Virtumonde

spobster · May 15, 2008

Hi there,

hope you can help! I get pop-ups every few minutes, but only when I am using IE. My WinPatrol also reports

(every minute) new IE add-Ons, but I did NOT approve them. Examples of these files are:

C:\WINDOWS\system32\ddcApqnM.dll

C:\WINDOWS\system32\pmnoOGYP.dll

My NOD32 virusscanner sometimes reports threats:

Win32/PrivacySet.A trojan

a variant of Win32/Adware.WinFixer application

Win32/PrcView application

Win32/Adware.AVSystemCare application

Win32/Adware.Virtumonde application

I always reacted with eather Delete or Connection Terminated.

So I came to Malwarebytes and ran Spybot, it found two important threats, but could only delete one

(Virtumonde.dll). Than I ran the Malwarebytes'Anti-Malware Tool, which found a number of infected files.

Meanwhile I ran the PandaScan. So I believe there are a number of double threats found. The scan took a while,

that's why I did not repeat this scan. The logs of both scans down here. Than the restart of the computer, at

startup Spybot ran again and could delete the Virtumonde.dll after all.

Malwarebytes' Anti-Malware 1.12

Database version: 752

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 94395

Time elapsed: 1 hour(s), 17 minute(s), 51 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 10

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 4

Files Infected: 19

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\pmnoOGYP.dll (Trojan.Vundo) -> Unloaded module successfully.

Registry Keys Infected:

HKEY_CLASSES_ROOT\Typelib\{abcdece2-4b15-11d1-abed-709549c10000} (Trojan.FakeAlert) -> Quarantined and deleted

successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{f9df827a-8fa7-48a3-b268-ca4db563ea40} (Trojan.Vundo) -> Quarantined and deleted

successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper

Objects\{f9df827a-8fa7-48a3-b268-ca4db563ea40} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnoogyp (Trojan.Vundo) ->

Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{f9df827a-8fa7-48a3-b268

-ca4db563ea40} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Program Files\AntiSpywareMaster (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\system32 (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\system32\drivers (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\system32\drivers\etc (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:

C:\WINDOWS\system32\ddcApqnM.dll_old (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\MnqpAcdd.ini (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\MnqpAcdd.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\huggpmkt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\tkmpgguh.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ipovawem.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mewavopi.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rmmjgfsf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\fsfgjmmr.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ulbqcpuf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\fupcqblu.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Program Files\AntiSpywareMaster\asm.exe (Rogue.AntiSpyMaster) -> Quarantined and deleted successfully.

E:\Robberts documenten\mijn ontvangen bestanden\klaar\ACDSee.Pro.v8.1.99.Incl.Keymaker-CORE\CORE10k.EXE

(Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\system32\drivers\etc\hosts_Win_Original (Trojan.Agent) -> Quarantined and deleted

successfully.

C:\WINDOWS\17PHolmes572.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\jkkLDVno.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pmnoOGYP.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\iifeEWoP.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Spobstertje\Local Settings\Temp\snapsnet.exe (Trojan.Agent) -> Quarantined and deleted

successfully.

;*******************************************************************************

********************************

********************************************************************

ANALYSIS: 2008-05-15 22:33:57

PROTECTIONS: 1

MALWARE: 15

SUSPECTS: 0

;*******************************************************************************

********************************

********************************************************************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================

====================================================================

ESET NOD32 antivirus system 2.70 2.70 Yes Yes

;===============================================================================

================================

====================================================================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected

Location

;===============================================================================

================================

====================================================================

00055471 Application/ServUBased.A HackTools No 0 No No

E:\Robberts documenten\Backup\Bureaublad.rar[serv-U\ServUDaemon.exe]

00139535 Application/Processor HackTools No 0 No No

C:\Documents and Settings\Spobstertje\Bureaublad\Programma's en shortcuts\myphotobook-Setup.exe[process.exe]

00139535 Application/Processor HackTools No 0 Yes No

C:\Program Files\myphotobook\xtras\process.exe

00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No

C:\Documents and Settings\Spobstertje\Cookies\spobstertje@server.iad.liveperson[2].txt

00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No

C:\Documents and Settings\Spobstertje\Cookies\spobstertje@statse.webtrendslive[2].txt

00293079 Spyware/7r7t Spyware No 1 Yes No

C:\Documents and Settings\Spobstertje\Local Settings\Temp\snapsnet.exe

00505582 Application/ServUBased.DU HackTools No 0 No No

E:\Robberts documenten\Backup\Bureaublad.rar[serv-U\ServUTray.exe]

01262593 Application/NirCmd.A HackTools No 0 Yes No

C:\WINDOWS\NirCmd.exe

02911014 Adware/AntiSpywareMaster Adware No 0 Yes No

C:\Program Files\AntiSpywareMaster\asm.exe

02947657 Trj/Agent.ITR Virus/Trojan No 0 Yes No

C:\System Volume Information\_restore{AC700A1F-ECB2-4C28-8D90-649C14F971F6}\RP385\A0030164.exe

02947657 Trj/Agent.ITR Virus/Trojan No 0 Yes No

C:\System Volume Information\_restore{AC700A1F-ECB2-4C28-8D90-649C14F971F6}\RP385\A0030162.exe

02947657 Trj/Agent.ITR Virus/Trojan No 0 Yes No

C:\System Volume Information\_restore{AC700A1F-ECB2-4C28-8D90-649C14F971F6}\RP385\A0030163.exe

02951531 Bck/Prorat.HT Virus/Trojan No 1 Yes No

E:\Robberts documenten\mijn ontvangen bestanden\klaar\314 Palm Games\__All PalmOS Games Released by AstraWare in

(2003) Crack\crack.exe

02951531 Bck/Prorat.HT Virus/Trojan No 1 Yes No

E:\Robberts documenten\mijn ontvangen bestanden\klaar\314 Palm Games\__All PalmOS Games Released by AstraWare in

(2003) Crack.zip[crack.exe]

02951532 Bck/Prorat.HT Virus/Trojan No 1 Yes No

E:\Robberts documenten\mijn ontvangen bestanden\klaar\314 Palm Games\__All PalmOS Games Released by AstraWare in

(2003) Crack.zip[setup.exe]

02951532 Bck/Prorat.HT Virus/Trojan No 1 Yes No

E:\Robberts documenten\mijn ontvangen bestanden\klaar\314 Palm Games\__All PalmOS Games Released by AstraWare in

(2003) Crack\setup.exe

02971602 Spyware/Virtumonde Spyware No 1 Yes No

C:\WINDOWS\system32\iifeEWoP.dll

02971602 Spyware/Virtumonde Spyware No 1 Yes No

C:\WINDOWS\system32\jkkLDVno.dll

02971602 Spyware/Virtumonde Spyware Yes 2 Yes No

C:\WINDOWS\SYSTEM32\PMNOOGYP.DLL

02972595 Spyware/Virtumonde Spyware No 1 Yes No

C:\WINDOWS\system32\pefxairs.dll

02972596 Spyware/Virtumonde Spyware No 1 Yes No

C:\WINDOWS\system32\wufclbhm.dll

02972601 Spyware/Virtumonde Spyware No 1 Yes No

C:\WINDOWS\system32\ulbqcpuf.dll

;===============================================================================

================================

====================================================================

SUSPECTS

Sent Location

;===============================================================================

================================

====================================================================

;===============================================================================

================================

====================================================================

VULNERABILITIES

Id Severity Description

;===============================================================================

================================

====================================================================

184380 MEDIUM MS08-002

184379 MEDIUM MS08-001

182048 HIGH MS07-069

182046 HIGH MS07-067

182043 HIGH MS07-064

179553 HIGH MS07-061

176382 HIGH MS07-057

176383 HIGH MS07-058

170911 HIGH MS07-050

170907 HIGH MS07-046

170906 HIGH MS07-045

170904 HIGH MS07-043

164915 HIGH MS07-035

164913 HIGH MS07-033

164911 HIGH MS07-031

160623 HIGH MS07-027

157262 HIGH MS07-022

157261 HIGH MS07-021

157260 HIGH MS07-020

157259 HIGH MS07-019

156477 HIGH MS07-017

150253 HIGH MS07-016

150249 HIGH MS07-013

150248 HIGH MS07-012

150247 HIGH MS07-011

150243 HIGH MS07-008

150242 HIGH MS07-007

150241 MEDIUM MS07-006

141034 HIGH MS06-076

141033 MEDIUM MS06-075

141030 HIGH MS06-072

137571 HIGH MS06-070

137568 HIGH MS06-067

133387 MEDIUM MS06-065

133386 MEDIUM MS06-064

133385 MEDIUM MS06-063

133379 HIGH MS06-057

131654 HIGH MS06-055

129977 MEDIUM MS06-053

129976 MEDIUM MS06-052

126093 HIGH MS06-051

126092 MEDIUM MS06-050

126087 HIGH MS06-046

126086 MEDIUM MS06-045

126083 HIGH MS06-042

126082 HIGH MS06-041

126081 HIGH MS06-040

123421 HIGH MS06-036

123420 HIGH MS06-035

120825 MEDIUM MS06-032

120823 MEDIUM MS06-030

120818 HIGH MS06-025

120815 HIGH MS06-022

120814 HIGH MS06-021

117384 MEDIUM MS06-018

114666 HIGH MS06-015

114664 HIGH MS06-013

108744 MEDIUM MS06-008

108743 MEDIUM MS06-007

108742 MEDIUM MS06-006

104567 HIGH MS06-002

104237 HIGH MS06-001

96574 HIGH MS05-053

93395 HIGH MS05-051

93394 HIGH MS05-050

93454 MEDIUM MS05-049

;===============================================================================

================================

====================================================================

Than I reran the Malwarebytes' Anti-Malware program. During this, WinPatrol alerted that regedit.exe %1 was

changed to regedit.exe%1%*, I said the change was NOT ok. Than WinPatrol alerted %1 /S to be exchanged by %1 %*

(.scr files), I also refused. The alerts reappear every now and than (what should I do?!). The final log of the

Malwarebytes' Anti-Malware program:

Malwarebytes' Anti-Malware 1.12

Database version: 752

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 94082

Time elapsed: 34 minute(s), 57 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Than HijackThis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:57:55, on 15-5-2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\ATKKBService.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = Download Directory

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/ig?hl=nl

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_02\bin\ssv.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe

O4 - HKLM\..\RunOnce: [spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

/autocheck

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xporteren naar Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) -

http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) -

http://as.photoprintit.de/ips-opdata/74914...PSUploader4.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware

2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Windows Alert Service (Winalert) - Unknown owner - C:\WINDOWS\System32\alertic.exe (file missing)

--

End of file - 5828 bytes

Thanks already for all the help!

AdvancedSetup · May 16, 2008

Hello spobster

Sorry for the delay. I was busy as heck at work and had spent an all nighter fixing some database issues. Some other the other helpers here are busy as well.

Let me take a look at your information and get back to you soon.

AdvancedSetup · May 16, 2008

First - disable the Spybot Search & Destroy Tea Timer if it's running as it will interfere with some fixes.

Either disable Winpatrol or allow it to make the changes we're going to make below.

Go into your Control Panel - Add/Remove and uninstall the following applications - you can get updates later on.

All Java versions, All Flash versions, All Shockwave versions, All QuickTime versions

Many of these programs have been recently updated to correct holes that have been found in the programs which help

facilitate Malware being installed onto your system. Updating to the most recent versions will help to eleviate this method of entry.

Software Updates

Here are links to get the latest versions of the software that you removed once we're all done scanning your system.

Don't reinstall them just yet.

Java Runtime Environment (JRE) 6 Update 6
Since you're using the FULL version of Adobe Acrobat 7 you may not want to update the reader depending on how you use Acrobat - at times having two different versions can cause conflicts
Adobe Acrobat Reader 8.12 Full Download English
Adobe Reader 8.12 Full Download Dutch
Adobe Flash Player version 9.0.124.0
uncheck the
Free Google Toolbar
Shockwave Player 11
QuickTime 7.4.5 for Windows XP or Vista
uncheck the sign ups

Instructions on how to disable the Spybot Search & Destroy Tea Timer

Disable Spybot Search & Destroys' TEA TIMER:

1. Run Spybot-S&D in Advanced Mode.

2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"

3. On the left hand side, Click on Tools

4. Then click on the Resident Icon in the List

5. Uncheck "Resident TeaTimer" and OK any prompts.

6. Restart your computer.

Please run the following tasks.

Follow these instructions carefully.

Download ATF-Cleaner from
Snapfiles.com
to remove un-needed temporary files from your computer that may contain malware.
You can also download it from
Majorgeeks.com
When you run ATF-Cleaner, check the items as shown below for Main.
For FireFox, be sure to click on the FireFox tab on top and check the items as shown below for FireFox
NOTE:
If you don't have FireFox or Opera installed then they will be grayed out and can be ignored
Then click on "Empty Selected".

.

Start HiJackThis and do a Scan Only and place a check mark in the following items

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

Then click on
Fix selected

The following items are up to you if you want to remove or not

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
It provides extra functionality for Logitech multimedia webcam devices. It is non-essential to the running of the system, but should not be terminated unless suspected to be causing problems.
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
Realtek HD Audio Sound Effect Manager
CTFMON.EXE - see the information here to determine if you want to leave it or remove it
Frequently asked questions about Ctfmon.exe

This next item is a service that needs to be removed. Let's try it this way first.

Click on

Start - Run

and type in

CMD

then press the Enter key to start a DOS prompt.

Then type in the following exactly as it is. Report back any errors if it's not successful.

sc delete alertic.exe

If it says it can not find it then try this

sc delete "Windows Alert Service"

Don't forget the quotes.

Then try this

sc delete wscntfy.exe

Then try this

sc delete nvsvc32.exe

If this gives an error as well then try to remove it from the list in a HJT scan only.

O23 - Service: Windows Alert Service (Winalert) - Unknown owner - C:\WINDOWS\System32\alertic.exe (file missing)

Then click on "Fix selected"

Finding and using the correct Service name to remove can be difficult at times

Update and Scan with Malwarebytes

Launch MB and go to the Update Tab and update the definitions
Click on the
Quick Scan
and click Next.
If any items are found allow it to clean them and then Reboot your computer.

Run HiJackThis again and do a Scan and save log and post back that log and the Malwarebytes log.

.

AdvancedSetup · May 16, 2008

It looks like we might need to get more details. Please run the following.

Download

Deckard's System Scanner (DSS)

to your

Desktop

.

Note: You must be logged onto an account with administrator privileges.

Close
all applications and windows.
Double-click
on
dss.exe
to run it, and follow the prompts.
When the scan is complete, two text files will open -
main.txt

<- this one will be maximized
and
extra.txt
<-this one will be minimized
Copy
(Ctrl+A then Ctrl+C)
and paste
(Ctrl+V)
the contents of
main.txt
and the extra.txt to your post. in your reply

spobster · May 16, 2008

I also have to work, just came back home and are now busy doing your advices. I'll be back with logs in a sec.

AdvancedSetup · May 16, 2008

Okay - just an FYI the Deckard's System Scanner (DSS) will run the HJT for you.

spobster · May 16, 2008

I have removed all software/applications you mentioned.

I have fixed all HiJackThis points mentioned. I also removed the microsoft office xp from my computer as I have also microsoft office 2003 running, which I always use. The link you gave for ctfmon.exe is only for office xp, so I guess what I did should be good enough.

Than I tried to use the quotes in the command screen. For all codes I received the following:

[sC] OpenService FAILED 1060:

De opgegeven service is geen ge

spobster · May 16, 2008

And I have to say two more things. Since I ran MB for the first time, most problems seemed to be solved. At this moment the popups from WinPatrol are only about the "regedit.exe %1 change to regedit.exe%1%*" and "%1 /S to be exchanged by %1 %*".

The other thing is that I have had JeanInMontana's help earlier: this link. At the end of page one we also worried about the "O23 - Service: Windows Alert Service (Winalert) - Unknown owner - C:\WINDOWS\System32\alertic.exe (file missing)", I believe we did everything we could to solve this, but nothing worked, even not the killbox program. actually the file alertic.exe does not exist on my computer (I guess that's why the file is missing).

Hope this helps, and I don't know for sure, but I think I got an infection with another worm/spyware than that time, although, some things look similar. I am really careful for clicking around on the internet and normally use only trusted sites, except for last week when I was in a hurry. Sorry about that! (for myself too B))

AdvancedSetup · May 16, 2008

Okay first let's try to see if these files still exist on your system and try to upload them so we can review them to see what they really are.

Upload Malware

C:\WINDOWS\system32\kadtmtmc.dll

C:\WINDOWS\system32\qjqiaocm.dll

C:\WINDOWS\system32\rywixfqp.dll

C:\WINDOWS\system32\qiddjpkj.dll

C:\WINDOWS\system32\pefxairs.dll

C:\WINDOWS\system32\wufclbhm.dll

C:\WINDOWS\system32\druxasmv.dll

C:\WINDOWS\system32\najfgbcp.dll

C:\WINDOWS\system32\ddcApqnM

Then we need to fix a couple other items.

Follow these instructions carefully as it can prevent your system from starting if done wrong.

You need to run a couple of Registry updates. Copy the following entries into Notepad - then save the file

and on the drop down selection for

Save as type:

choose

All Files

and save the file to your desktop

as

Repair01.reg

REGEDIT4


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

There should be no space before REGEDIT4 and there should be a single blank line after the last line.

Once saved double-click it and allow it to run and if any program attempts to stop it say it's okay to update it.

Then same thing for this one - copy and save as

Repair02.reg

REGEDIT4


[HKEY_CLASSES_ROOT\regedit\shell\open\command]

@="regedit.exe %1"

Once saved double-click it and allow it to run and if any program attempts to stop it say it's okay to update it.

Then click on START - RUN and type in

REGEDIT

and press the Enter Key.

Then clicking on the + signs to expand the folders in the Registry and walk down the tree until you get to

an entry that should be something like this.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Alert Service

If you find it and it has the

alertic.exe

entry then delete the alertic.exe entry.

If you don't find it there then go to the top of the Registry tree and do a search for

alertic.exe

and remove all the entries for it.

Not the PATH AND TREES - ONLY THE alertic.exe

Then restart your computer. Hopefully you can upload those files above and we'll check them out and if needed update Malwarebytes to remove them if they're bad items.

.

spobster · May 17, 2008

I'm sorry, don't know whether upload worked fine, so I was doing it a second time (same file) and now already a third time because of an error (third time, I do not upload them as a zip, but seperately and indeed that works). The only file I couldn't find was the one that was C:\WINDOWS\system32\ddcApqnM. The najfgbcp.dll and druxasmv.dll files are created at the time-point where the problems started. The others are created later on apparantly.

I updated the registry.

The search in the registry for alertic.exe gave me one entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winalert and I deleted that one, there are some entries left in this path, I did not touch them. Furthermore I got an entry in HKEY_USERS\S-1-5-21-329068152-1383384898-682003330-1003\Software\Microsoft\Search Assistant\ACMru\5603 but not the .exe file, only alertic, but I believe this is not harmful, because of my search in my windows-folders yesterday, is it? I can of course delete it, I didn't delete it yet.

Thanks for all your help!

AdvancedSetup · May 17, 2008

Great - thanks for the submissions. They should get checked out tonight some time.

Tomorrow please update your MB application and do a new Quick Scan and clean anything it finds.

Then reboot and run a new HJT scan and post back both of those logs.

spobster · May 18, 2008

Malwarebytes' Anti-Malware 1.12

Database version: 760

Scan type: Quick Scan

Objects scanned: 36445

Time elapsed: 3 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{1dc21177-f099-4369-ba8e-eda8c1573723} (Trojan.Vundo) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{c97007e2-bc21-4d9d-9bf8-b37d08b3d6e7} (Trojan.Vundo) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{85013b75-2320-4ec9-ab3d-141ea3dd1bac} (Trojan.Vundo) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{b7b6375a-4828-408b-a86a-bf75e2ca9394} (Trojan.Vundo) -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winalert (Trojan.FakeAlert) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\druxasmv.dll (Trojan.Vundo) -> No action taken.

C:\WINDOWS\system32\kadtmtmc.dll (Trojan.Vundo) -> No action taken.

C:\WINDOWS\system32\najfgbcp.dll (Trojan.Vundo) -> No action taken.

C:\WINDOWS\system32\pefxairs.dll (Trojan.Vundo) -> No action taken.

C:\WINDOWS\system32\qiddjpkj.dll (Trojan.Vundo) -> No action taken.

C:\WINDOWS\system32\qjqiaocm.dll (Trojan.Vundo) -> No action taken.

C:\WINDOWS\system32\rywixfqp.dll (Trojan.Vundo) -> No action taken.

C:\WINDOWS\system32\wufclbhm.dll (Trojan.Vundo) -> No action taken.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:42:15, on 18-5-2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\ATKKBService.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = Download Directory

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/ig?hl=nl

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/74914...PSUploader4.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 5080 bytes

AdvancedSetup · May 18, 2008

Well the log you posted shows you did not allow or have Malwarebytes remove the infected items.

You need to scan and then choose to fix the infected items.

spobster · May 18, 2008

sorry, posted wrong log in my hurry this morning.

Malwarebytes' Anti-Malware 1.12

Database version: 760

Scan type: Quick Scan

Objects scanned: 36445

Time elapsed: 3 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{1dc21177-f099-4369-ba8e-eda8c1573723} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{c97007e2-bc21-4d9d-9bf8-b37d08b3d6e7} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{85013b75-2320-4ec9-ab3d-141ea3dd1bac} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{b7b6375a-4828-408b-a86a-bf75e2ca9394} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winalert (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\druxasmv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kadtmtmc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\najfgbcp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pefxairs.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qiddjpkj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qjqiaocm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rywixfqp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wufclbhm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

spobster · May 18, 2008

I think most problems are solved, but still I get the WinPatrol Alerts, to which I have answered no till now. I have attached a picture of the alerts, wondering what I should do with this.

Thanks!

AdvancedSetup · May 19, 2008

No, do not allow the change. They are already using a default setting.

Once you tell it no and reboot your computer does it still alert to the change?

spobster · May 19, 2008

yes it does, every ten minutes or so I get the alert. also after rebooting the computer.

AdvancedSetup · May 19, 2008

If you click on INFO does it say what application is attempting to make this change?

spobster · May 19, 2008

I believe it is regedit.exe, when I click on INFO, I get a page with a lot of advertising to buy the WinPatrol Plus Version. In between it says "Upgrade to WinPatrol PLUS for more info on regedit.exe"

AdvancedSetup · May 19, 2008

It isn't telling what program is trying to make the change it's only telling you that if you bought the program it would tell you more about Regedit which is not what we're looking for.

Let's do this for now. Disable or uninstall WinPatrol - then let's look at the registry entries after a reboot.

Then I'd like you to run a log from Deckard's System Scanner that will give us more information about what is running on your system.

You should already have the DSS.EXE program for Deckard's System Scanner but if not here is the information again below.

Download

Deckard's System Scanner (DSS)

to your

Desktop

.

Note: You must be logged onto an account with administrator privileges.

Close
all applications and windows.
Double-click
on
dss.exe
to run it, and follow the prompts.
When the scan is complete, two text files will open -
main.txt

<- this one will be maximized
and
extra.txt
<-this one will be minimized
Copy
(Ctrl+A then Ctrl+C)
and paste
(Ctrl+V)
the contents of
main.txt
and the extra.txt to your post in your reply

What DSS will do:

create a new System Restore point in Windows XP and Vista.
clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

Notes:

The first time that the Deckard scanner is run, the extra.txt is generated in a minimized window. The second time you will not obtain the extra.txt. You must go to

Start

=>

Run

and copy the following

"%userprofile%\desktop\dss.exe" /config

in the line and click OK You will receive a pop-up box with options to check for the Main log and Extra Log and Options.

.

spobster · May 19, 2008

I have checked all options in the config. (my windows is dutch so I had to run "%userprofile%\bureaublad\dss.exe" /config B))

Deckard's System Scanner v20071014.68

Run by Spobstertje on 2008-05-19 22:05:10

Computer is in Normal Mode.

--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --

11: 2008-05-19 20:05:14 UTC - RP391 - Deckard's System Scanner Restore Point

10: 2008-05-18 19:38:09 UTC - RP390 - Controlepunt van systeem

9: 2008-05-16 19:52:37 UTC - RP389 - Deckard's System Scanner Restore Point

8: 2008-05-16 19:21:08 UTC - RP388 - Verwijderd: Microsoft Office XP Professional

7: 2008-05-16 17:18:23 UTC - RP387 - Verwijderd: QuickTime

-- First Restore Point --

1: 2008-05-09 13:39:58 UTC - RP381 - Controlepunt van systeem

Performed disk cleanup.

System Drive C: has 1.56 GiB (less than 15%) free.

-- HijackThis (run as Spobstertje.exe) -----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:05:18, on 19-5-2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\ATKKBService.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\Documents and Settings\Spobstertje\bureaublad\dss.exe

C:\PROGRA~1\TRENDM~1\HIJACK~1\SPOBST~1.EXE