AnimeSuki Forums

chikorita157 · 2009-05-12, 09:24

Rootkit is a program that is hidden in the system and runs in the background without the user knowing. Some of these can open a backdoor for an attacker to take control of your system. The famous example is the Sony BMG DRM rootkit that happened in 2005. Not all rootkits are malicious in nature and required for a program to operate, such as Daemon Tools which is a virtual cd manager.

If want to know more, I suggest reading this article about rootkits: http://en.wikipedia.org/wiki/Rootkit

SaintessHeart · 2009-05-12, 09:57

Spoiler for too long:

EDIT : Sorry for not reading through, but from these 4 which I can see,

mswsock.dll - It is the Windows socket service provider. Should be harmless. But you can try typing

netsh winsock reset

and

netsh int ip reset

to reset the config to default.

WS2_32.dll

This contains the Windows Sockets API. Whatever you do, DO NOT DELETE/ALTER THIS AND ITS RELATED REGISTRY KEYS. I don't know how to fix this corruption, other than the generic "reinstall Windows" procedure.

svchost.exe

How many instances of these are running in your system on tasklist? It is used to run your DLL files, and each of them can mean a different process.

kerne132.dll

I don't think that is a typo (L and 1 are too far away from each other on the keyboard). Could be a trojan masquerading as a kernel32.dll. Go to C:\Windows\System see if it is there. Kernel32.dll should be in C:\Windows\System32, possible masquerades don't install there. If it is in C:\Windows\System do the following :

1. Delete that file. If it is indicated as a running process and you can't turn it off, I suggest you corrupt it withSimple File Shredder.

2. Go Start > Run > regedit. Find kerne132.dll SPECIFICALLY and wipe that registry key. But remember to back up your registry first.

3. Restart your computer and see if it is still there.

I suggest you download Hijackthis and post your log here. I think I still can read the logs after a few years of not using that program. If I can't, one of the pros here can do more with that than an amateur like me.

sa547 · 2009-05-12, 11:46

Also, since some RBN squatters seem to have taken secret residence in the hard disk, there's RootkitRevealer from Windows Sysinternals. Tool might help you find where the buggers are.

-KarumA- · 2009-05-12, 12:21

I did a step by step procedure on Bullguard and it seems everything has been solved, I am still hoping someone would check out my logs to see if it is truly clean. I'll put them up here as well since the people at Bullguard removed my topic, probably because I am not one of their customers

Upon viewing the results from combofix when it comes to this rootkit the kit was located in my drivers of my usb D: all of them starting with ovfsth with more numbers and either .dll or .dat at the end, they have been removed by combofix as well as several other spam spreading files

But everything is working again, no errors nothing I installed all my software afterwards (3ds Max, Office and Adobe) and they all work fine, but just in case I'l post all 3 logs up (malwarebytes, combofix and lastly a hijack this)

another miracle D: my usb station returned omg! seems liek the deletion of the rootkit made my usb device station visible again, ever since the last attack 3 weeks ago I had been unable to even see these things

AND ANOTHER OMG! Jinto should remember this, in my disc management my pc was still un able to read and recognize my discs but they are listed now as well! both my C:/ and D:/ are now listed D: a miracle has happened! I guess my pc wasn't perfectly clean after I reformatted it 3 weeks ago, because then those stations had been visible for like a day before vanishing again as well as my usb station under My Computer

Spoiler for malware bytes:

I had scanned malware bytes first, then combofix and lastly did the hijack this log

Spoiler for combofix:

Spoiler for hijack this:

SaintessHeart · 2009-05-12, 12:25

Screw Norton Ghost. Erase everything.

Did you do a quick format or a thorough one? Also after formatting remember to shut down and discharge your PC as a safeguard, some viruses store themselves in the RAM during the format, then rewrite into the HD after it is done.

Either that or your disk has a bad sector, which means it isn't a virus after all.

-KarumA- · 2009-05-12, 13:06

I think it was a quick one, I don't know much about reformatting
basically inserted windows CD and reinstalled windows but kept all my data save except what was stored in my documents etc.

after that installed drivers of my graphics card etc. and reinstalled my software that was it

there is one entry that I am still concerned about:

O2 - BHO: (no name) - {C97FDF20-78B1-410F-9E8F-A5EF2A1326E1} - C:\WINDOWS\system32\atmf.dll

combofix and malwarebytes have been unable to delete it and when I try and remove it with hijack this it returns the next time I scan, when I google I only get virus warnings etc. but never a clear notice on how I can remove it or what process name it hides under so I can terminate it and then remove it manual, I also read that it can be related to Adobe Fonts though

I upped it to Jotti which can scan individual files and the result is that out of 20 scanners 3 say it is malware:
A Squarred: Trojan.Trash!IK
Antivir: TR/Trash.Gen
and Ikarus: Trojan.Trash

also upped it to Virus Total:
again 3 out of 20 says it is malware

AhnLab-V3 - - -
AntiVir - - TR/Trash.Gen
Antiy-AVL - - -
Authentium - - -
Avast - - -
AVG - - -
BitDefender - - -
CAT-QuickHeal - - -
ClamAV - - -
Comodo - - -
DrWeb - - -
eSafe - - -
eTrust-Vet - - -
F-Prot - - -
F-Secure - - -
Fortinet - - -
GData - - -
Ikarus - - Trojan.Trash
K7AntiVirus - - -
Kaspersky - - -
McAfee - - -
McAfee+Artemis - - -
McAfee-GW-Edition - - Trojan.Trash.Gen
Microsoft - - -
NOD32 - - -
Norman - - -
nProtect - - -
Panda - - -
PCTools - - -
Prevx1 - - -
Rising - - -
Sophos - - -
Sunbelt - - -
Symantec - - -
TheHacker - - -
TrendMicro - - -
VBA32 - - -
ViRobot - - -
VirusBuster

Jinto · 2009-05-12, 13:06

Ah and btw... Try to use just legit software on your system (you never know what sort of wicked set of trojans is installed with pirated software). I mean you can wipe your system as much as you want, but it won't make things better if you later just re-install the virii and trojans.

-KarumA- · 2009-05-12, 13:15

Quote:

Originally Posted by Jinto

Ah and btw... Try to use just legit software on your system (you never know what sort of wicked set of trojans is installed with pirated software). I mean you can wipe your system as much as you want, but it won't make things better if you later just re-install the virii and trojans.

thanks for the warning

Jinto what are your thoughts on atmf.dll
Read it is also used for fonts by Adobe but malware bytes and combofix both want it to have a no go

mechabao · 2009-05-12, 14:35

Quote:

Originally Posted by -KarumA-

I think it was a quick one, I don't know much about reformatting
basically inserted windows CD and reinstalled windows but kept all my data save except what was stored in my documents etc.

snip...

Then it means that the malware was hiding in your personal data and was merely waiting for you to open something in order to reinfect your system. The best way to avoid this is to do a complete format and get rid of everything on the Windows partition and then, before accessing your personal data, do a full system update, install antivirus and antimalware software and do a thorough scan of said personal data.

Jinto · 2009-05-12, 15:27

Quote:

Originally Posted by -KarumA-

thanks for the warning

Jinto what are your thoughts on atmf.dll
Read it is also used for fonts by Adobe but malware bytes and combofix both want it to have a no go

Could be a false positive. But there is no way I can tell you from here if this dll was somehow infected/injected. AntiVir and McAfee (and some others) use some generic routines to detect transmorphing virii. Polymorph virii as well as scrambled/runtime ecrypted virii are extremely difficult to detect. If you have one of these, reliable detection will be almost impossible. Since anti virus software is not always reliable - There are false positives as well as false negatives with this - it is up to you if you want to trust these 3 or beliefe into the results of the others.

If you want to have my honest oppinion... I would not want to share any data with your PC in a LAN... actually I would not want it to be connected to the same LAN.

Btw. both PCs could be affected. So in a worst case scenario you would have to clean both machines at the same time. (now this decission is left to you... depends on what you consider to be a robust cleaning strategy).

-KarumA- · 2009-05-12, 15:56

Quote:

Originally Posted by Jinto

Could be a false positive. But there is no way I can tell you from here if this dll was somehow infected/injected. AntiVir and McAfee (and some others) use some generic routines to detect transmorphing virii. Polymorph virii as well as scrambled/runtime ecrypted virii are extremely difficult to detect. If you have one of these, reliable detection will be almost impossible. Since anti virus software is not always reliable - There are false positives as well as false negatives with this - it is up to you if you want to trust these 3 or beliefe into the results of the others.

If you want to have my honest oppinion... I would not want to share any data with your PC in a LAN... actually I would not want it to be connected to the same LAN.

Btw. both PCs could be affected. So in a worst case scenario you would have to clean both machines at the same time. (now this decission is left to you... depends on what you consider to be a robust cleaning strategy).

no the other pc is clean, took it offline and scanned it completely for malware, virusses etc. nothing showed up on the other one

I think I'm going to leave it, though the guys at hijack this forums are finally helping me out now and checking my logs, goodnight folks time to catch up on the 4 hours of sleep I had yesterday, really what a day... i hate fixing computers its bad for my health I get too stressed out..

Jinto · 2009-05-12, 16:09

Quote:

Originally Posted by -KarumA-

no the other pc is clean, took it offline and scanned it completely for malware, virusses etc. nothing showed up on the other one

For some reason I smile when I read your statement. I would not declare my system was absolutely and with 100% certainty clean. Even if I scanned my PC with all the good virus scanners that are available on the market.
But you are probalby right, it should most likely be clean.

Quote:

Originally Posted by -KarumA-

I think I'm going to leave it, though the guys at hijack this forums are finally helping me out now and checking my logs, goodnight folks time to catch up on the 4 hours of sleep I had yesterday, really what a day... i hate fixing computers its bad for my health I get too stressed out..

Your logs alone are good when it comes down to malware that can be identified by the names/locations of the files. For the real bad stuff these logs are completely useless!
But I suggest you try to clean it with their help anyway. Best way to learn is practice.

So even if the system is not clean after this, you most likely learned more about the matter.

SaintessHeart · 2009-05-13, 00:12

Quote:

Originally Posted by Jinto

Ah and btw... Try to use just legit software on your system (you never know what sort of wicked set of trojans is installed with pirated software). I mean you can wipe your system as much as you want, but it won't make things better if you later just re-install the virii and trojans.

Legit software are not always virusfree. Just use any program, but be careful about the stuff they install.

If you want a full format, you can do this

1. Run in MSDOS mode.

2. Type in :

format C:

Follow the instructions and press Y when necessary. This should take around half an hour depending on how fast your computer are.

Since you mentioned that both your computers connected to the same network might be infected, it would be best if you format both of them before reinstalling anything at all. Oh yes, and before formatting disconnect them from your central modem/router just in case of cross infection. If you can get your hands on a degausser it would be the best, but I know that those things don't come by easily.

Whatever that fails, buy a new hard drive.

Jinto · 2009-05-13, 02:09

Quote:

Originally Posted by SaintessHeart

Legit software are not always virusfree. Just use any program, but be careful about the stuff they install.

In contrast to pirated software, legitimate software can be regarded as generally clean (there very few exceptions and most likely it is related to freeware tools).

The "but be careful about the stuff they install" clause is actually very funny. How do you see if it installs a runtime encrypted trojan with the program (in the program). Often that shit is in the crack files anyway but not always.

Quote:

Originally Posted by SaintessHeart

If you want a full format, you can do this

1. Run in MSDOS mode.

2. Type in :

format C:

Follow the instructions and press Y when necessary. This should take around half an hour depending on how fast your computer are.

Since you mentioned that both your computers connected to the same network might be infected, it would be best if you format both of them before reinstalling anything at all. Oh yes, and before formatting disconnect them from your central modem/router just in case of cross infection. If you can get your hands on a degausser it would be the best, but I know that those things don't come by easily.

Whatever that fails, buy a new hard drive.

I don't quite understand why the use of a degausser is recommended? Afaik, if it was a software (that just has this name because it does reliably overwrite old data... which is still different to degaussing) it is not relevant for the problem. If it was a strong magnet that degausses the hdd, then you can throw the hdd away after this procedure. Because the internal format of the hdd is lost. It won't find any sectors anymore.

SaintessHeart · 2009-05-13, 04:06

Quote:

Originally Posted by Jinto

In contrast to pirated software, legitimate software can be regarded as generally clean (there very few exceptions and most likely it is related to freeware tools).

The "but be careful about the stuff they install" clause is actually very funny. How do you see if it installs a runtime encrypted trojan with the program (in the program). Often that shit is in the crack files anyway but not always.

I was talking about all software, including open source, freeware, beta etc. After I learnt how to roughly identify surreptitious programs, it became much easier for discretionary download.

It has always been my personal belief that one should take responsibility in whatever program he/she uses, and constantly update him/herself on concurrent dangers of modern software.

Quote:

Originally Posted by Jinto

I don't quite understand why the use of a degausser is recommended? Afaik, if it was a software (that just has this name because it does reliably overwrite old data... which is still different to degaussing) it is not relevant for the problem. If it was a strong magnet that degausses the hdd, then you can throw the hdd away after this procedure. Because the internal format of the hdd is lost. It won't find any sectors anymore.

Sorry I misread. I thought he was dumping his hard drive.....never mind. I had caffeine OD for the past few days and my brain is busted.

IRJustman · 2009-05-17, 18:22

Quote:

If you want a full format, you can do this

1. Run in MSDOS mode.

2. Type in :

format C:
0
Follow the instructions and press Y when necessary. This should take around half an hour depending on how fast your computer are.

If this person is using Windows 2000, XP or Vista, he can't. There is no "MS-DOS mode" to boot to. These are not based on MS-DOS at all.

If anything he might try Darik's Boot and Nuke (sometimes known simply as "DBAN"). Those do a pretty good job of destroying the contents of a hard drive, especially if you want to either rid it of viruses or just want to sell the drive to someone, making sure it's completely rid of any private data.

Quote:

Originally Posted by Jinto

In contrast to pirated software, legitimate software can be regarded as generally clean (there very few exceptions and most likely it is related to freeware tools).

Emphasis mine.

Curious, what do you mean by this?

--Ian.

P.S. The plural form of "virus" is not "virii". Not to mention, the proper form of pluralizing a "-us" Latin word is "-i", not "-ii". And "virusses", as has been mentioned earlier in the thread, is also incorrect. It is, in fact, "viruses".

Justin Kim · 2009-05-17, 18:45

Quote:

Originally Posted by -KarumA-

I got an email from Ziggo today, this is my internet hook on company that provides me with this yummy internet hate machine and they stated that they received a number of complaints that we were mailing about emails containing pornographic spam etc.

Now I was very confused by this, my mom was hysterical like the little tech caveman she is and she was talking to me that it was something about child porn so I went lol what ?! (lost the game lol)

Anyway here's where it gets fishy, we have 2 computers in our house and for as far as I know my pc is clean but more on that later. Both pc's have Avast installed together with Comodo and the only thing my mom/dad do on their pc is either play patience or world of warcraft, my dad plays that and my mom the standard games, they both don't visit any other sites than the ones they know and so this left me with the conclusion that it might be my pc that is causing the problem. (also scanned it and it is clean of anythign fishy)

Now here is the thing, if you scroll back a page (or 4) you can see these topics, I had a horrible virus problem going on several weeks back, in late April I think it was. Something with CSRCS.EXE and several other suddenly spawned files that messed up my pc so badly that it generally thought the only device that was inserted was my DVD burner. This was all caused thanks to a virus on our school computers and later that week @ school we had some porn problems as well, you'd be following class and shazam random porn pop up shows up (I didn't have this going on on ym pc though), I re installed windows several days after all this trouble started, but I would like to hear your opinion about this, could the so proclaimed porn emailing spam have happened when my computer was entirely infected beyond repair? It is after all less than a month ago when this happens and I don't know how long it takes before they decide to send you a warning, also for spam to be send you'd get a trojan on virus on your computer right? or be stupid enough to fill your email address on some random website.. I have Avast in this pc including the website protection and email protection function and we also have this downstairs so I should be protected right? I don't do anything stupid like open random emails from people I don't know or download random files from the web.

So Asuki what do you think about this

There are many stories like this in the news today; I am sure if you searched a similar story up, something beneficial will pop up. I remember reading an article where a high school teacher was arrested and tried on court for the possible accusation of child pornography. When the police investigated even further, (the teacher had no criminal history and was completely clean) they found out that the computer was pretty much a "bomb" that was to be set off towards the victim. You may have a similar situation. The computer that this teacher held was actually custom built, but I guess someone just had to integrate some sneaky program. You should probably get your computer checked up, or just re-install the service pack you are currently using if this continues. Although, it may be a hassle, at least the pain of falsely being accused will go away.

-KarumA- · 2009-05-18, 13:36

Quote:

Originally Posted by Justin Kim

There are many stories like this in the news today; I am sure if you searched a similar story up, something beneficial will pop up. I remember reading an article where a high school teacher was arrested and tried on court for the possible accusation of child pornography. When the police investigated even further, (the teacher had no criminal history and was completely clean) they found out that the computer was pretty much a "bomb" that was to be set off towards the victim. You may have a similar situation. The computer that this teacher held was actually custom built, but I guess someone just had to integrate some sneaky program. You should probably get your computer checked up, or just re-install the service pack you are currently using if this continues. Although, it may be a hassle, at least the pain of falsely being accused will go away.

problem has already been solved, bot was nested in my drivers. the re installation hadn't cleaned that out but combofix has. bot has been removed and so far so good

and was not about child porn was mere a bot spreading porn spam emails that they were concerned about

Vexx · 2009-05-18, 15:01

yay, another bot node defanged

Jinto · 2009-05-19, 02:05

Quote:

Originally Posted by -KarumA-

problem has already been solved, bot was nested in my drivers. the re installation hadn't cleaned that out but combofix has. bot has been removed and so far so good

and was not about child porn was mere a bot spreading porn spam emails that they were concerned about

You could still have unknown backdoors in your PC. I would not feel very well doing online banking on it. Btw. Combofix reminds of something, I had to use it on my aunts PC once.

2009-05-12, 09:24	Link #21
chikorita157 ひきこもりアイドル IT Support Join Date: Feb 2009 Location: Pennsylvania , United States Age: 34	Rootkit is a program that is hidden in the system and runs in the background without the user knowing. Some of these can open a backdoor for an attacker to take control of your system. The famous example is the Sony BMG DRM rootkit that happened in 2005. Not all rootkits are malicious in nature and required for a program to operate, such as Daemon Tools which is a virtual cd manager. If want to know more, I suggest reading this article about rootkits: http://en.wikipedia.org/wiki/Rootkit __________________ Chikorita157's Anime Blog \| Atelier Shiori (Personal Sideblog) \| Tumblr \| Twitter

2009-05-12, 09:57	Link #22
SaintessHeart NYAAAAHAAANNNNN~ Join Date: Nov 2007 Age: 35	Spoiler for too long: For a start, I suggest you download Spybot S&D, Avast! antivirus and CCleaner. Then do the following : 1. Install them all, then update to latest definitions. 2. Go to run, type cmd. Then type the following 2 : ipconfig /release ipconfig /flushdns This should cut off your internet/network connection and purge your DNS cache. 3. Run Spybot and click on Immunize. After it is done immunising, run the check for spyware. 4. Run Avast. Scan thoroughly. 5. Run CCleaner, run the main cleaner and the registry cleaner. 6. Restart your computer. Run the scanners again. If your computer is clean, it should be okay already. Just reset your email's password just in case it is used for mailbomb attacks. EDIT : Sorry for not reading through, but from these 4 which I can see, mswsock.dll - It is the Windows socket service provider. Should be harmless. But you can try typing netsh winsock reset and netsh int ip reset to reset the config to default. WS2_32.dll This contains the Windows Sockets API. Whatever you do, DO NOT DELETE/ALTER THIS AND ITS RELATED REGISTRY KEYS. I don't know how to fix this corruption, other than the generic "reinstall Windows" procedure. svchost.exe How many instances of these are running in your system on tasklist? It is used to run your DLL files, and each of them can mean a different process. kerne132.dll I don't think that is a typo (L and 1 are too far away from each other on the keyboard). Could be a trojan masquerading as a kernel32.dll. Go to C:\Windows\System see if it is there. Kernel32.dll should be in C:\Windows\System32, possible masquerades don't install there. If it is in C:\Windows\System do the following : 1. Delete that file. If it is indicated as a running process and you can't turn it off, I suggest you corrupt it withSimple File Shredder. 2. Go Start > Run > regedit. Find kerne132.dll SPECIFICALLY and wipe that registry key. But remember to back up your registry first. 3. Restart your computer and see if it is still there. I suggest you download Hijackthis and post your log here. I think I still can read the logs after a few years of not using that program. If I can't, one of the pros here can do more with that than an amateur like me. Last edited by SaintessHeart; 2009-05-12 at 10:20.

2009-05-12, 11:46	Link #23
sa547 Senior Member Author Join Date: Oct 2007 Location: Philippines Age: 47	Also, since some RBN squatters seem to have taken secret residence in the hard disk, there's RootkitRevealer from Windows Sysinternals. Tool might help you find where the buggers are. __________________

2009-05-12, 12:21	Link #24
-KarumA- (｡☉౪ ⊙｡) Author Join Date: Jul 2004 Location: In Maya world, where all is 3D and everything crashes Age: 36	I did a step by step procedure on Bullguard and it seems everything has been solved, I am still hoping someone would check out my logs to see if it is truly clean. I'll put them up here as well since the people at Bullguard removed my topic, probably because I am not one of their customers Upon viewing the results from combofix when it comes to this rootkit the kit was located in my drivers of my usb D: all of them starting with ovfsth with more numbers and either .dll or .dat at the end, they have been removed by combofix as well as several other spam spreading files But everything is working again, no errors nothing I installed all my software afterwards (3ds Max, Office and Adobe) and they all work fine, but just in case I'l post all 3 logs up (malwarebytes, combofix and lastly a hijack this) another miracle D: my usb station returned omg! seems liek the deletion of the rootkit made my usb device station visible again, ever since the last attack 3 weeks ago I had been unable to even see these things AND ANOTHER OMG! Jinto should remember this, in my disc management my pc was still un able to read and recognize my discs but they are listed now as well! both my C:/ and D:/ are now listed D: a miracle has happened! I guess my pc wasn't perfectly clean after I reformatted it 3 weeks ago, because then those stations had been visible for like a day before vanishing again as well as my usb station under My Computer Spoiler for malware bytes: Malwarebytes' Anti-Malware 1.36 Database version: 1945 Windows 5.1.2600 Service Pack 3 12-5-2009 13:13:57 mbam-log-2009-05-12 (13-13-57).txt Scan type: Full Scan (C:\\|G:\\|) Objects scanned: 115916 Time elapsed: 27 minute(s), 3 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 3 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{c97fdf20-78b1-410f-9e8f-a5ef2a1326e1} (Trojan.Downloader) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{c97fdf20-78b1-410f-9e8f-a5ef2a1326e1} (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{c97fdf20-78b1-410f-9e8f-a5ef2a1326e1} (Trojan.Downloader) -> Delete on reboot. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\atmf.dll (Trojan.Downloader) -> Delete on reboot. I had scanned malware bytes first, then combofix and lastly did the hijack this log Spoiler for combofix: ComboFix 09-05-11.08 - anon 12-05-2009 15:09.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.2047.1619 [GMT 2:00] Gestart vanuit: c:\documents and settings\anon\Bureaublad\FIX\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090511-0] On-access scanning disabled (Updated) * Nieuw herstelpunt werd aangemaakt . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\command.pif c:\windows\system32\drivers\813b4a1d.sys c:\windows\system32\drivers\ovfsthpwnbawircvlpqvnk jpekdhhsayyqcwre.sys c:\windows\system32\Drivers\Svo45.sys c:\windows\system32\ovfsthfyalbyaiecwsvjvpraqqlarx oqykebgt.dll c:\windows\system32\ovfsthmallapkojuvxunyjmfnjtecl wjdxygmn.dll c:\windows\system32\ovfsthqgkoexgsjeddvfiowavphuqu nkkgkrwv.dat c:\windows\system32\ovfsthrulthwnkelswcgsfalwhkijj gkgcsbdx.dat c:\windows\system32\ovfsthwhvvuyeumgjktjkbgemjbmtq oohhopnq.dll c:\windows\system32\uniq.tll c:\windows\system32\atmf.dll . . . . konden niet verwijderd worden . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_ovfsthapjlhlpucdggpupqsxoimcjnnwvoirfl -------\Legacy_svo45 -------\Service_813b4a1d -------\Service_svo45 (((((((((((((((((((( Bestanden Gemaakt van 2009-04-12 to 2009-05-12 )))))))))))))))))))))))))))))) . 2009-05-12 12:29 . 2009-05-12 12:29 -------- d-sh--w c:\documents and settings\anon\Onlangs geopend 2009-05-12 12:19 . 2009-05-12 12:19 -------- d-----w c:\program files\Nero 2009-05-12 11:35 . 2009-05-12 11:46 -------- d-----w c:\program files\COMODO 2009-05-12 11:33 . 2009-05-12 11:33 -------- d-----w c:\program files\uTorrent 2009-05-12 11:33 . 2009-05-12 12:53 -------- d-----w c:\documents and settings\anon\Application Data\uTorrent 2009-05-12 11:18 . 2009-05-12 11:18 -------- d-----w c:\program files\Common Files\Stardock 2009-05-12 10:44 . 2009-05-12 10:44 -------- d-----w c:\documents and settings\anon\Application Data\Malwarebytes 2009-05-12 10:44 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-05-12 10:44 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-05-12 10:44 . 2009-05-12 10:44 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes 2009-05-12 10:44 . 2009-05-12 10:44 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-11 23:45 . 2009-05-11 23:45 -------- d-----w c:\documents and settings\LocalService.NT AUTHORITY\Bureaublad 2009-05-11 23:34 . 2009-05-11 23:52 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft 2009-05-11 19:21 . 2009-05-11 19:58 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2009-05-10 14:31 . 2009-05-10 15:49 -------- d-----w c:\documents and settings\LocalService.NT AUTHORITY\Application Data\GameTracker 2009-05-10 08:45 . 2009-05-10 08:45 -------- d-----w c:\documents and settings\anon\Application Data\vlc 2009-04-30 21:09 . 2009-04-30 21:09 2560 ----a-w c:\windows\_MSRSTRT.EXE 2009-04-30 16:15 . 2009-04-30 16:15 -------- d-----w c:\documents and settings\anon\Application Data\Publish Providers 2009-04-30 16:14 . 2009-04-30 16:14 -------- d-----w c:\documents and settings\anon\Application Data\Sony 2009-04-30 16:14 . 2009-04-30 16:14 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Sony 2009-04-30 16:11 . 2009-04-30 16:11 -------- d-----w c:\program files\Sony 2009-04-30 09:44 . 2000-10-09 23:00 49152 ----a-w c:\windows\system32\DartObjects.dll 2009-04-30 09:44 . 2002-11-24 23:00 118784 ----a-w c:\windows\system32\DartWeb.dll 2009-04-30 09:44 . 2002-11-21 23:00 221184 ----a-w c:\windows\system32\DartSock.dll 2009-04-30 09:38 . 2009-04-30 10:04 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Stardock 2009-04-30 09:38 . 2000-10-19 23:05 25088 ----a-w c:\windows\system32\msxml3a.dll 2009-04-30 09:37 . 2009-04-30 21:08 -------- d-----w c:\program files\Object Desktop 2009-04-30 09:25 . 2009-04-30 10:28 -------- d-----w c:\program files\Stardock 2009-04-27 15:17 . 2009-05-12 08:32 -------- d-----w c:\program files\MagicISO 2009-04-25 15:05 . 2005-02-26 05:34 442368 ----a-r c:\windows\system32\vp6vfw.dll 2009-04-25 13:21 . 2008-04-25 17:41 218624 -c--a-w c:\windows\system32\dllcache\uxtheme.dll 2009-04-20 20:35 . 2009-04-29 22:40 -------- d-----w c:\program files\Raxco 2009-04-20 12:30 . 2009-04-20 12:30 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Identities 2009-04-20 12:24 . 2009-04-20 12:24 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\WinZip 2009-04-20 12:23 . 2009-04-20 12:31 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\WinZip 2009-04-19 12:00 . 2009-04-19 12:00 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\CAPCOM 2009-04-19 11:38 . 2008-04-13 18:45 60032 -c--a-w c:\windows\system32\dllcache\usbaudio.sys 2009-04-19 11:38 . 2008-04-13 18:45 60032 ----a-w c:\windows\system32\drivers\USBAUDIO.sys 2009-04-19 11:34 . 2009-04-19 11:34 -------- d-----w c:\documents and settings\anon\Application Data\Apple Computer 2009-04-15 18:49 . 2009-05-12 12:21 -------- d-----w c:\program files\Common Files\Nero 2009-04-15 18:39 . 2009-04-15 18:39 -------- d-----w c:\program files\NeroInstall.bak 2009-04-14 12:55 . 2009-04-14 12:56 -------- d-----w c:\documents and settings\anon\Application Data\Autodesk 2009-04-14 12:52 . 2009-04-14 12:52 -------- d-----w c:\program files\Turbo Squid Tentacles 2009-04-14 12:51 . 2009-04-14 12:51 -------- d-----w c:\program files\Microsoft WSE 2009-04-14 12:46 . 2009-04-14 12:46 150520 ----a-w c:\documents and settings\LocalService.NT AUTHORITY\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-04-14 12:29 . 2009-04-14 12:29 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Autodesk 2009-04-14 12:26 . 2009-05-12 11:28 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Autodesk 2009-04-14 12:25 . 2007-05-16 14:45 443752 ----a-w c:\windows\system32\d3dx10_34.dll 2009-04-14 12:25 . 2007-05-16 14:45 1124720 ----a-w c:\windows\system32\D3DCompiler_34.dll 2009-04-14 12:25 . 2007-05-16 14:45 3497832 ----a-w c:\windows\system32\d3dx9_34.dll 2009-04-14 08:19 . 2009-04-14 08:19 -------- d-----w c:\documents and settings\anon\Application Data\ImgBurn 2009-04-14 08:10 . 2009-04-14 08:10 -------- d-----w c:\documents and settings\anon\LocalLow 2009-04-14 08:06 . 2009-04-14 08:06 -------- d-----w c:\documents and settings\anon\Application Data\DAEMON Tools Pro 2009-04-14 08:06 . 2009-04-14 08:06 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite 2009-04-14 08:06 . 2009-04-14 08:06 -------- d-----w c:\program files\DAEMON Tools Lite 2009-04-14 08:06 . 2009-04-14 08:06 -------- d-----w c:\documents and settings\anon\Application Data\DAEMON Tools Lite 2009-04-14 00:32 . 2009-04-14 00:32 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Ahead 2009-04-14 00:32 . 2009-04-14 00:32 -------- d-----w c:\documents and settings\anon\Application Data\Nero 2009-04-14 00:28 . 2009-05-12 12:19 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Nero 2009-04-13 23:31 . 2009-04-13 23:31 -------- d-----w c:\documents and settings\anon\Application Data\Uniblue 2009-04-13 23:25 . 2003-06-18 15:31 17920 ----a-w c:\windows\system32\mdimon.dll 2009-04-13 23:13 . 2009-04-30 21:07 -------- d---a-w c:\documents and settings\All Users.WINDOWS\Application Data\TEMP 2009-04-13 23:08 . 2009-04-13 23:08 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer 2009-04-13 23:08 . 2009-04-13 23:08 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Apple 2009-04-13 23:08 . 2009-04-13 23:08 -------- d-----w c:\program files\Apple Software Update 2009-04-13 23:08 . 2009-04-13 23:08 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Apple 2009-04-13 23:08 . 2009-04-13 23:08 -------- d-----w c:\documents and settings\anon\Application Data\Media Player Classic 2009-04-13 23:04 . 2009-04-13 23:04 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Apple Computer 2009-04-13 23:01 . 2006-06-29 11:07 14048 ----a-w c:\windows\system32\spmsg2.dll 2009-04-13 22:54 . 2009-04-13 22:54 -------- d-----w c:\program files\KeyHoleTV 2009-04-13 22:52 . 2009-05-01 08:49 -------- d-----w c:\documents and settings\anon\Application Data\mIRC 2009-04-13 22:51 . 2009-04-13 22:51 -------- d-----w c:\documents and settings\anon\Application Data\Sony Setup 2009-04-13 22:26 . 2009-04-13 22:26 717296 ----a-w c:\windows\system32\drivers\sptd.sys 2009-04-13 22:26 . 2009-04-14 08:06 -------- d-----w c:\documents and settings\anon\Application Data\DAEMON Tools 2009-04-13 18:41 . 2009-04-13 18:41 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Macrovision 2009-04-13 18:40 . 2009-04-13 18:40 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Installer1404 2009-04-13 18:38 . 2009-04-13 18:38 -------- d-----w C:\14343518650ab06c0a704716ee 2009-04-13 18:37 . 2009-04-13 18:38 -------- d-----w C:\4d9c2d6b17b5c4db032b28ebe6ee 2009-04-13 18:24 . 2009-04-13 18:25 209 ----a-w c:\windows\BricoPackFoldersDelete.cmd 2009-04-13 17:30 . 2009-05-10 21:05 -------- d-----w c:\documents and settings\anon\Application Data\BitTorrent 2009-04-13 17:22 . 2009-05-12 12:54 -------- d-----w c:\documents and settings\anon\Tracing 2009-04-13 16:41 . 2009-04-13 16:41 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\FLEXnet 2009-04-13 16:40 . 2009-05-12 10:39 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\COMODO 2009-04-13 16:30 . 2009-04-13 16:30 155 ----a-w c:\windows\system32\SelfDel.bat 2009-04-13 16:29 . 2009-04-13 18:25 72066 ----a-w c:\windows\BricoPackUninst.cmd 2009-04-13 16:03 . 2007-02-20 14:04 190696 ----a-w c:\windows\system32\NPSWF32_FlashUtil.exe 2009-04-13 16:03 . 2007-02-20 14:04 2463976 ----a-w c:\windows\system32\NPSWF32.dll 2009-04-13 15:58 . 2009-04-13 15:58 -------- d-----w c:\program files\CleanMyPC 2009-04-13 15:58 . 2009-05-12 13:11 97792 ----a-w c:\windows\system32\atmf.dll 2009-04-13 15:46 . 2009-04-13 15:46 49079 ----a-w c:\windows\system32\RadLightAPEUninstall.exe 2009-04-13 15:33 . 2009-04-14 13:21 -------- d-----w c:\documents and settings\Admin 2009-04-13 15:11 . 2008-04-14 17:02 21504 ----a-w c:\windows\system32\hidserv.dll 2009-04-13 15:10 . 2001-08-17 21:59 3072 ----a-w c:\windows\system32\drivers\audstub.sys 2009-04-13 15:10 . 2008-04-14 16:34 58112 ----a-w c:\windows\system32\drivers\redbook.sys 2009-04-13 15:09 . 2001-08-17 21:46 6400 ----a-w c:\windows\system32\drivers\enum1394.sys 2009-04-13 15:09 . 2008-04-14 17:02 76288 ----a-w c:\windows\system32\usbui.dll 2009-04-13 15:03 . 2006-03-02 12:00 13312 -c--a-w c:\windows\system32\dllcache\irclass.dll 2009-04-13 14:48 . 2008-12-20 23:03 459264 -c--a-w c:\windows\system32\dllcache\msfeeds.dll 2009-04-13 14:48 . 2008-12-20 23:03 52224 -c--a-w c:\windows\system32\dllcache\msfeedsbs.dll 2009-04-13 14:48 . 2008-12-20 23:03 267776 -c--a-w c:\windows\system32\dllcache\iertutil.dll 2009-04-13 14:48 . 2008-12-19 09:10 13824 -c--a-w c:\windows\system32\dllcache\ieudinit.exe 2009-04-13 14:48 . 2007-04-17 09:32 2455488 -c--a-w c:\windows\system32\dllcache\ieapfltr.dat 2009-04-13 14:48 . 2008-12-20 23:03 383488 -c--a-w c:\windows\system32\dllcache\ieapfltr.dll 2009-04-13 14:48 . 2008-12-20 23:03 6066688 -c--a-w c:\windows\system32\dllcache\ieframe.dll 2009-04-13 14:48 . 2008-12-20 23:03 63488 -c--a-w c:\windows\system32\dllcache\icardie.dll 2009-04-13 14:40 . 2009-05-12 09:37 -------- d-----w c:\documents and settings\anon\Local Settings\Application Data\Adobe 2009-04-13 14:37 . 2008-06-14 17:36 272640 -c--a-w c:\windows\system32\dllcache\bthport.sys 2009-04-13 14:37 . 2008-12-20 23:03 826368 -c--a-w c:\windows\system32\dllcache\wininet.dll 2009-04-13 14:37 . 2008-10-16 01:02 1499136 -c--a-w c:\windows\system32\dllcache\shdocvw.dll 2009-04-13 14:37 . 2008-12-20 23:03 1160192 -c--a-w c:\windows\system32\dllcache\urlmon.dll 2009-04-13 14:37 . 2008-08-14 13:27 2149888 -c--a-w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-04-13 14:37 . 2008-08-14 13:27 2070400 -c--a-w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-04-13 14:37 . 2008-08-14 13:27 2028544 -c--a-w c:\windows\system32\dllcache\ntkrpamp.exe 2009-04-13 14:37 . 2008-08-14 13:27 2193536 -c--a-w c:\windows\system32\dllcache\ntoskrnl.exe 2009-04-13 14:36 . 2008-05-08 14:02 203136 -c--a-w c:\windows\system32\dllcache\rmcast.sys 2009-04-13 14:36 . 2008-10-24 11:21 455296 -c--a-w c:\windows\system32\dllcache\mrxsmb.sys 2009-04-13 14:36 . 2008-12-11 10:57 333952 -c--a-w c:\windows\system32\dllcache\srv.sys 2009-04-13 14:36 . 2008-05-01 14:37 331776 -c--a-w c:\windows\system32\dllcache\msadce.dll 2009-04-13 14:36 . 2009-01-16 19:31 3594752 -c--a-w c:\windows\system32\dllcache\mshtml.dll 2009-04-13 14:36 . 2008-10-15 16:37 337408 -c--a-w c:\windows\system32\dllcache\netapi32.dll 2009-04-13 14:36 . 2008-09-04 17:17 1106944 -c--a-w c:\windows\system32\dllcache\msxml3.dll 2009-04-13 14:23 . 2004-08-03 22:54 701440 ----a-w c:\windows\system32\drivers\ati2mtag.sys 2009-04-13 14:16 . 2009-04-13 14:16 -------- d-sh--w c:\documents and settings\anon\UserData 2009-04-13 14:14 . 2008-04-11 19:06 691712 -c--a-w c:\windows\system32\dllcache\inetcomm.dll 2009-04-13 13:57 . 2009-04-13 13:57 -------- d-----w c:\documents and settings\anon\Contacts . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))) )) . 2009-05-12 12:28 . 2008-06-13 21:30 -------- d-----w c:\program files\CCleaner 2009-05-12 11:29 . 2008-02-15 16:44 -------- d-----w c:\program files\Common Files\Autodesk Shared 2009-05-12 10:12 . 2009-01-02 11:56 -------- d-----w c:\program files\Java 2009-05-12 10:06 . 2009-02-01 12:52 -------- d-----w c:\program files\Vstplugins 2009-05-12 09:57 . 2009-01-28 13:20 -------- d-----w c:\program files\Common Files\Adobe 2009-05-12 09:52 . 2009-02-08 12:52 -------- d-----w c:\program files\Bonjour 2009-05-12 09:09 . 2008-08-03 11:32 -------- d-----w c:\program files\TVUPlayer 2009-05-12 09:04 . 2009-02-08 16:42 -------- d-----w c:\program files\Common Files\Control Panels 2009-05-12 08:32 . 2009-02-26 15:18 -------- d-----w c:\program files\Runes of Magic 2009-05-10 09:01 . 2008-02-09 17:04 -------- d-----w c:\program files\Combined Community Codec Pack 2009-05-01 08:48 . 2009-01-13 11:19 -------- d-----w c:\program files\mIRC 2009-04-25 20:05 . 2006-03-02 12:00 218624 ----a-w c:\windows\system32\uxtheme.dll 2009-04-14 12:51 . 2008-02-15 16:44 -------- d-----w c:\program files\Autodesk 2009-04-14 12:46 . 2006-03-02 12:00 86676 ----a-w c:\windows\system32\perfc013.dat 2009-04-14 12:46 . 2006-03-02 12:00 499770 ----a-w c:\windows\system32\perfh013.dat 2009-04-13 23:38 . 2009-02-05 10:08 -------- d-----w c:\program files\Registry Easy 2009-04-13 23:08 . 2009-02-08 14:56 -------- d-----w c:\program files\QuickTime 2009-04-13 23:08 . 2008-02-06 15:51 -------- d-----w c:\program files\QuickTime Alternative 2009-04-13 17:12 . 2009-03-14 18:24 -------- d-----w c:\program files\Windows Live SkyDrive 2009-04-13 17:12 . 2008-02-10 09:55 -------- d-----w c:\program files\Windows Live 2009-04-13 16:29 . 2009-04-13 18:25 219136 ----a-w c:\windows\system32\nsy312.tmp 2009-04-13 16:26 . 2008-09-08 21:47 -------- d-----w c:\program files\AGEIA Technologies 2009-04-13 14:32 . 2009-04-13 13:18 76487 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-13 13:41 . 2008-01-31 08:52 -------- d-----w c:\program files\Realtek 2009-04-13 13:18 . 2006-03-02 12:00 67 --sha-w c:\windows\Fonts\desktop.ini 2009-04-13 13:16 . 2009-04-13 13:16 21748 ----a-w c:\windows\system32\emptyregdb.dat 2009-04-08 12:11 . 2008-01-31 10:50 76728 ----a-w c:\documents and settings\Diepenhorst\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-08 10:22 . 2009-04-08 10:22 -------- d-----w c:\program files\Alwil Software 2009-03-15 16:45 . 2009-03-15 16:45 -------- d-----w c:\program files\Belastingdienst 2009-03-14 18:24 . 2009-03-14 18:24 -------- d-----w c:\program files\Microsoft 2009-03-14 18:22 . 2009-03-14 18:22 -------- d-----w c:\program files\Common Files\Windows Live 2008-12-30 20:17 . 2008-12-27 19:41 128 --sh--w c:\program files\desktop.ini . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))) ) . . Nota lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C97FDF20-78B1-410F-9E8F-A5EF2A1326E1}] 2009-05-12 13:11 97792 ----a-w c:\windows\system32\atmf.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-12 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray. dll" [2007-04-12 81920] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp. exe" [2009-02-05 81000] "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-08 16380416] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-04-12 1626112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer] "NoSetActiveDesktop"= 1 (0x1) "NoActiveDesktopChanges"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\UT GOTY\\UnrealTournament\\System\\UnrealTournament.e xe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\KeyHoleTV\\KeyHoleTV.exe"= "c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"= "c:\\Program Files\\Autodesk\\Backburner\\manager.exe"= "c:\\Program Files\\Autodesk\\Backburner\\server.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\Program Files\\Autodesk\\3ds Max 2009\\3dsmax.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R0 ekcrsmch;ekcrsmch;c:\windows\system32\drivers\ekcr smch.sys [2-3-2006 14:00 23424] R1 aswsp;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [12-5-2009 12:27 114768] R2 aswfsblk;aswFsBlk;c:\windows\system32\drivers\aswF sBlk.sys [12-5-2009 12:27 20560] R2 mi-raysat_3dsmax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32serve r.exe [10-3-2008 0:04 65536] S0 lbd;Lbd; [x] S3 PciCon;PciCon;\??\f:\pcicon.sys --> f:\PciCon.sys [?] S4 ntfrrofdnrn;ntfrrofdnrn; [x] [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{0dab9b71-2880-11de-b375-001e8c1b861c}] \shell\autorun\command - E:\Setupx.exe . - - - - ORPHANS VERWIJDERD - - - - HKCU-Run-Uniblue RegistryBooster 2 - c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe . ------- Bijkomende Scan ------- . IE: e&xport to microsoft excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\anon\Application Data\Mozilla\Firefox\Profiles\esz3qr5o.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - plugin: c:\documents and settings\anon\Application Data\Mozilla\Firefox\Profiles\esz3qr5o.default\ext ensions\firefox@tvunetworks.com\plugins\npTVUAx.dl l FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll . ************************************************ ******************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-12 15:15 Windows 5.1.2600 Service Pack 3 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ********************************************** ******************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_USERS\S-1-5-21-484763869-220523388-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Exp lorer\CLSID] @Denied: (Full) (LocalSystem) . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'explorer.exe'(2324) c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\msls31.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Andere Aktieve Processen ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\rundll32.exe c:\windows\system32\wscntfy.exe . ********************************************** ******************** . Voltooingstijd: 2009-05-12 15:19 - machine werd herstart ComboFix-quarantined-files.txt 2009-05-12 13:19 Pre-Run: 84.525.277.184 bytes beschikbaar Post-Run: 90.301.304.832 bytes beschikbaar WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Home Edition" /noexecute=optin /fastdetect 292 --- E O F --- 2009-04-13 16:38 Spoiler** for hijack this: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:19:53, on 12-5-2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32serve r.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\notepad.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\anon\Bureaublad\FIX\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file) O2 - BHO: (no name) - {C97FDF20-78B1-410F-9E8F-A5EF2A1326E1} - C:\WINDOWS\system32\atmf.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: e&xport to microsoft excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Autodesk Licensing Service (autodesk licensing service) - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Intelligente achtergrondsoverdrachtservice (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: Macromedia Licensing Service (macromedia licensing service) - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsmax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32serve r.exe O23 - Service: NMIndexingService (nmindexingservice) - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Automatische updates (wuauserv) - Unknown owner - C:\WINDOWS\ -- End of file - 4969 bytes

2009-05-12, 12:25	Link #25
SaintessHeart NYAAAAHAAANNNNN~ Join Date: Nov 2007 Age: 35	Screw Norton Ghost. Erase everything. Did you do a quick format or a thorough one? Also after formatting remember to shut down and discharge your PC as a safeguard, some viruses store themselves in the RAM during the format, then rewrite into the HD after it is done. Either that or your disk has a bad sector, which means it isn't a virus after all. __________________ When three puppygirls named after pastries are on top of each other, it is called Eclair a'la menthe et Biscotti aux fraises avec beaucoup de Ricotta sur le dessus. Most of all, you have to be disciplined and you have to save, even if you hate our current financial system. Because if you don't save, then you're guaranteed to end up with nothing.

2009-05-12, 13:06	Link #26
-KarumA- (｡☉౪ ⊙｡) Author Join Date: Jul 2004 Location: In Maya world, where all is 3D and everything crashes Age: 36	I think it was a quick one, I don't know much about reformatting basically inserted windows CD and reinstalled windows but kept all my data save except what was stored in my documents etc. after that installed drivers of my graphics card etc. and reinstalled my software that was it there is one entry that I am still concerned about: O2 - BHO: (no name) - {C97FDF20-78B1-410F-9E8F-A5EF2A1326E1} - C:\WINDOWS\system32\atmf.dll combofix and malwarebytes have been unable to delete it and when I try and remove it with hijack this it returns the next time I scan, when I google I only get virus warnings etc. but never a clear notice on how I can remove it or what process name it hides under so I can terminate it and then remove it manual, I also read that it can be related to Adobe Fonts though I upped it to Jotti which can scan individual files and the result is that out of 20 scanners 3 say it is malware: A Squarred: Trojan.Trash!IK Antivir: TR/Trash.Gen and Ikarus: Trojan.Trash also upped it to Virus Total: again 3 out of 20 says it is malware AhnLab-V3 - - - AntiVir - - TR/Trash.Gen Antiy-AVL - - - Authentium - - - Avast - - - AVG - - - BitDefender - - - CAT-QuickHeal - - - ClamAV - - - Comodo - - - DrWeb - - - eSafe - - - eTrust-Vet - - - F-Prot - - - F-Secure - - - Fortinet - - - GData - - - Ikarus - - Trojan.Trash K7AntiVirus - - - Kaspersky - - - McAfee - - - McAfee+Artemis - - - McAfee-GW-Edition - - Trojan.Trash.Gen Microsoft - - - NOD32 - - - Norman - - - nProtect - - - Panda - - - PCTools - - - Prevx1 - - - Rising - - - Sophos - - - Sunbelt - - - Symantec - - - TheHacker - - - TrendMicro - - - VBA32 - - - ViRobot - - - VirusBuster

2009-05-12, 13:06	Link #27
Jinto Asuki-tan Kairin ↓ Join Date: Feb 2004 Location: Fürth (GER) Age: 43	Ah and btw... Try to use just legit software on your system (you never know what sort of wicked set of trojans is installed with pirated software). I mean you can wipe your system as much as you want, but it won't make things better if you later just re-install the virii and trojans. __________________ Folding@Home, Team Animesuki

2009-05-18, 15:01	Link #39
Vexx Obey the Darkly Cute ... Author Join Date: Dec 2005 Location: On the whole, I'd rather be in Kyoto ... Age: 66	yay, another bot node defanged __________________ "It Really IS Rocket Science", Novel series rough drafts; vol. 1 thru vol. 3 complete Volume 4 in work, Visit the thread for short stories!