Hi,

First of all i´d like to introduce myself. I am Mike im not much of an anti virus expert myself. I have a problem with my computer and I think this is the best place to come to because of your expertise and the fact that this guy link had the exact same problem and it was fixed somehow. For the record I am talking about a very annoying program that imitates Windows in some ways claiming my system is infected and I should download Spyware Cleaner. It comes with bogus windows icons and everything. It has an annoying pop up bar that tries to connect with suspicious sites and once in a while it makes my computer completely crash. So well bottomline I hate it and want to destroy it. I hope you guys can help! Oh it also accasionaly shutsdown installers, like for antivirus programs. I cant install spybot for instance it just shuts the installer window down!

I wanted to try this sollution but then I started to think what if this is not exaclty the same and I accidently delete some files or something I need in order to keep windows running. So I decided to come here and register as well, I hope its not double the work, I just dont wanna mess up my computer! This is my Hijack Log.

Logfile of HijackThis v1.99.1
Scan saved at 21:09:20, on 8-11-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PackethSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\DeltTray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InstantOn] "C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe /c "
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [eTrust PestPatrol Active Protection] none
O4 - HKLM\..\Run: [AntivirusRegistration] C:\Program Files\CA\Etrust Antivirus\Register.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ncxuzmju] rundll32.exe "C:\Program Files\ixolajib\urcdypmv.dll",Init
O4 - HKLM\..\Run: [qnovafgf] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\qnovafgf.dll"
O4 - HKLM\..\Run: [udwhunor] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\udwhunor.dll"
O4 - HKLM\..\Run: [404e74fc] rundll32.exe "C:\WINDOWS\system32\gykpthgk.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QuickClean Imonitor] C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Startup: findfast.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: autorun.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobiele favorieten maken... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130364442791
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1131365030359
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/er...erInstallNL.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00A9D08.dat
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\system32\PackethSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Hoi,

Ik zie dat je nederlandstalig bent, dus lijkt het me beter om de instructies in het Nederlands te posten

* Download Combofix naar je bureaublad (belangrijk!).

Indien je Combofix al eerder hebt gebruikt, gelieve die versie te verwijderen en Combofix opnieuw te downloaden via bovenstaande link, want Combofix wordt dagelijks geupdate.

Indien je, na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus of andere Realtime scanner, schakel deze scanner uit en download Combofix opnieuw. Dit omdat sommige scanners bepaalde componenten die Combofix gebruikt als verdacht zien en dit gaan blokkeren of verwijderen.

* Dubbelklik ComboFix.exe
Volg de instructies.
Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix gedaan heeft en na herstart (indien Combofix de computer heeft doen herstarten), zal Combofix opnieuw scannen om de nodige info in een log te plaatsen. Daarna zal Combofix sluiten en de log combofix.txt zal openen.
Kopieer en plak de inhoud van deze log in je volgende post samen met een nieuw hijackthislog.

Hoi Miekie Mous,

bedankt voor de reactie! Ik heb je advies opgevolgd en hier is het resultaat:

Hijack This Log:

Logfile of HijackThis v1.99.1
Scan saved at 20:43:49, on 10-11-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PackethSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\DeltTray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe
C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Winamp\winamp.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll
O2 - BHO: (no name) - {2D628D87-D0A3-6203-4E86-09D91C6DD614} - C:\Program Files\Ztfmogur\xaasbotl.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {B02199BD-9BED-4943-A939-ADC51602ADDD} - C:\WINDOWS\system32\mllmn.dll (file missing)
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InstantOn] "C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe /c "
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [eTrust PestPatrol Active Protection] none
O4 - HKLM\..\Run: [AntivirusRegistration] C:\Program Files\CA\Etrust Antivirus\Register.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QuickClean Imonitor] C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobiele favorieten maken... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130364442791
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1131365030359
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/er...erInstallNL.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\system32\PackethSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Combofix Log:

ComboFix 07-11-08.1 - Rockmore 2007-11-10 20:33:56.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.469 [GMT 1:00]
Gestart vanuit: C:\Documents and Settings\Rockmore\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\udwhunor.dll
C:\Program Files\ucleaner_setup.exe
C:\Program Files\Ultimate Cleaner
C:\WINDOWS\Free Online Dating.ico
C:\WINDOWS\system32\dyywpdqt.exe
C:\WINDOWS\system32\msvdprqe
C:\WINDOWS\system32\msvdprqe\bg1.gif
C:\WINDOWS\system32\msvdprqe\bgtop.gif
C:\WINDOWS\system32\msvdprqe\bottom1.gif
C:\WINDOWS\system32\msvdprqe\essentials.gif
C:\WINDOWS\system32\msvdprqe\icon1.ico
C:\WINDOWS\system32\msvdprqe\install1.gif
C:\WINDOWS\system32\msvdprqe\left1.gif
C:\WINDOWS\system32\msvdprqe\li.gif
C:\WINDOWS\system32\msvdprqe\logo.gif
C:\WINDOWS\system32\msvdprqe\main.htm
C:\WINDOWS\system32\msvdprqe\mainframe.htm
C:\WINDOWS\system32\msvdprqe\msvdprqe1.exe
C:\WINDOWS\system32\msvdprqe\msvdprqe2.exe
C:\WINDOWS\system32\msvdprqe\msvdprqe3.exe
C:\WINDOWS\system32\msvdprqe\reinstall1.gif
C:\WINDOWS\system32\msvdprqe\right1.gif
C:\WINDOWS\system32\msvdprqe\s1.htm
C:\WINDOWS\system32\msvdprqe\s2.htm
C:\WINDOWS\system32\msvdprqe\s3.htm
C:\WINDOWS\system32\msvdprqe\SMTop1.gif
C:\WINDOWS\system32\msvdprqe\SMTop2.gif
C:\WINDOWS\system32\msvdprqe\SMTop3.gif
C:\WINDOWS\system32\msvdprqe\SMTop4.gif
C:\WINDOWS\system32\msvdprqe\soft1_off.gif
C:\WINDOWS\system32\msvdprqe\soft1_off_ext.gif
C:\WINDOWS\system32\msvdprqe\soft1_on.gif
C:\WINDOWS\system32\msvdprqe\soft1_on_ext.gif
C:\WINDOWS\system32\msvdprqe\soft2_off.gif
C:\WINDOWS\system32\msvdprqe\soft2_off_ext.gif
C:\WINDOWS\system32\msvdprqe\soft2_on.gif
C:\WINDOWS\system32\msvdprqe\soft2_on_ext.gif
C:\WINDOWS\system32\msvdprqe\soft3_off.gif
C:\WINDOWS\system32\msvdprqe\soft3_off_ext.gif
C:\WINDOWS\system32\msvdprqe\soft3_on.gif
C:\WINDOWS\system32\msvdprqe\soft3_on_ext.gif
C:\WINDOWS\system32\msvdprqe\softbottom_off.gif
C:\WINDOWS\system32\msvdprqe\softbottom_on.gif
C:\WINDOWS\system32\msvdprqe\softleft_off.gif
C:\WINDOWS\system32\msvdprqe\softleft_on.gif
C:\WINDOWS\system32\msvdprqe\top1.gif
C:\WINDOWS\system32\msvdprqe\top2.gif
C:\WINDOWS\system32\msvdprqe\turnoff1.gif
C:\WINDOWS\system32\msvdprqe\turnon1.gif
C:\WINDOWS\system32\nmllm.bak1
C:\WINDOWS\system32\nmllm.bak2
C:\WINDOWS\system32\nmllm.ini
C:\WINDOWS\system32\nmllm.ini2
C:\WINDOWS\system32\nmllm.tmp
C:\WINDOWS\system32\qsmrukbb.dll
C:\WINDOWS\system32\ugcowjkc.dll
C:\WINDOWS\system32\uktugwvx.dll
C:\WINDOWS\system32\ukvrywhh.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\nm


(((((((((((((((((((( Bestanden Gemaakt van 2007-10-10 to 2007-11-10 ))))))))))))))))))))))))))))))
.

2007-11-10 20:32 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-09 22:30 <DIR> d-------- C:\Program Files\Mindscape
2007-11-09 21:04 <DIR> d-------- C:\Temp\wc_calc
2007-11-09 20:48 1,044,480 --a------ C:\WINDOWS\system32\Roboex32.dll
2007-11-09 20:48 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll
2007-11-09 20:44 <DIR> d-------- C:\Program Files\LMSOFT Web Creator Pro 3
2007-11-09 16:07 <DIR> d-------- C:\WINDOWS\Icons
2007-11-09 04:13 <DIR> d-------- C:\Documents and Settings\NetworkService\Bureaublad
2007-11-09 02:54 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-11-09 02:54 <DIR> d-------- C:\Documents and Settings\Rockmore\Application Data\SUPERAntiSpyware.com
2007-11-09 02:52 <DIR> d-------- C:\Program Files\Alwil Software
2007-11-08 23:35 <DIR> d-------- C:\Program Files\IrfanView
2007-11-08 23:04 <DIR> d-------- C:\Program Files\Bradbury
2007-11-08 23:02 <DIR> d-------- C:\Program Files\Common Files\Agnitum Shared
2007-11-08 23:02 <DIR> d-------- C:\Program Files\Agnitum
2007-11-08 21:49 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-11-08 21:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 1.1
2007-11-08 21:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-11-08 21:25 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-08 20:56 <DIR> d-------- C:\Program Files\STOPzilla!
2007-11-08 20:56 <DIR> d-------- C:\Program Files\Common Files\iS3
2007-11-08 20:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2007-11-08 20:31 71,232 --a------ C:\WINDOWS\system32\hhceduoc.exe
2007-11-08 18:11 <DIR> d-------- C:\Program Files\InterMute
2007-11-08 16:04 <DIR> d-------- C:\Program Files\Hercules
2007-11-05 00:45 78,912 --a------ C:\WINDOWS\system32\qeqmpgnu.dll
2007-11-04 14:32 <DIR> d-------- C:\Program Files\AdultPDF
2007-11-01 23:07 <DIR> dr-h----- C:\Documents and Settings\Rockmore\Onlangs geopend
2007-11-01 23:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-11-01 23:06 <DIR> d-------- C:\Program Files\Common Files\Control Panels
2007-11-01 00:47 9,216 --a------ C:\Documents and Settings\Rockmore\install.exe
2007-11-01 00:47 48 --a------ C:\Documents and Settings\Rockmore\readme.bat
2007-11-01 00:06 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-10-31 23:53 <DIR> d-------- C:\Program Files\MagicDisc
2007-10-31 23:53 92,544 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
2007-10-30 02:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-10-26 17:41 <DIR> d-------- C:\Program Files\SampleTank 2
2007-10-18 16:56 <DIR> dr-h----- C:\Documents and Settings\Rockmore\Application Data\SecuROM
2007-10-18 16:53 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-10-18 16:52 <DIR> d--h----- C:\Documents and Settings\Rockmore\InstallAnywhere
2007-10-10 17:39 <DIR> d-------- C:\Program Files\Uniblue
2007-10-10 17:39 <DIR> d-------- C:\Documents and Settings\Rockmore\Application Data\Uniblue
2007-10-10 17:32 <DIR> d-------- C:\BACKUP

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-10 19:34 --------- d-----w C:\Program Files\DC++
2007-11-10 02:00 3,072 ----a-w C:\WINDOWS\system32\drivers\8EBC064C-7710-46D6-816A-7C5752EF4F8A.cxv
2007-11-09 02:33 1,024 ----a-w C:\WINDOWS\system32\drivers\4C9F8F54-E511-4805-9984-FA75A70D43BD.cxv
2007-11-08 21:29 --------- d-----w C:\Program Files\Kazaa
2007-11-08 20:26 --------- d-----w C:\Program Files\Lavasoft
2007-11-08 19:58 4,096 ----a-w C:\WINDOWS\system32\drivers\7E0699C9-FCA7-4C9D-B373-B4667A73380F.cxv
2007-11-08 15:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-03 08:53 --------- d-----w C:\Program Files\MagicISO
2007-11-03 08:50 --------- d-----w C:\Program Files\Trojan Remover
2007-11-01 22:07 --------- d-----w C:\Program Files\NoAdware
2007-11-01 22:02 --------- d-----w C:\Program Files\Macromedia
2007-11-01 21:46 --------- d-----w C:\Program Files\Common Files\Macromedia
2007-11-01 18:09 --------- d-----w C:\Program Files\FLStudio
2007-11-01 16:30 --------- d-----w C:\Program Files\AddRemove
2007-10-31 23:17 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-30 03:25 3,590 ----a-w C:\Documents and Settings\Rockmore\Application Data\wklnhst.dat
2007-10-29 15:43 --------- d-----w C:\Documents and Settings\Rockmore\Application Data\OpenOffice.org2
2007-10-22 15:07 --------- d-----w C:\Program Files\BitTorrent
2007-10-18 15:57 --------- d-----w C:\Documents and Settings\Rockmore\Application Data\Sports Interactive
2007-10-13 01:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-10-10 16:46 --------- d-----w C:\Program Files\RegistryFix
2007-08-27 23:32 617 ----a-w C:\WINDOWS\Fonts\dingosaurs.txt
2007-08-27 11:36 487 ----a-w C:\WINDOWS\Fonts\loosydings-expert_Readme.txt
2007-02-11 19:22 6,494 ----a-w C:\Documents and Settings\Jolijn\Application Data\wklnhst.dat
2007-02-02 10:49 174,216 ----a-w C:\Documents and Settings\Rockmore\Application Data\GDIPFONTCACHEV1.DAT
2006-12-05 20:44 174,216 ----a-w C:\Documents and Settings\Jolijn\Application Data\GDIPFONTCACHEV1.DAT
2006-09-04 00:10 0 ----a-w C:\Program Files\SpoonInstaller.TMP
2005-10-27 00:05:59 8 --sh--r C:\WINDOWS\system32\7767FFB962.sys
2005-11-07 11:28:35 56 --sh--r C:\WINDOWS\system32\EA74F080C2.sys
2005-11-07 11:28:35 5,746 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D628D87-D0A3-6203-4E86-09D91C6DD614}]
C:\Program Files\Ztfmogur\xaasbotl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B02199BD-9BED-4943-A939-ADC51602ADDD}]
C:\WINDOWS\system32\mllmn.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 13:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 13:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 13:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 13:00]
"CHotkey"="mHotkey.exe" []
"ledpointer"="CNYHKey.exe" [2005-11-10 14:41 C:\WINDOWS\CNYHKey.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-01-11 17:23 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2005-10-10 20:49 C:\WINDOWS\system32\nwiz.exe]
"PCMService"="C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" [2006-02-09 19:02]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"InstantOn"="C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe" [2005-09-22 13:19]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 15:57]
"DeltTray"="DeltTray.exe" [2003-12-10 02:53 C:\WINDOWS\system32\delttray.exe]
"eTrust PestPatrol Active Protection"="none" []
"AntivirusRegistration"="C:\Program Files\CA\Etrust Antivirus\Register.exe" [2005-08-22 22:05]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 17:29]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 11:05]
"McRegWiz"="C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe" [2003-09-02 17:41]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-10-10 20:49]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
"QuickClean Imonitor"="C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe" [2003-09-04 03:00]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 17:34]

C:\Documents and Settings\Rockmore\Menu Start\Programma's\Opstarten\
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-10-31 23:53:43]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 16:23:32]

R2 CTDevice_Srv;CT Device Query service;C:\Program Files\Creative\Shared Files\CTDevSrv.exe
R2 PackethSvc;Virtual NIC Service;C:\WINDOWS\system32\PackethSvc.exe
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
R3 CMISTOR;CMIUCR.SYS CM220 Card Reader Driver;C:\WINDOWS\system32\DRIVERS\cmiucr.SYS
S3 SamsonLLDriver;Samson LL Driver;C:\WINDOWS\system32\Drivers\SamsonLLDriver.sys
S3 SWWDM_multi;Samson Audio (WDM);C:\WINDOWS\system32\drivers\SWAudWDM.sys
S3 SynasUSB;SynasUSB;C:\WINDOWS\system32\drivers\SynasUSB.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\Shell\AutoRun\command - N:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6afa8c76-ad58-11db-9a48-0012bf642e54}]
\Shell\AutoRun\command


.
Inhoud van de 'Gedeelde Taken' map
"2007-11-10 19:40:32 C:\WINDOWS\Tasks\SDMsgUpdate (TE).job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-10 20:40:24
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2007-11-10 20:41:40 - machine was rebooted
.
--- E O F ---

Hoi,

* Start Hijackthis en vink volgende items aan indien nog aanwezig:

O2 - BHO: (no name) - {2D628D87-D0A3-6203-4E86-09D91C6DD614} - C:\Program Files\Ztfmogur\xaasbotl.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {B02199BD-9BED-4943-A939-ADC51602ADDD} - C:\WINDOWS\system32\mllmn.dll (file missing)
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/er...erInstallNL.cab

* Sluit alle open vensters.(belangrijk!!)
Klik daarna op Fix checked onderaan en sluit HijackThis


Blader naar en verwijder volgende bestanden:

C:\WINDOWS\system32\hhceduoc.exe
C:\WINDOWS\system32\qeqmpgnu.dll

* Ga naar start > uitvoeren en kopieer en plak volgende command in het veld:

ComboFix /u

Zorg ervoor dat er dus een spatie is tussen Combofix en /
Daarna klik enter.

Dit zal Combofix verwijderen+gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en reset je Systeemherstel opnieuw.


Trouwens, ik zie dat je een heleboel registry cleaners hebt geinstalleerd. Met welke reden gebruik je die?
Laat me ook weten daarna hoe alles terug werkt.

Hoi MikieMous,

Bedankt voor alle hulp moet ik nog een Hijack Log posten? OF weet je nu zeker dat ie schoon is? Over de register cleaners.. Ja ik heb gewoon een aantal progjes gedownload waarvan men mij vertelde dat dat goed werkte. Ik probeer me op die manier als noob zo goed mogelijk te beschermen tegen die vervelende virussen, malware en spyware..

Een nieuwe log is niet nodig, want ik weet dat, nadat je die items hebt gefixt in HijackThis, dat ze weg zullen zijn.

Ehm, zoals je zelf al aangeeft vind je van jezelf dat je een noob bent, dus raad ik in jouw geval Register Cleaners ten sterkste af.
Een RegisterCleaner gaat helemaal geen spyware of Virussen verwijderen, dus weet niet wie jou dat heeft wijsgemaakt. Een registercleaner gaat vooral sleutels uit het register verwijderen die het als "overbodig" aanziet. En in principe is dit helemaal niet nodig en zelfs gevaarlijk. Want er zijn veel registercleaners die dingen gaan verwijderen in het register die helemaal niet mogen verwijderd worden - met alle gevolgen vandien, want een corrupt register is een corrupte Windows.
Het is niet de eerste keer dat men hun Windows opnieuw hebben moeten installeren omdat een Registercleaner dingen had verwijderd die niet mocht verwijderd worden.
Het is ook een fabel dat Registry Cleaners de computer sneller maken.
Daarom raad ik Registercleaners ten sterkste af - Gebruik die enkel maar indien je een goede basiskennis hebt van het register en echt weet of een bepaalde sleutel al dan niet mag verwijderd worden. Dus in jouw geval veronderstel ik dat je geen kennis hebt van het register, dus raad ik ook aan om die registercleaners te verwijderen.
Dus, deinstalleer de volgende:

RegistryFix
Zero G Registry

Alsook, ik zie dat je NoAdware hebt geinstalleerd. Ik raad je ook aan om die te deinstalleren, want die heeft een dubieuze reputatie.

Verder, zie ik nog de volgende bestanden aanwezig die ik eerder over het hoofd heb gezien, dus verwijder de volgende bestanden:

C:\Documents and Settings\Rockmore\install.exe
C:\Documents and Settings\Rockmore\readme.bat

Deze zijn de oorzaak en de installers van je problemen. Ga er niet op gaan dubbelklikken, anders wordt alle troep terug geinstalleerd.
Blijkbaar heb je die bestanden eerder zelf gedownload in de veronderstelling dat het een crack was. Zo zie je dat het bezoeken van cracksites en het gebruiken van cracks altijd een risico is.

Alsook, ken je deze map?

C:\Program Files\AdultPDF

Heb je die geinstalleerd? Indien niet, verwijder die map.

Laat me daarna weten hoe alles terug werkt.

Hoi MickieMous,

Ik ga het ff proberen, die registry cleaners heb ik ooit voor een ander probleem nodig gehad geloof ik. Maar dat heb ik nu niet meer dus het kan eraf. Zero G kan ik overigens niet vinden! De rest heb ik gedaan Zeer zeer veel dank voor je hulp in ieder geval!

Groeten Mike

Graag gedaan.

Lees alvast mijn Preventie pagina met info en tips hoe dit in de toekomst te voorkomen.
En lees deze pagina om je computer terug te optimaliseren na het verwijderen van malware.

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact the staff member who was helping you with your issue.

Everyone else please begin a New Topic.

Thank you !