Infected with avirus/spyware and my system restarts every minute

Hi there my laptop is infected with a virus and when I start the laptop it gives me a message about something that doesn't starts propaply then my laptop restarts again. I work now in safe mode here is the hijackthislog thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:38:07, on 22-12-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WISPTIS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\nl.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HerculesCamService] C:\Program Files\Hercules\Hercules DualPix HD Webcam\CamService.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iSecurity applet] rundll32.exe iSecurity.cpl,SecurityMonitor
O4 - HKLM\..\Run: [XP SecurityCenter] "C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe" /hide
O4 - HKLM\..\Run: [ypops] C:\Program Files\Mypops\ypops.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BM234c9a67] Rundll32.exe "C:\WINDOWS\system32\synuufvf.dll",s
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Amir\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: SANTIS USB and PC Card Utility.lnk = C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe
O4 - Global Startup: vtjl.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\nl.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://realamir3.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - AppInit_DLLs: iSecurity.cpl
O21 - SSODL: iSecurity - {A8311E8F-E459-4D22-89B4-CB9DCF10A425} - iSecurity.cpl (file missing)
O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 7050 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\nl.htm
  O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
  O4 - HKLM\..\Run: [iSecurity applet] rundll32.exe iSecurity.cpl,SecurityMonitor
  O4 - HKLM\..\Run: [XP SecurityCenter] "C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe" /hide
  O4 - HKLM\..\Run: [BM234c9a67] Rundll32.exe "C:\WINDOWS\system32\synuufvf.dll",s
  O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
  O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
  O4 - Global Startup: vtjl.exe
  O20 - AppInit_DLLs: iSecurity.cpl
  O21 - SSODL: iSecurity - {A8311E8F-E459-4D22-89B4-CB9DCF10A425} - iSecurity.cpl (file missing)
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

I think you may have the tdss rootkit.
I want to run a test for it, while taking out some of the garbage as well.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\system32\drivers\Icon.exe
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\synuufvf.dll
C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe
c:\WINDOWS\system32\iSecurity.cpl

Folders to delete:
C:\Program Files\XPSecurityCenter

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

5. Please copy/paste the content of c:\avenger.txt into your reply.

I keep getting messages of antivirus 2009 Here's the avengerlog:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\drivers\Icon.exe" deleted successfully.

Error: file "C:\WINDOWS\system32\braviax.exe" not found!
Deletion of file "C:\WINDOWS\system32\braviax.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\synuufvf.dll" not found!
Deletion of file "C:\WINDOWS\system32\synuufvf.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open file "C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe"
Deletion of file "C:\Program Files\XPSecurityCenter\xpsecuritycenter.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist

File "c:\WINDOWS\system32\iSecurity.cpl" deleted successfully.

Error: folder "C:\Program Files\XPSecurityCenter" not found!
Deletion of folder "C:\Program Files\XPSecurityCenter" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

It's okay, keep ignoring the warning, we'll get rid of whatever is still present now.

• Download combofix from here, use the top links - combofix.exe
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 08-12-21.04 - Amir 2008-12-22 18:00:57.2 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.511.376 [GMT 1:00]
Gestart vanuit: c:\documents and settings\Amir\Bureaublad\ComboFix.exe
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\acowejnq.ini
c:\windows\system32\adefvsgj.dll
c:\windows\system32\almdpdwo.ini
c:\windows\system32\aomxapxj.ini
c:\windows\system32\aqiosrpl.ini
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\avwuhmvg.ini
c:\windows\system32\bcwqbdfk.ini
c:\windows\system32\bficxedc.ini
c:\windows\system32\biylvxio.dll
c:\windows\system32\bscbxrsj.ini
c:\windows\system32\cfhhk.ini
c:\windows\system32\cfhhk.ini2
c:\windows\system32\chnnpvco.ini
c:\windows\system32\chtcbnkm.ini
c:\windows\system32\ckqudsra.ini
c:\windows\system32\cmjeryrk.ini
c:\windows\system32\cnpgmnav.ini
c:\windows\system32\cvqobgkw.ini
c:\windows\system32\cwwxjabi.ini
c:\windows\system32\dcfawokn.ini
c:\windows\system32\dgqbxlse.ini
c:\windows\system32\dlvhqtkb.ini
c:\windows\system32\dnaasigt.ini
c:\windows\system32\dnyhfokt.ini
c:\windows\system32\dusodyhe.ini
c:\windows\system32\ebpvsuid.ini
c:\windows\system32\edkedatf.ini
c:\windows\system32\edsqyhyy.ini
c:\windows\system32\eejusshd.ini
c:\windows\system32\ehoadaaq.ini
c:\windows\system32\ehucscgr.ini
c:\windows\system32\epyhymwf.ini
c:\windows\system32\eqaiqwgo.ini
c:\windows\system32\etoqklya.ini
c:\windows\system32\evvraefq.ini
c:\windows\system32\fabratbv.ini
c:\windows\system32\frmeorxv.ini
c:\windows\system32\frslonfq.ini
c:\windows\system32\fukpepgp.ini
c:\windows\system32\fuqrktnm.ini
c:\windows\system32\gaadsgdl.ini
c:\windows\system32\gagiioju.ini
c:\windows\system32\ghmtmwnx.ini
c:\windows\system32\giaygnmc.ini
c:\windows\system32\gmkgteen.ini
c:\windows\system32\gqbhwgkn.ini
c:\windows\system32\haehwfyl.ini
c:\windows\system32\hcmkctpj.ini
c:\windows\system32\hdheeldl.ini
c:\windows\system32\hfrgxqnr.ini
c:\windows\system32\hggeecd.dll
c:\windows\system32\hhkcahqi.ini
c:\windows\system32\hkwsailb.ini
c:\windows\system32\hpqmaula.ini
c:\windows\system32\hqgtavko.ini
c:\windows\system32\hsgvggoc.ini
c:\windows\system32\ifdyukpw.ini
c:\windows\system32\ikmgadmv.ini
c:\windows\system32\ipkvnhmm.ini
c:\windows\system32\ipltqnel.ini
c:\windows\system32\ishcvfoa.ini
c:\windows\system32\ivkjljro.ini
c:\windows\system32\ivmyftrn.ini
c:\windows\system32\ixtnmerp.ini
c:\windows\system32\jcyracul.ini
c:\windows\system32\jefjrgem.ini
c:\windows\system32\jfwkkkow.ini
c:\windows\system32\jgsvfeda.ini
c:\windows\system32\jkbhxqei.ini
c:\windows\system32\jqhngycd.ini
c:\windows\system32\jstgglci.ini
c:\windows\system32\juarewnp.ini
c:\windows\system32\juhyaduy.ini
c:\windows\system32\kcvdikpu.ini
c:\windows\system32\kddgqjeo.ini
c:\windows\system32\khhfc.dll
c:\windows\system32\kkbhvwdo.ini
c:\windows\system32\kwelciyf.ini
c:\windows\system32\kwkyvocd.ini
c:\windows\system32\kxtjdurr.ini
c:\windows\system32\kyjaupyx.ini
c:\windows\system32\lbylasfo.ini
c:\windows\system32\lfbhobcy.ini
c:\windows\system32\lgvexmog.ini
c:\windows\system32\ljkdnbpu.ini
c:\windows\system32\mbdpbnqp.ini
c:\windows\system32\mgfcbfkv.ini
c:\windows\system32\mkfrjwir.ini
c:\windows\system32\mtjeqaaa.ini
c:\windows\system32\mvdteygy.ini
c:\windows\system32\ncobnfrb.ini
c:\windows\system32\neufhqlp.ini
c:\windows\system32\nimwpuua.ini
c:\windows\system32\nriyoojr.ini
c:\windows\system32\nvqtfvqr.ini
c:\windows\system32\nwigjbmt.ini
c:\windows\system32\nwqrkrcp.ini
c:\windows\system32\odackdrd.ini
c:\windows\system32\ofyijyoj.ini
c:\windows\system32\ohvdewfh.ini
c:\windows\system32\ojwcisll.ini
c:\windows\system32\pjmgnxhn.ini
c:\windows\system32\pnuahnei.ini
c:\windows\system32\ppbaitew.ini
c:\windows\system32\ptcbrcyp.ini
c:\windows\system32\qcnfvbhl.ini
c:\windows\system32\qdqssvgu.ini
c:\windows\system32\qkbhajon.ini
c:\windows\system32\qmidngkf.ini
c:\windows\system32\qvsygvqg.ini
c:\windows\system32\qxedbggs.ini
c:\windows\system32\rdrwfx.dll
c:\windows\system32\rhqooiey.ini
c:\windows\system32\rmeoyuff.ini
c:\windows\system32\roxxxgin.ini
c:\windows\system32\ruqbhfco.ini
c:\windows\system32\rvajptqi.ini
c:\windows\system32\rvgqdxax.ini
c:\windows\system32\rwpcacba.ini
c:\windows\system32\rywvxlkm.ini
c:\windows\system32\scwmqmxy.ini
c:\windows\system32\snjogluf.ini
c:\windows\system32\soaatmug.ini
c:\windows\system32\soqoawim.ini
c:\windows\system32\tflttmou.ini
c:\windows\system32\tfushuyd.ini
c:\windows\system32\tifflmey.ini
c:\windows\system32\tiorloga.ini
c:\windows\system32\tjhvcunl.ini
c:\windows\system32\trdfyedf.ini
c:\windows\system32\tttwa.ini
c:\windows\system32\tttwa.ini2
c:\windows\system32\tvixabku.ini
c:\windows\system32\uagpjbav.ini
c:\windows\system32\udxqokts.ini
c:\windows\system32\ulajlpiy.ini
c:\windows\system32\uouegoes.ini
c:\windows\system32\urasqcpu.ini
c:\windows\system32\uwkcikqg.ini
c:\windows\system32\vabfvwtu.ini
c:\windows\system32\vbragbts.ini
c:\windows\system32\vfmjapfr.ini
c:\windows\system32\vguefoyx.ini
c:\windows\system32\viuoniwt.ini
c:\windows\system32\vjqmqbcw.ini
c:\windows\system32\wbavnspg.ini
c:\windows\system32\wdnvfmwe.ini
c:\windows\system32\wdufjkfw.ini
c:\windows\system32\whqvshad.ini
c:\windows\system32\wmmhrbmu.ini
c:\windows\system32\wpkuydfi.dll
c:\windows\system32\wqwsnjyt.ini
c:\windows\system32\wrkljoed.dll
c:\windows\system32\wstyqdaq.ini
c:\windows\system32\wxxbc.ini
c:\windows\system32\wxxbc.ini2
c:\windows\system32\xbcadsac.ini
c:\windows\system32\xbclktdi.ini
c:\windows\system32\xhueufvq.ini
c:\windows\system32\xiwawfqa.ini
c:\windows\system32\xjmtofxo.ini
c:\windows\system32\xlbcnwbc.ini
c:\windows\system32\xlequuqu.ini
c:\windows\system32\xnhyhkyq.ini
c:\windows\system32\xnugcmak.ini
c:\windows\system32\xvrmmcam.ini
c:\windows\system32\xvufaafe.ini
c:\windows\system32\yjayyvqs.ini
c:\windows\system32\yjruoqpi.ini
c:\windows\system32\ylucwnxa.ini
c:\windows\system32\ytisdpfk.ini
c:\windows\system32\yxhewugg.ini
c:\windows\system32\yywdrqmo.ini
c:\windows\system32\zijell.dll
.

---- Previous Run -------
.
C:\Advanced XP Defender.lnk
C:\Advanced XP Fixer.lnk
c:\docume~1\Amir\LOCALS~1\Temp\install_flash_player.exe
c:\docume~1\Amir\LOCALS~1\Temp\snapsnet.exe
c:\documents and settings\Amir\Bureaublad\Advanced XP Defender.lnk
c:\documents and settings\Amir\Bureaublad\Advanced XP Fixer.lnk
c:\documents and settings\Amir\Bureaublad\SystemDefender.lnk
c:\documents and settings\Amir\Local Settings\Tempmbroit.exe
C:\iSecurity
c:\program files\AntiSpywareMaster
c:\program files\iSecurity
c:\program files\iSecurity\axpdefender.bmp
c:\program files\iSecurity\axpdefender.ico
c:\program files\iSecurity\axpdefenderi.bmp
c:\program files\iSecurity\axpfixer.bmp
c:\program files\iSecurity\axpfixer.ico
c:\program files\iSecurity\axpfixeri.bmp
c:\program files\iSecurity\iSecurity.dat
c:\program files\iSecurity\iSecurity.html
c:\program files\iSecurity\systemdefender.bmp
c:\program files\iSecurity\systemdefender.ico
c:\program files\iSecurity\systemdefenderi.bmp
c:\program files\iSecurity\v12\iSecurity.cpl
C:\SystemDefender.lnk
c:\windows\17PHolmes572.exe
c:\windows\BM234c9a67.txt
c:\windows\BM234c9a67.xml
c:\windows\cookies.ini
c:\windows\pskt.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\nwourvqm.dll
c:\windows\system32\UpMedia
c:\windows\system32\winivstr.exe

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-11-22 to 2008-12-22 ))))))))))))))))))))))))))))))
.

2008-12-22 00:37 . 2008-12-22 00:37 d-------- c:\program files\Trend Micro
2008-12-22 00:11 . 2008-12-22 00:11 d-------- c:\program files\Classic Menu for Office
2008-12-22 00:11 . 2008-12-22 00:11 d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-12-22 00:09 . 2008-12-22 00:56 664 --a------ c:\windows\system32\d3d9caps.dat
2008-12-06 19:24 . 2008-12-06 19:24 d-------- c:\documents and settings\Amir\Application Data\Kazaa Lite

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 23:13 216 ----a-w c:\documents and settings\Amir\delself.bat
2008-12-21 23:11 --------- d-----w c:\documents and settings\Amir\Application Data\uTorrent
2008-12-11 19:00 --------- d-----w c:\program files\uTorrent
2008-12-06 18:35 --------- d-----w c:\documents and settings\Amir\Application Data\Apple Computer
2008-12-06 18:34 --------- d-----w c:\documents and settings\Amir\Application Data\LimeWire
2008-11-25 18:38 --------- d-----w c:\program files\Mypops
2008-11-19 16:36 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2008-11-13 22:00 --------- d-----w c:\program files\DivX
2008-11-07 21:08 --------- d-----w c:\program files\Apple Software Update
2008-11-06 21:54 --------- d-----w c:\program files\iTunes
2008-11-06 21:54 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-06 21:52 --------- d-----w c:\program files\iPod
2008-11-06 21:43 --------- d-----w c:\program files\QuickTime
2008-11-06 21:40 --------- d-----w c:\program files\Common Files\Apple
2008-11-06 21:14 --------- d-----w c:\program files\Safari
2008-11-06 21:08 --------- d-----w c:\program files\Bonjour
2008-11-01 12:41 --------- d-----w c:\program files\LimeWire
2008-02-13 20:08 9 ----a-w c:\documents and settings\Amir\Application Data\mdb.bin
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-02-07 3497984]
"Google Update"="c:\documents and settings\Amir\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-09-26 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-09-26 503808]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-22 335872]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-01-07 949376]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-02-03 185896]
"ypops"="c:\program files\Mypops\ypops.exe" [2008-11-25 92672]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
SANTIS USB and PC Card Utility.lnk - c:\program files\Siemens\SANTIS WLAN\WlanMonitor.exe [2003-04-02 491520]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Amir\\Application Data\\Thinstall\\Adobe Photoshop CS3\\4000005700003h\\mDNSResponder.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 Asapi;Asapi;c:\windows\system32\drivers\Asapi.sys [2004-09-15 11264]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-01-07 15424]
R2 MTC0005_MTCDIO;Wireless HotKey Driver;c:\windows\system32\drivers\MTCDIO.sys [2004-09-15 11316]
R3 EMCR;EMCR;c:\windows\system32\DRIVERS\EMCR7SK.sys [1979-12-31 68224]
S2 MTCDIO;MTCDIO;c:\windows\system32\DRIVERS\MTCDIO.sys [2004-09-15 11316]
S3 APL531;Hercules Dualpix HD Webcam;c:\windows\system32\Drivers\HDvid.sys []
S3 ATMEL FVNETusbASKEY (AR)(R);ATMEL FVNETusbASKEY (AR)(R) Service for SANTIS WLAN USB Adapter;c:\windows\system32\DRIVERS\vnetusbk.sys [2003-02-20 93184]
S3 ATMEL WinXP PCMCIAFVNETR (2ARC)(R);ATMEL WinXP PCMCIAFVNETR (2ARC)(R) Service for SANTIS WLAN PC Card;c:\windows\system32\DRIVERS\fvnetr51.sys [2003-01-14 91648]
S3 camfilt;camfilt;c:\windows\system32\Drivers\camfilt.sys []
.
Inhoud van de 'Gedeelde Taken' map

2008-11-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-12-19 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Amir\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 11:31]

2007-05-24 c:\windows\Tasks\Herinnering voor registratie 1.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-04 01:03]

2007-05-24 c:\windows\Tasks\Herinnering voor registratie 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-04 01:03]

2007-05-24 c:\windows\Tasks\Herinnering voor registratie 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-08-04 01:03]
.
- - - - ORPHANS VERWIJDERD - - - -

BHO-{25D5BD41-0268-4A92-A75D-B0053B0EF3A4} - c:\windows\system32\khhfc.dll
BHO-{25f241c6-d435-427e-9b7d-5102711629c7} - c:\windows\system32\zijell.dll
HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
HKCU-Run-Sonic RecordNow! - (no file)
HKLM-Run-HerculesCamService - c:\program files\Hercules\Hercules DualPix HD Webcam\CamService.exe
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe


.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\System32\imon.dll

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-22 18:12:53
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'lsass.exe'(576)
c:\windows\System32\imon.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\ESET\nod32krn.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Voltooingstijd: 2008-12-22 18:16:11 - machine werd herstart [Amir]
ComboFix-quarantined-files.txt 2008-12-22 17:16:08

Pre-Run: 5,289,918,464 bytes beschikbaar
Post-Run: 5,776,310,272 bytes beschikbaar

370

Hello.
Looks good, what problems remain?

everything looks good now thanks a lot for you're help

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

• Download the latest version of Java SE Runtime Environment (JRE) 6 Update 11.
  
• Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 11".
  
• Click the "Download" button to the right.
  
• In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  
• Click on the link to download Windows Offline Installation and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  - Examples of older versions in Add or Remove Programs:
  - Java 2 Runtime Environment, SE v1.4.2
  - J2SE Runtime Environment 5.0
  - J2SE Runtime Environment 5.0 Update 2
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u11-windows-i586-p.exe that you downloaded to install the newest version.
  

Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from here

• First, unzip it.
  
• Then run JavaRa.
  
• Select English from the drop down menu and press Select.
  
• This will open JavaRa.
  
• Press Remove older versions
  
• Press yes to the prompt.
  
• It will make a log file of what it's removed.
  
• Copy and paste the log back here.
  

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.