Hallo,
Sinds een paar weken heb ik een probleem met mijn computer. Als ik bijvoorbeeld internet explorer opstart, sluit deze na enkele momenten zomaar af. Ook malwarebytes starte sinds gisteren helemaal niet op, dit heb ik reeds opgelost door de naam mbam.exe in 54321.exe te veranderen. Maar ook als ik met andere programma's bezig ben, bijvoorbeeld Firefox, Windows Mediaplayer etc. lijkt het alsof er een ander programma wordt opgestart. (de donkerblauwe balk bovenaan het venster wordt ineens lichtblauw). Dus ik wou graag een HJT logje plaatsen zodat misschien iemand op het forum mij kan helpen.
--- automatische edit ---
HJT log
[hjt]
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:45:45, on 27-12-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal
Running processes:
c:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\program files\common files\symantec shared\ccsetmgr.exe
c:\windows\explorer.exe
c:\windows\system32\ctfmon.exe
c:\program files\common files\symantec shared\ccevtmgr.exe
c:\program files\common files\symantec shared\ccproxy.exe
c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe
c:\program files\common files\symantec shared\sndsrvc.exe
c:\program files\common files\symantec shared\spbbc\spbbcsvc.exe
c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe
c:\windows\system32\spoolsv.exe
c:\windows\system32\ctsvccda.exe
c:\windows\system32\svchost.exe
c:\program files\java\jre6\bin\jqs.exe
c:\program files\norton internet security\norton antivirus\navapsvc.exe
c:\windows\system32\hpzipm12.exe
c:\windows\system32\svchost.exe
c:\program files\common files\microsoft shared\windows live\wlidsvc.exe
c:\windows\system32\mspmspsv.exe
c:\program files\common files\pure networks shared\platform\nmsrvc.exe
c:\program files\common files\microsoft shared\windows live\wlidsvcm.exe
c:\program files\creative\sb live! 24-bit\surround mixer\ctsysvol.exe
c:\program files\common files\symantec shared\ccapp.exe
c:\program files\common files\pure networks shared\platform\nmctxth.exe
c:\program files\pure networks\network magic\nmapp.exe
c:\windows\system32\rundll32.exe
c:\program files\java\jre6\bin\jusched.exe
c:\program files\windows media player\wmpnscfg.exe
c:\program files\common files\symantec shared\security console\nscsrvce.exe
c:\windows\system32\searchindexer.exe
c:\program files\windows media player\wmplayer.exe
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\searchprotocolhost.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\messenger\msmsgs.exe
c:\program files\trend micro\hijackthis\hijackthis.exe
r0 - hkcu\software\microsoft\internet explorer\main,start page = [noparse]http://www.google.nl/[/noparse]
r1 - hklm\software\microsoft\internet explorer\main,default_page_url = [noparse]http://go.microsoft.com/fwlink/?linkid=69157[/noparse]
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = [noparse]http://go.microsoft.com/fwlink/?linkid=54896[/noparse]
r1 - hklm\software\microsoft\internet explorer\main,search page = [noparse]http://go.microsoft.com/fwlink/?linkid=54896[/noparse]
r0 - hklm\software\microsoft\internet explorer\search,searchassistant =
r0 - hkcu\software\microsoft\internet explorer\toolbar,linksfoldername = koppelingen
o2 - bho: adobe pdf reader help bij koppelingen - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\acroiehelper.dll
o2 - bho: acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file)
o2 - bho: aanmeldhulp voor windows live id - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: norton internet security 2006 - {9ecb9560-04f9-4bbc-943d-298ddf1699e1} - c:\program files\common files\symantec shared\adblocking\nisshext.dll
o2 - bho: nav helper - {a8f38d8d-e480-4d52-b7a2-731bb6995fdd} - c:\program files\norton internet security\norton antivirus\navshext.dll
o2 - bho: java(tm) plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
o2 - bho: jqsiestartdetectorimpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
o3 - toolbar: norton internet security 2006 - {0b53eac3-8d69-4b9e-9b19-a37c9a5676a7} - c:\program files\common files\symantec shared\adblocking\nisshext.dll
o3 - toolbar: norton antivirus - {c4069e3a-68f1-403e-b40e-20066696354b} - c:\program files\norton internet security\norton antivirus\navshext.dll
o4 - hklm\..\run: [quicktime task] c:\program files\quicktime\qttask.exe -atboottime
o4 - hklm\..\run: [ctsysvol] c:\program files\creative\sb live! 24-bit\surround mixer\ctsysvol.exe /r
o4 - hklm\..\run: [updreg] c:\windows\updreg.exe
o4 - hklm\..\run: [snelkoppeling naar eigenschappenvenster voor high definition audio] hdaudpropshortcut.exe
o4 - hklm\..\run: [adobe reader speed launcher] c:\program files\adobe\reader 9.0\reader\reader_sl.exe
o4 - hklm\..\run: [adobe arm] c:\program files\common files\adobe\arm\1.0\adobearm.exe
o4 - hklm\..\run: [ccapp] c:\program files\common files\symantec shared\ccapp.exe
o4 - hklm\..\run: [symantec pif alerteng] c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe /a /m c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\alerteng.dll
o4 - hklm\..\run: [nmctxth] c:\program files\common files\pure networks shared\platform\nmctxth.exe
o4 - hklm\..\run: [nmapp] c:\program files\pure networks\network magic\nmapp.exe -autorun -nosplash
o4 - hklm\..\run: [nwiz] nwiz.exe /installquiet
o4 - hklm\..\run: [nvmediacenter] rundll32.exe c:\windows\system32\nvmctray.dll,nvtaskbarinit
o4 - hklm\..\run: [nvcpldaemon] rundll32.exe c:\windows\system32\nvcpl.dll,nvstartup
o4 - hklm\..\run: [sunjavaupdatesched] c:\program files\java\jre6\bin\jusched.exe
o4 - hklm\..\runservices: [wusb54gc] %programfiles%\
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [nbj] c:\program files\ahead\nero backitup\nbj.exe
o4 - hkcu\..\run: [wmpnscfg] c:\program files\windows media player\wmpnscfg.exe
o4 - hkcu\..\runonce: [shockwave updater] c:\windows\system32\adobe\shockwave 11\swhelper_1150595.exe -update -1150595 -"mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; trident/4.0; simbar enabled; simbar={f2a8402f-4c5f-4655-9e4e-3f4efcc02f0d}; .net clr 1.1.4322; .net clr 2.0.50727; .net clr 3.0.04506.30; .net clr 3.0.04506.648; .net clr 3.0.4506.2152; .net clr 3.5.30729; officeliveconnector.1.3; officelivepatch.0.0)" -"[noparse]http://www.habbo.nl/client"[/noparse]
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'lokale service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'netwerkservice')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - global startup: raid manager.lnk = c:\program files\ite\ite it8212 ata raid controller\raidmgr.exe
o8 - extra context menu item: add to google photos screensa&ver - res://c:\windows\system32\gphotos.scr/200
o8 - extra context menu item: e&xporteren naar microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o9 - extra button: onderzoek - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: shopperreports - compare travel rates - {946b3e9e-e21a-49c8-9f63-900533fafe14} - c:\windows\system32\shdocvw.dll
o9 - extra button: shopperreports - compare product prices - {946b3e9e-e21a-49c8-9f63-900533fafe15} - c:\windows\system32\shdocvw.dll
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o16 - dpf: {2250c29c-c5e9-4f55-be4e-01e45a40fcf1} (cmediamix object) - [noparse]http://musicmix.messenger.msn.com/medialogic.cab[/noparse]
o16 - dpf: {2917297f-f02b-4b9d-81df-494b6333150b} (minesweeper flags class) - [noparse]http://messenger.zone.msn.com/binary/minesweeper.cab31267.cab[/noparse]
o16 - dpf: {5ed80217-570b-4da9-bf44-be107c0ec166} (windows live safety center base module) - [noparse]http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab[/noparse]
o16 - dpf: {6a344d34-5231-452a-8a57-d064ac9b7862} (symantec download manager) - [noparse]https://webdl.symantec.com/activex/symdlmgr.cab[/noparse]
o16 - dpf: {6e32070a-766d-4ee6-879c-dc1fa91d2fc3} (muwebcontrol class) - [noparse]http://update.microsoft.com/microsoftupdate/v6/v5controls/en/x86/client/muweb_site.cab?1140638021515[/noparse]
o16 - dpf: {74dbcb52-f298-4110-951d-ad2ff67bc8ab} (nvidia smart scan) - [noparse]http://www.nvidia.com/content/driverdownload/nforce/nvidiasmartscan.cab[/noparse]
o16 - dpf: {8e0d4de5-3180-4024-a327-4dfad1796a8d} (messengerstatsclient class) - [noparse]http://messenger.zone.msn.com/binary/messengerstatsclient.cab31267.cab[/noparse]
o16 - dpf: {97e71027-0ba2-44f2-97db-f84d808ed0b6} (messengerstatsclient class) - [noparse]http://messenger.zone.msn.com/binary/messengerstatspaclient.cab55762.cab[/noparse]
o16 - dpf: {b8be5e93-a60c-4d26-a2dc-220313175592} (msn games - installer) - [noparse]http://messenger.zone.msn.com/binary/zintro.cab56649.cab[/noparse]
o16 - dpf: {c3f79a2b-b9b4-4a66-b012-3ee46475b072} (messengerstatsclient class) - [noparse]http://messenger.zone.msn.com/binary/messengerstatspaclient.cab56907.cab[/noparse]
o16 - dpf: {cd995117-98e5-4169-9920-6c12d4c0b548} (hgplugin9usa class) - [noparse]http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/hgplugin9usa.cab[/noparse]
o16 - dpf: {cf40acc5-e1bb-4aff-ac72-04c2f616bca7} (get_atlcom class) - [noparse]http://www.adobe.com/products/acrobat/nos/gp.cab[/noparse]
o16 - dpf: {d27cdb6e-ae6d-11cf-96b8-444553540000} (shockwave flash object) - [noparse]http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab[/noparse]
o16 - dpf: {e06e2e99-0aa1-11d4-aba6-0060082aa75c} -
o16 - dpf: {f5a7706b-b9c0-4c89-a715-7a0c6b05dd48} (minesweeper flags class) - [noparse]http://messenger.zone.msn.com/binary/minesweeper.cab56986.cab[/noparse]
o23 - service: atheros configuration service (acs) - unknown owner - c:\windows\system32\acs.exe
o23 - service: canon camera access library 8 (ccalib8) - canon inc. - c:\program files\canon\cal\calmain.exe
o23 - service: symantec event manager (ccevtmgr) - symantec corporation - c:\program files\common files\symantec shared\ccevtmgr.exe
o23 - service: symantec internet security password validation (ccispwdsvc) - symantec corporation - c:\program files\norton internet security\ccpwdsvc.exe
o23 - service: symantec network proxy (ccproxy) - symantec corporation - c:\program files\common files\symantec shared\ccproxy.exe
o23 - service: symantec settings manager (ccsetmgr) - symantec corporation - c:\program files\common files\symantec shared\ccsetmgr.exe
o23 - service: com host (comhost) - symantec corporation - c:\program files\norton internet security\comhost.exe
o23 - service: creative service for cdrom access - creative technology ltd - c:\windows\system32\ctsvccda.exe
o23 - service: google update service (gupdate1c9acbb8959df00) (gupdate1c9acbb8959df00) - google inc. - c:\program files\google\update\googleupdate.exe
o23 - service: google updater service (gusvc) - google - c:\program files\google\common\google updater\googleupdaterservice.exe
o23 - service: installdriver table manager (idrivert) - macrovision corporation - c:\program files\common files\installshield\driver\11\intel 32\idrivert.exe
o23 - service: java quick starter (javaquickstarterservice) - sun microsystems, inc. - c:\program files\java\jre6\bin\jqs.exe
o23 - service: liveupdate - symantec corporation - c:\progra~1\symantec\liveup~1\lucoms~1.exe
o23 - service: liveupdate notice service - symantec corporation - c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe
o23 - service: norton antivirus auto-protect-service (navapsvc) - symantec corporation - c:\program files\norton internet security\norton antivirus\navapsvc.exe
o23 - service: pure networks platform service (nmservice) - cisco systems, inc. - c:\program files\common files\pure networks shared\platform\nmsrvc.exe
o23 - service: norton protection center service (nscservice) - symantec corporation - c:\program files\common files\symantec shared\security console\nscsrvce.exe
o23 - service: nvidia display driver service (nvsvc) - nvidia corporation - c:\windows\system32\nvsvc32.exe
o23 - service: planner voor automatische liveupdate - symantec corporation - c:\program files\symantec\liveupdate\aluschedulersvc.exe
o23 - service: pml driver hpz12 - hp - c:\windows\system32\hpzipm12.exe
o23 - service: symantec avscan (savscan) - symantec corporation - c:\program files\norton internet security\norton antivirus\savscan.exe
o23 - service: servicelayer - nokia. - c:\program files\pc connectivity solution\servicelayer.exe
o23 - service: symantec network drivers service (sndsrvc) - symantec corporation - c:\program files\common files\symantec shared\sndsrvc.exe
o23 - service: symantec spbbcsvc (spbbcsvc) - symantec corporation - c:\program files\common files\symantec shared\spbbc\spbbcsvc.exe
o23 - service: symantec core lc - unknown owner - c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe
o23 - service: upnpservice - magix ag - c:\program files\common files\magix shared\upnpservice\upnpservice.exe
o23 - service: wmp54gv4svc - gemteks - c:\program files\linksys\linksys wireless-g pci wireless network monitor\wlservice.exe
--
end of file - 13660 bytes
[/hjt]
O ja en ik heb het volgende al tevergeefs geprobeerd http://www.nationaalcomputerforum.nl/showthread.php?t=53954
en daarbij heb ik de volgende logjes verzameld van SDFix en Avenger
SDFix: Version 1.240
Run on za 26-12-2009 at 16:52
Microsoft Windows XP [versie 5.1.2600]
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-26 17:04:26
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
disk error: C:\WINDOWS\system32\config\system, 1381
scanning hidden registry entries ...
disk error: C:\WINDOWS\system32\config\software, 1381
disk error: C:\Documents and Settings\Berends\ntuser.dat, 1381
scanning hidden files ...
disk error: C:\WINDOWS\
please note that you need administrator rights to perform deep scan
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*isabled:Microsoft DirectPlay8 Server"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:EnablednkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:EnablednkBstrB"
"C:\\Documents and Settings\\Berends\\Application Data\\Vusion\\WARPVideoStreamer.exe"="C:\\Documents and Settings\\Berends\\Application Data\\Vusion\\WARPVideoStreamer.exe:*:Enabled:WARP Video Streamer"
"C:\\Program Files\\FrostWire\\FrostWire.exe"="C:\\Program Files\\FrostWire\\FrostWire.exe:*:Enabled:FrostWire"
"C:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"="C:\\Program Files\\TVersity\\Media Server\\MediaServer.exe:*:Enabled:TVersity Media Server"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\condition zero\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\day of defeat\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\day of defeat\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
Remaining Files :
Files with Hidden Attributes :
Finished!
en
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
Hidden driver "H8SRTd.sys" found!
ImagePath: \systemroot\system32\drivers\H8SRTbdvbrxnriq.sys
Start Type: 1 (System)
Rootkit scan completed.
Error: file "c:\windows\system32\22.tmp" not found!
Deletion of file "c:\windows\system32\22.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "c:\windows\system32\37.tmp" not found!
Deletion of file "c:\windows\system32\37.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "c:\windows\system32\dpvacm32.dll" not found!
Deletion of file "c:\windows\system32\dpvacm32.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "c:\windows\system32\d3drm32.dll" not found!
Deletion of file "c:\windows\system32\d3drm32.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c428c540517" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c428c540517" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c428c540658" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c428c540658" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Completed script processing.
*******************
Finished! Terminate.
Sinds een paar weken heb ik een probleem met mijn computer. Als ik bijvoorbeeld internet explorer opstart, sluit deze na enkele momenten zomaar af. Ook malwarebytes starte sinds gisteren helemaal niet op, dit heb ik reeds opgelost door de naam mbam.exe in 54321.exe te veranderen. Maar ook als ik met andere programma's bezig ben, bijvoorbeeld Firefox, Windows Mediaplayer etc. lijkt het alsof er een ander programma wordt opgestart. (de donkerblauwe balk bovenaan het venster wordt ineens lichtblauw). Dus ik wou graag een HJT logje plaatsen zodat misschien iemand op het forum mij kan helpen.
--- automatische edit ---
HJT log
[hjt]
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:45:45, on 27-12-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal
Running processes:
c:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\program files\common files\symantec shared\ccsetmgr.exe
c:\windows\explorer.exe
c:\windows\system32\ctfmon.exe
c:\program files\common files\symantec shared\ccevtmgr.exe
c:\program files\common files\symantec shared\ccproxy.exe
c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe
c:\program files\common files\symantec shared\sndsrvc.exe
c:\program files\common files\symantec shared\spbbc\spbbcsvc.exe
c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe
c:\windows\system32\spoolsv.exe
c:\windows\system32\ctsvccda.exe
c:\windows\system32\svchost.exe
c:\program files\java\jre6\bin\jqs.exe
c:\program files\norton internet security\norton antivirus\navapsvc.exe
c:\windows\system32\hpzipm12.exe
c:\windows\system32\svchost.exe
c:\program files\common files\microsoft shared\windows live\wlidsvc.exe
c:\windows\system32\mspmspsv.exe
c:\program files\common files\pure networks shared\platform\nmsrvc.exe
c:\program files\common files\microsoft shared\windows live\wlidsvcm.exe
c:\program files\creative\sb live! 24-bit\surround mixer\ctsysvol.exe
c:\program files\common files\symantec shared\ccapp.exe
c:\program files\common files\pure networks shared\platform\nmctxth.exe
c:\program files\pure networks\network magic\nmapp.exe
c:\windows\system32\rundll32.exe
c:\program files\java\jre6\bin\jusched.exe
c:\program files\windows media player\wmpnscfg.exe
c:\program files\common files\symantec shared\security console\nscsrvce.exe
c:\windows\system32\searchindexer.exe
c:\program files\windows media player\wmplayer.exe
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\searchprotocolhost.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\messenger\msmsgs.exe
c:\program files\trend micro\hijackthis\hijackthis.exe
r0 - hkcu\software\microsoft\internet explorer\main,start page = [noparse]http://www.google.nl/[/noparse]
r1 - hklm\software\microsoft\internet explorer\main,default_page_url = [noparse]http://go.microsoft.com/fwlink/?linkid=69157[/noparse]
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = [noparse]http://go.microsoft.com/fwlink/?linkid=54896[/noparse]
r1 - hklm\software\microsoft\internet explorer\main,search page = [noparse]http://go.microsoft.com/fwlink/?linkid=54896[/noparse]
r0 - hklm\software\microsoft\internet explorer\search,searchassistant =
r0 - hkcu\software\microsoft\internet explorer\toolbar,linksfoldername = koppelingen
o2 - bho: adobe pdf reader help bij koppelingen - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\acroiehelper.dll
o2 - bho: acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file)
o2 - bho: aanmeldhulp voor windows live id - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: norton internet security 2006 - {9ecb9560-04f9-4bbc-943d-298ddf1699e1} - c:\program files\common files\symantec shared\adblocking\nisshext.dll
o2 - bho: nav helper - {a8f38d8d-e480-4d52-b7a2-731bb6995fdd} - c:\program files\norton internet security\norton antivirus\navshext.dll
o2 - bho: java(tm) plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
o2 - bho: jqsiestartdetectorimpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
o3 - toolbar: norton internet security 2006 - {0b53eac3-8d69-4b9e-9b19-a37c9a5676a7} - c:\program files\common files\symantec shared\adblocking\nisshext.dll
o3 - toolbar: norton antivirus - {c4069e3a-68f1-403e-b40e-20066696354b} - c:\program files\norton internet security\norton antivirus\navshext.dll
o4 - hklm\..\run: [quicktime task] c:\program files\quicktime\qttask.exe -atboottime
o4 - hklm\..\run: [ctsysvol] c:\program files\creative\sb live! 24-bit\surround mixer\ctsysvol.exe /r
o4 - hklm\..\run: [updreg] c:\windows\updreg.exe
o4 - hklm\..\run: [snelkoppeling naar eigenschappenvenster voor high definition audio] hdaudpropshortcut.exe
o4 - hklm\..\run: [adobe reader speed launcher] c:\program files\adobe\reader 9.0\reader\reader_sl.exe
o4 - hklm\..\run: [adobe arm] c:\program files\common files\adobe\arm\1.0\adobearm.exe
o4 - hklm\..\run: [ccapp] c:\program files\common files\symantec shared\ccapp.exe
o4 - hklm\..\run: [symantec pif alerteng] c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe /a /m c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\alerteng.dll
o4 - hklm\..\run: [nmctxth] c:\program files\common files\pure networks shared\platform\nmctxth.exe
o4 - hklm\..\run: [nmapp] c:\program files\pure networks\network magic\nmapp.exe -autorun -nosplash
o4 - hklm\..\run: [nwiz] nwiz.exe /installquiet
o4 - hklm\..\run: [nvmediacenter] rundll32.exe c:\windows\system32\nvmctray.dll,nvtaskbarinit
o4 - hklm\..\run: [nvcpldaemon] rundll32.exe c:\windows\system32\nvcpl.dll,nvstartup
o4 - hklm\..\run: [sunjavaupdatesched] c:\program files\java\jre6\bin\jusched.exe
o4 - hklm\..\runservices: [wusb54gc] %programfiles%\
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [nbj] c:\program files\ahead\nero backitup\nbj.exe
o4 - hkcu\..\run: [wmpnscfg] c:\program files\windows media player\wmpnscfg.exe
o4 - hkcu\..\runonce: [shockwave updater] c:\windows\system32\adobe\shockwave 11\swhelper_1150595.exe -update -1150595 -"mozilla/4.0 (compatible; msie 7.0; windows nt 5.1; trident/4.0; simbar enabled; simbar={f2a8402f-4c5f-4655-9e4e-3f4efcc02f0d}; .net clr 1.1.4322; .net clr 2.0.50727; .net clr 3.0.04506.30; .net clr 3.0.04506.648; .net clr 3.0.4506.2152; .net clr 3.5.30729; officeliveconnector.1.3; officelivepatch.0.0)" -"[noparse]http://www.habbo.nl/client"[/noparse]
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'lokale service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'netwerkservice')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - global startup: raid manager.lnk = c:\program files\ite\ite it8212 ata raid controller\raidmgr.exe
o8 - extra context menu item: add to google photos screensa&ver - res://c:\windows\system32\gphotos.scr/200
o8 - extra context menu item: e&xporteren naar microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o9 - extra button: onderzoek - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: shopperreports - compare travel rates - {946b3e9e-e21a-49c8-9f63-900533fafe14} - c:\windows\system32\shdocvw.dll
o9 - extra button: shopperreports - compare product prices - {946b3e9e-e21a-49c8-9f63-900533fafe15} - c:\windows\system32\shdocvw.dll
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o16 - dpf: {2250c29c-c5e9-4f55-be4e-01e45a40fcf1} (cmediamix object) - [noparse]http://musicmix.messenger.msn.com/medialogic.cab[/noparse]
o16 - dpf: {2917297f-f02b-4b9d-81df-494b6333150b} (minesweeper flags class) - [noparse]http://messenger.zone.msn.com/binary/minesweeper.cab31267.cab[/noparse]
o16 - dpf: {5ed80217-570b-4da9-bf44-be107c0ec166} (windows live safety center base module) - [noparse]http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab[/noparse]
o16 - dpf: {6a344d34-5231-452a-8a57-d064ac9b7862} (symantec download manager) - [noparse]https://webdl.symantec.com/activex/symdlmgr.cab[/noparse]
o16 - dpf: {6e32070a-766d-4ee6-879c-dc1fa91d2fc3} (muwebcontrol class) - [noparse]http://update.microsoft.com/microsoftupdate/v6/v5controls/en/x86/client/muweb_site.cab?1140638021515[/noparse]
o16 - dpf: {74dbcb52-f298-4110-951d-ad2ff67bc8ab} (nvidia smart scan) - [noparse]http://www.nvidia.com/content/driverdownload/nforce/nvidiasmartscan.cab[/noparse]
o16 - dpf: {8e0d4de5-3180-4024-a327-4dfad1796a8d} (messengerstatsclient class) - [noparse]http://messenger.zone.msn.com/binary/messengerstatsclient.cab31267.cab[/noparse]
o16 - dpf: {97e71027-0ba2-44f2-97db-f84d808ed0b6} (messengerstatsclient class) - [noparse]http://messenger.zone.msn.com/binary/messengerstatspaclient.cab55762.cab[/noparse]
o16 - dpf: {b8be5e93-a60c-4d26-a2dc-220313175592} (msn games - installer) - [noparse]http://messenger.zone.msn.com/binary/zintro.cab56649.cab[/noparse]
o16 - dpf: {c3f79a2b-b9b4-4a66-b012-3ee46475b072} (messengerstatsclient class) - [noparse]http://messenger.zone.msn.com/binary/messengerstatspaclient.cab56907.cab[/noparse]
o16 - dpf: {cd995117-98e5-4169-9920-6c12d4c0b548} (hgplugin9usa class) - [noparse]http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/hgplugin9usa.cab[/noparse]
o16 - dpf: {cf40acc5-e1bb-4aff-ac72-04c2f616bca7} (get_atlcom class) - [noparse]http://www.adobe.com/products/acrobat/nos/gp.cab[/noparse]
o16 - dpf: {d27cdb6e-ae6d-11cf-96b8-444553540000} (shockwave flash object) - [noparse]http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab[/noparse]
o16 - dpf: {e06e2e99-0aa1-11d4-aba6-0060082aa75c} -
o16 - dpf: {f5a7706b-b9c0-4c89-a715-7a0c6b05dd48} (minesweeper flags class) - [noparse]http://messenger.zone.msn.com/binary/minesweeper.cab56986.cab[/noparse]
o23 - service: atheros configuration service (acs) - unknown owner - c:\windows\system32\acs.exe
o23 - service: canon camera access library 8 (ccalib8) - canon inc. - c:\program files\canon\cal\calmain.exe
o23 - service: symantec event manager (ccevtmgr) - symantec corporation - c:\program files\common files\symantec shared\ccevtmgr.exe
o23 - service: symantec internet security password validation (ccispwdsvc) - symantec corporation - c:\program files\norton internet security\ccpwdsvc.exe
o23 - service: symantec network proxy (ccproxy) - symantec corporation - c:\program files\common files\symantec shared\ccproxy.exe
o23 - service: symantec settings manager (ccsetmgr) - symantec corporation - c:\program files\common files\symantec shared\ccsetmgr.exe
o23 - service: com host (comhost) - symantec corporation - c:\program files\norton internet security\comhost.exe
o23 - service: creative service for cdrom access - creative technology ltd - c:\windows\system32\ctsvccda.exe
o23 - service: google update service (gupdate1c9acbb8959df00) (gupdate1c9acbb8959df00) - google inc. - c:\program files\google\update\googleupdate.exe
o23 - service: google updater service (gusvc) - google - c:\program files\google\common\google updater\googleupdaterservice.exe
o23 - service: installdriver table manager (idrivert) - macrovision corporation - c:\program files\common files\installshield\driver\11\intel 32\idrivert.exe
o23 - service: java quick starter (javaquickstarterservice) - sun microsystems, inc. - c:\program files\java\jre6\bin\jqs.exe
o23 - service: liveupdate - symantec corporation - c:\progra~1\symantec\liveup~1\lucoms~1.exe
o23 - service: liveupdate notice service - symantec corporation - c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe
o23 - service: norton antivirus auto-protect-service (navapsvc) - symantec corporation - c:\program files\norton internet security\norton antivirus\navapsvc.exe
o23 - service: pure networks platform service (nmservice) - cisco systems, inc. - c:\program files\common files\pure networks shared\platform\nmsrvc.exe
o23 - service: norton protection center service (nscservice) - symantec corporation - c:\program files\common files\symantec shared\security console\nscsrvce.exe
o23 - service: nvidia display driver service (nvsvc) - nvidia corporation - c:\windows\system32\nvsvc32.exe
o23 - service: planner voor automatische liveupdate - symantec corporation - c:\program files\symantec\liveupdate\aluschedulersvc.exe
o23 - service: pml driver hpz12 - hp - c:\windows\system32\hpzipm12.exe
o23 - service: symantec avscan (savscan) - symantec corporation - c:\program files\norton internet security\norton antivirus\savscan.exe
o23 - service: servicelayer - nokia. - c:\program files\pc connectivity solution\servicelayer.exe
o23 - service: symantec network drivers service (sndsrvc) - symantec corporation - c:\program files\common files\symantec shared\sndsrvc.exe
o23 - service: symantec spbbcsvc (spbbcsvc) - symantec corporation - c:\program files\common files\symantec shared\spbbc\spbbcsvc.exe
o23 - service: symantec core lc - unknown owner - c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe
o23 - service: upnpservice - magix ag - c:\program files\common files\magix shared\upnpservice\upnpservice.exe
o23 - service: wmp54gv4svc - gemteks - c:\program files\linksys\linksys wireless-g pci wireless network monitor\wlservice.exe
--
end of file - 13660 bytes
[/hjt]
O ja en ik heb het volgende al tevergeefs geprobeerd http://www.nationaalcomputerforum.nl/showthread.php?t=53954
en daarbij heb ik de volgende logjes verzameld van SDFix en Avenger
SDFix: Version 1.240
Run on za 26-12-2009 at 16:52
Microsoft Windows XP [versie 5.1.2600]
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-26 17:04:26
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
disk error: C:\WINDOWS\system32\config\system, 1381
scanning hidden registry entries ...
disk error: C:\WINDOWS\system32\config\software, 1381
disk error: C:\Documents and Settings\Berends\ntuser.dat, 1381
scanning hidden files ...
disk error: C:\WINDOWS\
please note that you need administrator rights to perform deep scan
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*isabled:Microsoft DirectPlay8 Server"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:EnablednkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:EnablednkBstrB"
"C:\\Documents and Settings\\Berends\\Application Data\\Vusion\\WARPVideoStreamer.exe"="C:\\Documents and Settings\\Berends\\Application Data\\Vusion\\WARPVideoStreamer.exe:*:Enabled:WARP Video Streamer"
"C:\\Program Files\\FrostWire\\FrostWire.exe"="C:\\Program Files\\FrostWire\\FrostWire.exe:*:Enabled:FrostWire"
"C:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"="C:\\Program Files\\TVersity\\Media Server\\MediaServer.exe:*:Enabled:TVersity Media Server"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\condition zero\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\day of defeat\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\sj3nkie\\day of defeat\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
Remaining Files :
Files with Hidden Attributes :
Finished!
en
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
Hidden driver "H8SRTd.sys" found!
ImagePath: \systemroot\system32\drivers\H8SRTbdvbrxnriq.sys
Start Type: 1 (System)
Rootkit scan completed.
Error: file "c:\windows\system32\22.tmp" not found!
Deletion of file "c:\windows\system32\22.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "c:\windows\system32\37.tmp" not found!
Deletion of file "c:\windows\system32\37.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "c:\windows\system32\dpvacm32.dll" not found!
Deletion of file "c:\windows\system32\dpvacm32.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "c:\windows\system32\d3drm32.dll" not found!
Deletion of file "c:\windows\system32\d3drm32.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c428c540517" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c428c540517" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c428c540658" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c428c540658" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Completed script processing.
*******************
Finished! Terminate.
Laatst bewerkt door een moderator: