Rootkits op PC

Fm94 · 12 juli 2012

Hallo,

Mijn AVG Anti-Virus heeft tijdens een scan rootkits gevonden, maar heeft deze niet verwijderd, alleen verborgen. Ik heb toen een paar proberen te verwijderen via AVG, maar toen kwam bij die paar rootkits "object is niet toegankelijk" te staan in plaats van "object is verborgen". Hier zijn de scanresultaten:

[TABLE=class: outer_border, width: 500]

[TR]

[TD][TABLE=width: 850]

[TR]

[TD=colspan: 4]Scan "Anti-Rootkitscan" is voltooid.[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 2]Rootkits;"8";"3";"5"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 5]Scan is gestart:;"donderdag 12 juli 2012, 14:02:04"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 7]Scan voltooid:;"donderdag 12 juli 2012, 14:04:14 (2 min. 9 seconde (n))"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 4]Totaal gescande objecten:;"65254"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 3]Gebruiker:;"SYSTEM"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD][/TD]

[/TR]

[TR]

[TD]Rootkits[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 4];"Bestand";"Infectie";"Resultaat"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spob.sys";"atapi.sys, koppelpunt import HAL.dll READ_PORT_UCHAR -> spob.sys +0x2040";"Object is niet toegankelijk."[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 16];"C:\WINDOWS\system32\drivers\spob.sys";"atapi.sys, koppelpunt import HAL.dll READ_PORT_BUFFER_USHORT -> spob.sys +0x213C";"Object is verborgen"[/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spob.sys";"atapi.sys, koppelpunt import HAL.dll READ_PORT_USHORT -> spob.sys +0x20BE";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 16];"C:\WINDOWS\system32\drivers\spob.sys";"atapi.sys, koppelpunt import HAL.dll WRITE_PORT_BUFFER_USHORT -> spob.sys +0x27FC";"Object is verborgen"[/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spob.sys";"atapi.sys, koppelpunt import HAL.dll WRITE_PORT_UCHAR -> spob.sys +0x26D2";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spob.sys";"pci.sys, koppelpunt import ntoskrnl.exe IoDetachDevice -> spob.sys +0x32C4C";"Object is niet toegankelijk."

[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 16];"C:\WINDOWS\system32\drivers\spob.sys";"pci.sys, koppelpunt import ntoskrnl.exe IoAttachDeviceToDeviceStack -> spob.sys +0x32CA0";"Object is verborgen"[/TD]

[/TR]

[TR]

[TD=colspan: 16];"C:\WINDOWS\system32\drivers\spob.sys";"i8042prt.sys, koppelpunt import HAL.dll READ_PORT_UCHAR -> spob.sys +0x12048";"Object is niet toegankelijk."[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[/TABLE]

Hoe kan ik ze wel verwijderen, en is dat schadelijk voor de PC om het te verwijderen? En hebben de rootkits nu ook schade gebracht aan m'n computer?

Dit is mijn logfile:

[TABLE=class: outer_border, width: 850]

[TR]

[TD]Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:55:39, on 12-7-2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20900)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Desktop Tray Clock\DTClock.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\AVG Secure Search\vprot.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\oodag.exe

C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe

C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\UPHClean\uphclean.exe

C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\Program Files\AVG\AVG2012\avgemcx.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\AVG\AVG2012\avgrsx.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\AVG\AVG2012\avgui.exe

C:\Program Files\Microsoft Office\Office12\EXCEL.EXE

C:\Documents and Settings\Administrator\Mijn documenten\Downloads\HijackThis(1).exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Google

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Google

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [skinClock] C:\Program Files\Desktop Tray Clock\DTClock.exe

O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"

O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe

O4 - HKLM\..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skinClock] C:\Program Files\Desktop Tray Clock\DTClock.exe

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-19\..\Run: [skinClock] C:\Program Files\Desktop Tray Clock\DTClock.exe (User 'Lokale service')

O4 - HKUS\S-1-5-19\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-20\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

O4 - S-1-5-18 Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'SYSTEM')

O4 - S-1-5-18 Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Default user')

O4 - .DEFAULT Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')

O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll

O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll

O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll

O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll

O9 - Extra button: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - Advanced Search (file missing)

O9 - Extra 'Tools' menuitem: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - Advanced Search (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\Skype4COM.dll

O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe

O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: Start BT in service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe

O23 - Service: vToolbarUpdater11.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe

--

End of file - 12469 bytes

[/TD]

[/TR]

[/TABLE]

Alvast bedankt.

kape · 12 juli 2012

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O4 - HKUS\S-1-5-19\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

O9 - Extra button: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - Advanced Search (file missing)

O9 - Extra 'Tools' menuitem: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - Advanced Search (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\Program Files\Trend Micro\HiJackThis of C:\Program Files (x86)\Trend Micro\HiJackThis.

Download MBAM (Malwarebytes Anti-Malware)

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder).

Indien er de rootkit (TDSS) aanwezig is, zal MBAM vragen te herstarten. Doe dit dan ook.

MBAM zal na de herstart opnieuw scannen en de rootkit verwijderen.

Het log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in het programma.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

Fm94 · 12 juli 2012

Hier is het logje van MBAM:

alwarebytes Anti-Malware (-evaluatieversie-) 1.62.0.1300

Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Databaseversie: v2012.07.12.10

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 7.0.5730.13

Administrator :: UNATTEND-9D4712 [administrator]

Realtime bescherming: Ingeschakeld

12-7-2012 22:10:28

mbam-log-2012-07-12 (22-10-28).txt

Scantype: Snelle scan

Uitgeschakelde scanopties: P2P

Objecten gescand: 199619

Verstreken tijd: 20 minuut/minuten, 13 seconde(n)

Geheugenprocessen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden gedetecteerd: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Data: 1 -> Succesvol in quarantaine geplaatst en verwijderd.

Registerdata gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Mappen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Bestanden gedetecteerd: 5

C:\Documents and Settings\Administrator\Application Data\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Documents and Settings\Default User\Application Data\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\WINDOWS\system32\config\systemprofile\Application Data\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Documents and Settings\Administrator\Local Settings\Temp\26601609.Uninstall\Uninstall.exe (Adware.Agent) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files\Unlocker\eBay_shortcuts_1016.exe (Adware.Clicker) -> Succesvol in quarantaine geplaatst en verwijderd.

(einde)

En deze is van Hijackthis:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 23:04:23, on 12-7-2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20900)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\IVT

Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common

Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Malwarebytes'

Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\oodag.exe

C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe

C:\Program Files\IVT

Corporation\BlueSoleil\StartSkysolSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\UPHClean\uphclean.exe

C:\Program Files\Common Files\AVG Secure

Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe

C:\Program Files\Common

Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\Program Files\AVG\AVG2012\avgemcx.exe

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

C:\Program Files\AVG\AVG2012\avgrsx.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Desktop Tray Clock\DTClock.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Common

Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\AVG Secure Search\vprot.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Administrator\Mijn

documenten\Downloads\HijackThis(1).exe

R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL = Google

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start

Page = Google

R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start

Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,SearchAssistant = Google

O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF}

- C:\Program Files\IEPro\iepro.dll

O2 - BHO: AcroIEHelperStub -

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program

Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for

Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA}

- C:\Program

Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: AVG Do Not Track -

{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program

Files\AVG\AVG2012\avgdtiex.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter -

{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program

Files\AVG\AVG2012\avgssie.dll

O2 - BHO: SSVHelper Class -

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre6\bin\ssv.dll

O2 - BHO: Windows Live Aanmelden - Help -

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Common Files\Microsoft Shared\Windows

Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar -

{95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program

Files\AVG Secure Search\11.1.0.12\AVG Secure

Search_toolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper -

{DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program

Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl -

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program

Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AVG Security Toolbar -

{95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program

Files\AVG Secure Search\11.1.0.12\AVG Secure

Search_toolbar.dll

O4 - HKLM\..\Run: [igfxtray]

C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd]

C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers]

C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog

Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [skinClock] C:\Program Files\Desktop

Tray Clock\DTClock.exe

O4 - HKLM\..\Run: [RemoteControl8] "C:\Program

Files\CyberLink\PowerDVD8\PDVD8Serv.exe"

O4 - HKLM\..\Run: [Monitor]

C:\WINDOWS\PixArt\PAC207\Monitor.exe

O4 - HKLM\..\Run: [PAC207_Monitor]

C:\WINDOWS\PixArt\PAC207\Monitor.exe

O4 - HKLM\..\Run: [LogitechCommunicationsManager]

"C:\Program Files\Common

Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent]

rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program

Files\AVG\AVG2012\avgtray.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program

Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher]

"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common

Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure

Search\vprot.exe"

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program

Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKCU\..\Run: [CTFMON.EXE]

C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skinClock] C:\Program Files\Desktop

Tray Clock\DTClock.exe

O4 - HKCU\..\Run: [RocketDock] "C:\Program

Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows

Live\Messenger\msnmsgr.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE]

C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-19\..\Run: [skinClock] C:\Program

Files\Desktop Tray Clock\DTClock.exe (User 'Lokale

service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE]

C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE]

C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE]

C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-18 Startup: OneNote 2007 Schermopname en Snel

starten.lnk = C:\Program Files\Microsoft

Office\Office12\ONENOTEM.EXE (User 'SYSTEM')

O4 - S-1-5-18 Startup: RocketDock.lnk = C:\Program

Files\RocketDock\RocketDock.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: OneNote 2007 Schermopname en Snel

starten.lnk = C:\Program Files\Microsoft

Office\Office12\ONENOTEM.EXE (User 'Default user')

O4 - .DEFAULT Startup: RocketDock.lnk = C:\Program

Files\RocketDock\RocketDock.exe (User 'Default user')

O4 - Startup: OneNote 2007 Schermopname en Snel

starten.lnk = C:\Program Files\Microsoft

Office\Office12\ONENOTEM.EXE

O4 - Startup: RocketDock.lnk = C:\Program

Files\RocketDock\RocketDock.exe

O8 - Extra context menu item: E&xporteren naar Microsoft

Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: IE7Pro Grab and Drag -

{000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program

Files\IEPro\iepro.dll

O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag -

{000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program

Files\IEPro\iepro.dll

O9 - Extra button: IE7Pro Preferences -

{0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program

Files\IEPro\iepro.dll

O9 - Extra 'Tools' menuitem: IE7Pro Preferences -

{0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program

Files\IEPro\iepro.dll

O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre6\bin\jp2iexp.dll

O9 - Extra button: Verzenden naar OneNote -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: AVG Do Not Track -

{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program

Files\AVG\AVG2012\avgdtiex.dll

O9 - Extra button: (no name) -

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}

(Shockwave Flash Object) -

http://fpdownload2.macromedia.com/get/flashplayer/current/

swflash.cab

O18 - Protocol: linkscanner -

{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program

Files\AVG\AVG2012\avgpp.dll

O18 - Protocol: skype4com -

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

C:\WINDOWS\system32\Skype4COM.dll

O18 - Protocol: viprotocol -

{B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program

Files\Common Files\AVG Secure

Search\ViProtocolInstaller\11.2.0\ViProtocol.dll

O22 - SharedTaskScheduler: Preloader van browseui -

{438755C2-A8BA-11D1-B96B-00A0C90312E1} -

C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor

onderdeelcategorieën -

{8C7461EF-2B13-11d2-BE35-3078302C2030} -

C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe LM Service - Adobe Systems -

C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. -

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ,

s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner -

C:\Program Files\IVT

Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Firebird Server - MAGIX Instance

(FirebirdServerMAGIXInstance) - MAGIX® - C:\Program

Files\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: Java Quick Starter

(JavaQuickStarterService) - Sun Microsystems, Inc. -

C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program

Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc.

- C:\Program Files\Common

Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: MBAMService - Malwarebytes Corporation -

C:\Program Files\Malwarebytes'

Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service

(MozillaMaintenance) - Mozilla Foundation - C:\Program

Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: O&O Defrag - O&O Software GmbH -

C:\WINDOWS\system32\oodag.exe

O23 - Service: PD91Agent - Raxco Software, Inc. -

C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe

O23 - Service: PD91Engine - Raxco Software, Inc. -

C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC

Connectivity Solution\ServiceLayer.exe

O23 - Service: Start BT in service - Unknown owner -

C:\Program Files\IVT

Corporation\BlueSoleil\StartSkysolSvc.exe

O23 - Service: vToolbarUpdater11.2.0 - Unknown owner -

C:\Program Files\Common Files\AVG Secure

Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe

--

End of file - 11715 bytes

kape · 12 juli 2012

Laat AVG nu eens opnieuw scannen. Benieuwd wat die nog te vertellen heeft ?

Fm94 · 13 juli 2012

Ik krijg nu dit:

AVG Scan:

[TABLE=width: 1024]

[TR]

[TD=colspan: 4]Scan "Anti-Rootkitscan" is voltooid.[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 2]Rootkits;"8";"0";"8"

[/TD]

[TD][/TD]

[/TR]

[TR]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 5]Scan is gestart:;"vrijdag 13 juli 2012, 15:24:08"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 7]Scan voltooid:;"vrijdag 13 juli 2012, 15:26:11 (2 min. 2 seconde (n))"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 4]Totaal gescande objecten:;"59214"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 3]Gebruiker:;"SYSTEM"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD][/TD]

[/TR]

[TR]

[TD]Rootkits[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 4];"Bestand";"Infectie";"Resultaat"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 14];"C:\WINDOWS\system32\drivers\spjz.sys";"atapi.sys, koppelpunt import HAL.dll READ_PORT_UCHAR -> spjz.sys +0x2040";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spjz.sys";"atapi.sys, koppelpunt import HAL.dll READ_PORT_BUFFER_USHORT -> spjz.sys +0x213C";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spjz.sys";"atapi.sys, koppelpunt import HAL.dll READ_PORT_USHORT -> spjz.sys +0x20BE";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spjz.sys";"atapi.sys, koppelpunt import HAL.dll WRITE_PORT_BUFFER_USHORT -> spjz.sys +0x27FC";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spjz.sys";"atapi.sys, koppelpunt import HAL.dll WRITE_PORT_UCHAR -> spjz.sys +0x26D2";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 14];"C:\WINDOWS\system32\drivers\spjz.sys";"pci.sys, koppelpunt import ntoskrnl.exe IoDetachDevice -> spjz.sys +0x32C4C";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 16];"C:\WINDOWS\system32\drivers\spjz.sys";"pci.sys, koppelpunt import ntoskrnl.exe IoAttachDeviceToDeviceStack -> spjz.sys +0x32CA0";"Object is verborgen"[/TD]

[/TR]

[TR]

[TD=colspan: 15];"C:\WINDOWS\system32\drivers\spjz.sys";"i8042prt.sys, koppelpunt import HAL.dll READ_PORT_UCHAR -> spjz.sys +0x12048";"Object is verborgen"[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 15:28:55, on 13-7-2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.20900)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Desktop Tray Clock\DTClock.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\AVG Secure Search\vprot.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe