Beveiligingsupdate voor Windows Media Player (KB954155)
Beveiligingsupdate voor Windows Media Player (KB968816)
Beveiligingsupdate voor Windows Media Player (KB973540)
Beveiligingsupdate voor Windows Media Player 11 (KB936782)
Beveiligingsupdate voor Windows Media Player 11 (KB954154)
Beveiligingsupdate voor Windows Media Player 6.4 (KB925398)
Beveiligingsupdate voor Windows XP (KB883939)
Beveiligingsupdate voor Windows XP (KB896688)
Beveiligingsupdate voor Windows XP (KB899588)
Beveiligingsupdate voor Windows XP (KB923561)
Beveiligingsupdate voor Windows XP (KB938464-v2)
Beveiligingsupdate voor Windows XP (KB938464)
Beveiligingsupdate voor Windows XP (KB946648)
Beveiligingsupdate voor Windows XP (KB950760)
Beveiligingsupdate voor Windows XP (KB950762)
Beveiligingsupdate voor Windows XP (KB950974)
Beveiligingsupdate voor Windows XP (KB951066)
Beveiligingsupdate voor Windows XP (KB951376-v2)
Beveiligingsupdate voor Windows XP (KB951376)
Beveiligingsupdate voor Windows XP (KB951698)
Beveiligingsupdate voor Windows XP (KB951748)
Beveiligingsupdate voor Windows XP (KB952004)
Beveiligingsupdate voor Windows XP (KB952954)
Beveiligingsupdate voor Windows XP (KB953839)
Beveiligingsupdate voor Windows XP (KB954211)
Beveiligingsupdate voor Windows XP (KB954459)
Beveiligingsupdate voor Windows XP (KB954600)
Beveiligingsupdate voor Windows XP (KB955069)
Beveiligingsupdate voor Windows XP (KB956391)
Beveiligingsupdate voor Windows XP (KB956572)
Beveiligingsupdate voor Windows XP (KB956744)
Beveiligingsupdate voor Windows XP (KB956802)
Beveiligingsupdate voor Windows XP (KB956803)
Beveiligingsupdate voor Windows XP (KB956841)
Beveiligingsupdate voor Windows XP (KB956844)
Beveiligingsupdate voor Windows XP (KB957095)
Beveiligingsupdate voor Windows XP (KB957097)
Beveiligingsupdate voor Windows XP (KB958644)
Beveiligingsupdate voor Windows XP (KB958687)
Beveiligingsupdate voor Windows XP (KB958690)
Beveiligingsupdate voor Windows XP (KB958869)
Beveiligingsupdate voor Windows XP (KB959426)
Beveiligingsupdate voor Windows XP (KB960225)
Beveiligingsupdate voor Windows XP (KB960715)
Beveiligingsupdate voor Windows XP (KB960803)
Beveiligingsupdate voor Windows XP (KB960859)
Beveiligingsupdate voor Windows XP (KB961371)
Beveiligingsupdate voor Windows XP (KB961373)
Beveiligingsupdate voor Windows XP (KB961501)
Beveiligingsupdate voor Windows XP (KB968537)
Beveiligingsupdate voor Windows XP (KB969059)
Beveiligingsupdate voor Windows XP (KB969898)
Beveiligingsupdate voor Windows XP (KB969947)
Beveiligingsupdate voor Windows XP (KB970238)
Beveiligingsupdate voor Windows XP (KB970430)
Beveiligingsupdate voor Windows XP (KB971486)
Beveiligingsupdate voor Windows XP (KB971557)
Beveiligingsupdate voor Windows XP (KB971633)
Beveiligingsupdate voor Windows XP (KB971657)
Beveiligingsupdate voor Windows XP (KB972270)
Beveiligingsupdate voor Windows XP (KB973346)
Beveiligingsupdate voor Windows XP (KB973354)
Beveiligingsupdate voor Windows XP (KB973507)
Beveiligingsupdate voor Windows XP (KB973525)
Beveiligingsupdate voor Windows XP (KB973869)
Beveiligingsupdate voor Windows XP (KB973904)
Beveiligingsupdate voor Windows XP (KB974112)
Beveiligingsupdate voor Windows XP (KB974318)
Beveiligingsupdate voor Windows XP (KB974392)
Beveiligingsupdate voor Windows XP (KB974571)
Beveiligingsupdate voor Windows XP (KB975025)
Beveiligingsupdate voor Windows XP (KB975467)
BULLFROG GAMEPAD
Canon MP Navigator EX 1.2
Canon MP190 series MP Drivers
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
CCleaner (remove only)
CDisplay 1.8
Compatibiliteitspakket voor het 2007 Microsoft Office system
CoreAAC Audio Decoder (remove only)
Direct Show Ogg Vorbis Filter (remove only)
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Download Accelerator Plus
DVD X Ghost 1.5
EA SPORTS online 2007
Essentiële update voor Windows Media Player 11 (KB959772)
ffdshow (remove only)
FLV Player 1.3.3
FLV Player 2.0 (build 25)
Gebruikersregistratie voor Canon MP190 series
H.264 Decoder
Hijack This 1.99.1
HijackThis 1.99.1
hkSFV (remove only)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix voor Windows Internet Explorer 7 (KB947864)
Hotfix voor Windows Media Player 11 (KB939683)
Hotfix voor Windows XP (KB952287)
Hotfix voor Windows XP (KB970653-v3)
Hotfix voor Windows XP (KB976098-v2)
Huffyuv AVI lossless video codec (Remove Only)
InterVideo DeviceService
iTunes
Java Auto Updater
Java(TM) 6 Update 18
Junk Mail filter update
MainConcept MPEG Encoder
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Editie 2003
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
MKV Splitter
Move Networks Media Player for Internet Explorer
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Musicmatch® Jukebox
Nero - Burning Rom
Nero 7 Premium
NVIDIA Drivers
NvMixer
oggcodecs 0.71.0946
Orange Livebox
Parche Stats NBA Live 07
PartyPoker
PokerStars
Pop-Up Stopper Professional
PPStream V2.6.86.8989 Final
Proxy Changer
QuickTime
RealPlayer
RegistryBooster 2
Roster Season 06-07 for NBA live 06
SAMSUNG CDMA Modem Driver Set
SAMSUNG Mobile Composite Device Software
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3
Security Update for CAPICOM (KB931906)
Segoe UI
SLD CODEC PACK 1.3
SopCast 3.2.4
The KMPlayer (remove only)
TigerGame Superjoy Box Series
Trillian
TVAnts 1.0
TVUPlayer 2.4.9.1
TypingMaster Pro
Update voor Windows Internet Explorer 8 (KB971930)
Update voor Windows Internet Explorer 8 (KB976749)
Update voor Windows XP (KB894391)
Update voor Windows XP (KB896727)
Update voor Windows XP (KB898461)
Update voor Windows XP (KB951072-v2)
Update voor Windows XP (KB951978)
Update voor Windows XP (KB955759)
Update voor Windows XP (KB955839)
Update voor Windows XP (KB961503)
Update voor Windows XP (KB967715)
Update voor Windows XP (KB968389)
Update voor Windows XP (KB971737)
Update voor Windows XP (KB973687)
Update voor Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
Veetle TV 0.9.15
Video to Audio Converter 1.00
VidGIF
VidGIF 2.3.0.1
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 3
WinRAR archiver
WinZip
Xilisoft MP4 Converter
XviD 1.1 final uninstall

==== End Of File ===========================

Blade81 · Feb 3, 2010

Hi again,

Open notepad and copy/paste the text in the quotebox below into it:

Code:

RegNull::
[HKEY_USERS\S-1-5-21-1409082233-606747145-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8A13AB9F-0214-342E-0FA0-CAA388CD5A84}*]

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

See if you're able to run Kaspersky scan after defragging the hard drive first. It's possible that the scan will take hours since you have pretty full drive there.

shaft23 · Feb 4, 2010

hi blade,

this is the log from the last combofix scan. The KAS scan still isn't going past 42% no idea why. After 2 hours it just stops even counting the seconds at 42%.

ComboFix 10-02-03.04 - K. Kuord 03-02-2010 23:52:57.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.242 [GMT 1:00]
Gestart vanuit: c:\documents and settings\K. Kuord\Bureaublad\thunder.exe
gebruikte Opdracht switches :: c:\documents and settings\K. Kuord\Bureaublad\CFScript.txt
AV: *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((( Bestanden Gemaakt van 2010-01-03 to 2010-02-03 ))))))))))))))))))))))))))))))
.

2010-02-03 21:50 . 2010-02-03 21:50 -------- d--h--r- c:\documents and settings\K. Kuord\Onlangs geopend
2010-02-02 16:43 . 2010-02-02 16:43 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-02-02 16:36 . 2010-02-02 16:54 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-02-02 16:33 . 2010-02-02 16:33 -------- d-----w- c:\windows\system32\Adobe
2010-02-01 13:32 . 2010-02-01 13:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-23 02:16 . 2010-01-23 02:16 -------- d-----w- c:\documents and settings\K. Kuord\Downloads
2010-01-22 17:43 . 2010-02-02 16:44 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\CheckPoint
2010-01-22 17:42 . 2010-02-02 16:45 -------- d-----w- c:\program files\CheckPoint
2010-01-22 17:42 . 2010-01-22 17:50 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-01-16 20:47 . 2010-01-16 20:47 490 ---ha-w- C:\aaw7boot.cmd
2010-01-16 15:16 . 2010-01-16 15:16 -------- d-----w- c:\documents and settings\LocalService\Bureaublad
2010-01-15 13:06 . 2010-01-18 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-13 09:25 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-12 22:37 . 2010-01-12 22:54 -------- d-----w- c:\windows\SxsCaPendDel
2010-01-12 17:11 . 2010-01-12 17:11 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-02 16:42 . 2004-02-14 18:26 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-02 16:32 . 2004-11-10 14:19 -------- d-----w- c:\program files\Java
2010-02-02 16:32 . 2004-11-10 14:18 -------- d-----w- c:\program files\Common Files\Java
2010-02-02 16:20 . 2006-04-05 13:41 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\Lavasoft
2010-02-02 02:12 . 2006-04-11 23:54 -------- d-----w- c:\program files\PPStream
2010-02-02 01:57 . 2009-08-09 15:20 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\vlc
2010-02-01 23:21 . 2004-08-04 13:15 -------- d-----w- c:\program files\mIRC
2010-01-28 16:55 . 2007-12-04 14:24 -------- d-----w- c:\program files\PartyGaming
2010-01-28 09:56 . 2006-10-08 20:36 -------- d-----w- c:\program files\Hijack This
2010-01-24 01:47 . 2005-12-26 01:26 -------- d-----w- c:\program files\tvants
2010-01-24 01:46 . 2006-12-15 02:25 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\ppStream
2010-01-23 00:28 . 2008-12-18 11:47 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-21 22:16 . 2007-08-01 10:11 -------- d-----w- c:\program files\AVI MPEG ASF WMV Splitter
2010-01-20 14:42 . 2009-02-18 19:29 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-28 20:24 . 2009-12-18 13:31 -------- d-----w- c:\documents and settings\K. Kuord\Application Data\Belastingdienst
2009-12-21 19:10 . 2005-10-21 14:51 916480 ------w- c:\windows\system32\wininet.dll
2009-12-18 20:22 . 2008-04-22 02:12 -------- d-----w- c:\program files\PokerStars
2009-12-13 19:50 . 2007-02-18 01:42 -------- d-----w- c:\program files\SopCast
2009-12-09 19:52 . 2003-04-08 12:00 70426 ----a-w- c:\windows\system32\perfc013.dat
2009-12-09 19:52 . 2003-04-08 12:00 444960 ----a-w- c:\windows\system32\perfh013.dat
2009-11-21 16:03 . 2004-11-30 09:44 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-17 19:38 . 2008-03-11 21:23 87512 ----a-w- c:\documents and settings\shahla en dawood\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-06-15 19:24 . 2004-05-05 16:54 56 --sh--r- c:\windows\system32\562AD544BF.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpStopperProfessional"="c:\program files\Panicware\Pop-Up Stopper Professional\PopUpStopperProfessional.exe" [2005-06-02 516096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\System32\\NeroCheck.exe" [2001-07-09 155648]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 131072]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2005-05-10 11776]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-10-25 652624]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-09-13 1603152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-2-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PPStream\\PPStream.exe"=
"c:\\Program Files\\Trillian\\trillian.exe"=
"c:\\Program Files\\tvants\\Tvants.exe"=
"c:\\Documents and Settings\\K. Kuord\\Mijn documenten\\appz\\utorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\PPStream\\PPSAP.exe"=
"c:\\Documents and Settings\\K. Kuord\\Local Settings\\Application Data\\RayV\\RayV.dll"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3594:TCP"= 3594:TCP

pLive
"2186:UDP"= 2186:UDP

pLive

R0 d346bus;d346bus;c:\windows\system32\drivers\d346bus.sys [13-5-2004 16:02 156800]
R0 d346prt;d346prt;c:\windows\system32\drivers\d346prt.sys [13-5-2004 16:02 5248]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [4-2-2007 18:43 2368]
S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
S4 cdawdm;CDAWDM;c:\windows\system32\DRIVERS\CDAWDM.sys --> c:\windows\system32\DRIVERS\CDAWDM.sys [?]
.
Inhoud van de 'Gedeelde Taken' map

2010-01-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
IE: &Download with &DAP - c:\progra~1\DAP\dapextie.htm
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.05\AMVConverter\grab.html
IE: Download &all with DAP - c:\progra~1\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.05\MediaManager\grab.html
IE: {{022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com
Trusted Zone: musicmatch.com\online
DPF: Microsoft XML Parser for Java
DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab
DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - hxxp://p3p.sogou.com/MMCShell.cab
DPF: {18CD2FD8-81CE-44C3-99E1-0822E1C7116C} - hxxp://files.ea.com/downloads/rtpatch/v4/EARTP8X.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
DPF: {9CA74596-B5BB-4634-971C-F0224115A15F} - hxxp://nba.tom.com/video/tcastV1.cab
DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - hxxp://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-04 00:04
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x82A7A380]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf86eaf28
\Driver\ACPI -> ACPI.sys @ 0xf8605cb8
\Driver\atapi -> atapi.sys @ 0xf85a5852
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf847ebd4
PacketIndicateHandler -> NDIS.sys @ 0xf848aa21
SendHandler -> NDIS.sys @ 0xf847ed44
user & kernel MBR OK

**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(212)
c:\program files\Panicware\Pop-Up Stopper Professional\XAHook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Voltooingstijd: 2010-02-04 00:15:33
ComboFix-quarantined-files.txt 2010-02-03 23:15
ComboFix2.txt 2010-02-02 17:39
ComboFix3.txt 2010-02-01 22:25

Pre-Run: 3.574.079.488 bytes beschikbaar
Post-Run: 3.635.257.344 bytes beschikbaar

- - End Of File - - F0BD886F2E7A949FF57F3AA64D315310

Blade81 · Feb 4, 2010

Hi,

Please see if you're able to run system critical area scan with Kaspersky successfully.

shaft23 · Feb 5, 2010

hey Blade,

the KAS scan did better, but it was stuck again, but thistime on 81% after a couple of hours. The timer just stops too and it doesn;t do anything. When i stopped the scan and tried to give you th repot it wouldn;t show either. i get a page error.

Blade81 · Feb 5, 2010

Hi,

Have you defragged the hard drive? Seeing that it's almost full there may be fragmentation on the drive.

shaft23 · Feb 5, 2010

hi,

i only have 5% HD space left and i need at least 15% so it won;t let me defrag the HD. I did it a while back, though.

Radio Virus!?? Noone seems to know it on the net yet....

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member