Antimalware doctor :(

Anna_T · 24 juli 2010

hey,

Uit het niets kreeg ik het programma Antimaleware doctor op mijn computer. Na een paar mislukte pogingen om het te verwijderen, heb ik mijn computer gescand met malwarebytes. Het heeft een paar infecties verwijderd, maar niet alles. Daarna heb ik nog een hijackthis uitgevoert. Hieronder de log.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:25:26, on 24/07/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe

C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Documents and Settings\HP_Administrator\Application Data\074AA3F8999CB01651C31DD200E67E32\setupupdate70700.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgemc.exe

C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

C:\WINDOWS\ehome\mcrdsvc.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5643

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [JustVoip] "C:\Program Files\JustVoip.com\JustVoip\JustVoip.exe" -nosplash -minimized

O4 - HKCU\..\Run: [LowRateVoip] "C:\Program Files\LowRateVoip\LowRateVoip.exe" -nosplash -minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [setupupdate70700.exe] C:\Documents and Settings\HP_Administrator\Application Data\074AA3F8999CB01651C31DD200E67E32\setupupdate70700.exe

O4 - HKCU\..\Run: [XA5RJ9EADJ] C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Ywd.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - Startup: KDWin Keyboard Driver.lnk = C:\KDWin\KDWIN.EXE

O4 - Startup: OpenOffice.org 3.0 .lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Google Zoeken - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Afdrukken - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint Afdrukvoorbeeld - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Toevoegen aan afdruklijst - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint Versneld afdrukken - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html

O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe

O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--

End of file - 11906 bytes

Wie kan mij helpen?

kape · 24 juli 2010

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5643

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O4 - HKCU\..\Run: [setupupdate70700.exe] C:\Documents and Settings\HP_Administrator\Application Data\074AA3F8999CB01651C31DD200E67E32\setupupdate70700.exe

O4 - HKCU\..\Run: [XA5RJ9EADJ] C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Ywd.exe

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Je Java software is verouderd.

Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.

Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

Download Java Runtime Environment (JRE) 6 Update 21.

Scroll omlaag naar : "Java Platform Standard Edition".
Klik op de "Download JRE" knop aan de rechterkant.
In het uitklapmenu rechts naast Platform, selecteer Windows
Vink aan: "I agree to the Java SE Runtime Environment 6u21 with JavaFX License Agreement", en klik op Continue.
De pagina zal herladen.
Klik op de jre-6u21-windows-i586.exe link ONDER Available Files en bewaar het naar je Bureaublad.
Sluit alle programma's die eventueel open zijn - Zeker je web browser!
Ga dan naar Start > Configuratiescherm > Software of Start > Configuratiescherm > Programma's en onderdelen (bij Vista) en verwijder alle oudere versies van Java uit de Softwarelijst.
Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
Herhaal dit tot alle oudere versies verdwenen zijn.
Na het verwijderen van alle oudere versies, herstart je pc.
Dubbelklik vervolgens op jre-6u21-windows-i586.exe op je Bureaublad om de nieuwste versie van Java te installeren.

Maak daarna een nieuw logje met HijackThis en Malwarebytes en hang beiden in je volgende bericht.

Anna_T · 24 juli 2010

Ik krijg geen berichten meer van antimalware doctor, maar de virus heeft op de een of andere manier mijn internetverbinding aangetast. Er kan geen verbinding met de internet gemaakt worden (ik zit nu op de laptop)

hijackthis.log

mbam-log-2010-07-24 (19-12-24).txt

kape · 24 juli 2010

Logjes zijn OK.

Ga naar start -> uitvoeren

typ cmd druk op enter

typ ipconfig /flushdns en klik enter

Herstart de computer.

En kijk dan eens of je nu verbinding hebt ?

Anna_T · 24 juli 2010

nee nog altijd geen internet

Anna_T · 25 juli 2010

Toen ik mijn pc vanmorgen opstartte had ik opeens internet verbinding. Maar de computer werkt redelijk traag. Ik denk dat dit te wijten is aan die virus. Wat moet ik doen op uiteindelijk er vanaf te zijn?

kape · 25 juli 2010

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

Lees hier meer over correct gebruik van Combofix.

Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen: Klik hier Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.
Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd. Als deze Recovery Console al is geïnstalleerd zal ComboFix automatisch verder gaan met het scannen naar malware
Volg anders de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren. Wanneer de Recovery Console succesvol is geïnstalleerd, klik je op “JA” om verder te gaan met het scannen naar malware.

NOTA: Wanneer ComboFix start, kan het zijn dat je een foutmelding krijgt dat “De inhoud van het ComboFix pakket werd gewijzigd”. Ga dan niet verder met de instructies, maar download ComboFix opnieuw. Deze melding kan verschijnen wanneer een file-infector (Virut) actief is op de computer. Blijf je die melding krijgen dan meld je dit.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Anna_T · 25 juli 2010

hier is het

ComboFix 10-07-24.03 - HP_Administrator 25/07/2010 21:38:00.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.32.1043.18.1022.521 [GMT 2:00]

Gestart vanuit: c:\documents and settings\HP_Administrator\Bureaublad\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\HP_Administrator\Application Data\074AA3F8999CB01651C31DD200E67E32

c:\documents and settings\HP_Administrator\Application Data\074AA3F8999CB01651C31DD200E67E32\enemies-names.txt

c:\documents and settings\HP_Administrator\Application Data\074AA3F8999CB01651C31DD200E67E32\local.ini

c:\documents and settings\HP_Administrator\Application Data\074AA3F8999CB01651C31DD200E67E32\lsrslt.ini

c:\documents and settings\HP_Administrator\Application Data\inst.exe

c:\documents and settings\HP_Administrator\Menu Start\Programma's\Opstarten\OpenOffice.org 3.0 .lnk

c:\program files\Mail.Ru\Agent\Mra\dll\newmrasearch.dll

c:\windows\dat.txt

c:\windows\system32\404Fix.exe

c:\windows\system32\dumphive.exe

c:\windows\system32\IEDFix.C.exe

c:\windows\system32\IEDFix.exe

c:\windows\system32\Process.exe

c:\windows\system32\SrchSTS.exe

c:\windows\system32\tmp.reg

c:\windows\system32\VACFix.exe

c:\windows\system32\VCCLSID.exe

c:\windows\system32\WS2Fix.exe

D:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SSHNAS

(((((((((((((((((((( Bestanden Gemaakt van 2010-06-25 to 2010-07-25 ))))))))))))))))))))))))))))))

.

2010-07-25 13:14 . 2010-07-25 13:14 -------- d--h--r- c:\documents and settings\HP_Administrator\Onlangs geopend

2010-07-25 08:26 . 2010-07-25 08:26 5504 ----a-w- c:\windows\system32\drivers\INTELIDE.SYS

2010-07-25 08:10 . 2010-07-25 08:34 -------- d-----w- c:\windows\system32\MpEngineStore

2010-07-24 17:01 . 2010-07-24 17:01 -------- d-----w- c:\program files\Common Files\Java

2010-07-24 17:00 . 2010-07-24 17:00 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-07-24 12:08 . 2010-07-24 12:08 -------- d-----w- c:\program files\Trend Micro

2010-07-24 11:50 . 2010-07-24 11:50 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Threat Expert

2010-07-24 10:48 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-24 10:48 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-24 10:48 . 2010-07-24 10:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-24 10:17 . 2008-09-08 21:38 88576 ----a-w- c:\windows\system32\AntiXPVSTFix.exe

2010-07-24 10:01 . 2010-07-25 15:32 -------- d-----w- c:\program files\Spyware Doctor

2010-07-24 09:38 . 2010-07-24 09:38 202752 ----a-w- c:\windows\Ypabaa.exe

2010-07-24 09:38 . 2010-07-24 11:43 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\flriaoqni

2010-07-20 12:09 . 2006-03-29 05:05 32768 ------w- c:\windows\system32\IJRMF.exe

2010-07-20 12:04 . 2006-03-26 20:00 65024 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP83.DLL

2010-07-20 12:04 . 2006-03-26 20:00 22528 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD83.DLL

2010-07-20 12:04 . 2006-03-26 20:00 161792 ----a-w- c:\windows\system32\CNMLM83.DLL

2010-07-20 12:04 . 2010-07-20 12:04 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information

2010-07-19 11:34 . 2008-11-10 09:41 32656 ----a-w- c:\windows\system32\msonpmon.dll

2010-07-19 11:34 . 2006-10-26 17:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll

2010-07-16 11:03 . 2010-07-16 11:03 12536 ----a-w- c:\windows\system32\avgrsstx.dll

2010-07-14 08:50 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

2010-06-27 18:47 . 2010-06-28 18:54 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-25 19:19 . 2007-12-22 20:15 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\BitTorrent

2010-07-25 16:42 . 2007-08-15 20:11 -------- d-----w- c:\program files\LowRateVoip

2010-07-25 15:30 . 2008-09-11 20:12 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-07-25 15:28 . 2006-09-14 05:03 -------- d-----w- c:\program files\Common Files\Real

2010-07-25 08:29 . 2008-01-23 20:20 -------- d-----w- c:\program files\SC-KeyLog

2010-07-25 08:15 . 2010-07-25 08:15 12800 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-2af7a695-n\decora-d3d.dll

2010-07-25 08:15 . 2010-07-25 08:15 61440 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-2af7a695-n\decora-sse.dll

2010-07-25 08:15 . 2010-07-25 08:15 503808 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5c6bb169-n\msvcp71.dll

2010-07-25 08:15 . 2010-07-25 08:15 499712 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5c6bb169-n\jmc.dll

2010-07-25 08:15 . 2010-07-25 08:15 348160 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5c6bb169-n\msvcr71.dll

2010-07-24 16:55 . 2006-01-27 10:38 90870 ----a-w- c:\windows\system32\perfc013.dat

2010-07-24 16:55 . 2006-01-27 10:38 508462 ----a-w- c:\windows\system32\perfh013.dat

2010-07-24 12:08 . 2010-07-24 12:08 388096 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-07-23 08:22 . 2009-08-06 12:25 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2010-07-22 14:28 . 2009-09-29 18:18 186 ----a-w- c:\documents and settings\All Users\Application Data\SafeNet Sentinel\Sentinel RMS Development Kit\System\prsgrc.dll

2010-07-21 12:37 . 2010-07-21 12:37 1615200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll

2010-07-21 12:37 . 2010-07-21 12:37 1107296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll

2010-07-21 12:37 . 2010-07-21 12:37 921440 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgemc.exe

2010-07-21 12:37 . 2010-07-21 12:37 4368224 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll

2010-07-20 18:50 . 2007-08-29 15:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-07-20 13:02 . 2007-08-15 17:37 53696 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-19 21:19 . 2006-09-14 05:07 -------- d-----w- c:\program files\Microsoft Works

2010-07-19 11:39 . 2010-07-19 11:39 53248 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\1000000b00002h\verclsid.exe

2010-07-16 11:03 . 2010-07-16 11:03 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys

2010-07-16 11:03 . 2010-07-16 11:03 216200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys

2010-07-16 11:03 . 2010-06-24 15:25 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-07-16 11:02 . 2010-06-24 15:25 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-07-16 11:01 . 2010-07-16 11:01 1038688 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe

2010-07-16 11:01 . 2010-07-16 11:01 813336 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll

2010-07-16 11:01 . 2010-07-16 11:01 624920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe

2010-07-16 11:01 . 2010-07-16 11:01 1690464 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll

2010-06-27 18:48 . 2010-06-27 18:48 2605008 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe

2010-06-25 08:53 . 2006-09-14 05:23 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-06-25 08:53 . 2006-09-14 05:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2010-06-24 19:18 . 2010-06-24 15:25 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-06-24 15:35 . 2009-11-06 11:21 -------- d-----w- c:\program files\Windows Live SkyDrive

2010-06-24 15:27 . 2010-06-24 15:27 53248 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\30000000d900002h\DW20.EXE

2010-06-24 15:27 . 2010-06-24 15:27 53248 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\300000007300002h\POWERPNT.EXE

2010-06-24 15:27 . 2010-06-24 15:27 53248 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\300000007100002h\ODSERV.EXE

2010-06-24 15:27 . 2010-06-24 15:27 53248 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\300000002ca00002h\OffDiag.exe

2010-06-24 15:27 . 2010-06-24 15:27 53248 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\1000000500002h\hh.exe

2010-06-24 15:24 . 2010-06-24 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-06-24 15:24 . 2009-07-14 17:37 -------- d-----w- c:\program files\AVG

2010-06-24 14:23 . 2008-12-18 21:25 -------- d-----w- c:\program files\Avi2Dvd

2010-06-24 14:22 . 2009-04-18 12:21 -------- d-----w- c:\program files\Any Video Converter

2010-06-24 14:22 . 2009-04-18 12:21 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Any Video Converter

2010-06-24 14:18 . 2006-09-14 04:58 -------- d-----w- c:\program files\Common Files\Sonic Shared

2010-06-24 14:17 . 2006-09-14 05:04 -------- d-----w- c:\program files\Sonic

2010-06-24 14:08 . 2009-11-06 11:26 -------- d-----w- c:\program files\Microsoft Silverlight

2010-06-23 17:52 . 2006-01-27 10:32 92663 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2010-06-14 14:31 . 2004-09-02 11:00 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-05-23 18:53 . 2008-01-05 22:18 12 ----a-w- c:\windows\bthservsdp.dat

2010-05-06 10:37 . 2004-09-02 11:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-05 19:15 . 2009-04-04 13:10 1 ----a-w- c:\documents and settings\HP_Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-05-02 08:10 . 2004-09-02 11:00 1851392 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2010-04-19 08:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"JustVoip"="c:\program files\JustVoip.com\JustVoip\JustVoip.exe" [2009-11-13 9052464]

"LowRateVoip"="c:\program files\LowRateVoip\LowRateVoip.exe" [2009-12-14 9167160]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-18 64512]

"ftutil2"="ftutil2.dll" [2004-06-07 106496]

"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16261632]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-02-22 143360]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-21 7622656]

"nwiz"="nwiz.exe" [2006-06-21 1519616]

"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]

"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-16 2065760]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

c:\documents and settings\HP_Administrator\Menu Start\Programma's\Opstarten\

KDWin Keyboard Driver.lnk - c:\kdwin\KDWIN.EXE [2007-10-14 655360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Reader Snelle start.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\JustVoip.com\\JustVoip\\justvoip.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\LowRateVoip\\LowRateVoip.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\SPSSInc\\SPSS16\\spss.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [24/06/2010 17:25 216400]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [24/06/2010 17:25 243024]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [16/07/2010 13:02 921952]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [16/07/2010 13:03 308136]

R3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [25/05/2010 20:43 20160]

S1 fgskpnoo;fgskpnoo;\??\c:\windows\system32\drivers\fgskpnoo.sys --> c:\windows\system32\drivers\fgskpnoo.sys [?]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [24/06/2010 17:25 430152]

.

Inhoud van de 'Gedeelde Taken' map

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = <local>

IE: &Google Zoeken - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: &Woord vertalen in het Nederlands - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Easy-WebPrint Afdrukken - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html

IE: Easy-WebPrint Afdrukvoorbeeld - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html

IE: Easy-WebPrint Toevoegen aan afdruklijst - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html

IE: Easy-WebPrint Versneld afdrukken - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html

IE: Gelijkwaardige pagina's - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Koppelingspagina's - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Opgeslagen momentopname van de pagina - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

.

- - - - ORPHANS VERWIJDERD - - - -

HKLM-Run-PCDrProfiler - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-07-25 21:48

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(2284)

c:\windows\system32\nview.dll

c:\windows\system32\NVWRSNL.DLL

c:\kdwin\KDWKeys.dll

c:\program files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll

c:\windows\system32\nvwddi.dll

c:\windows\system32\webcheck.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\system32\nvsvc32.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\ehome\mcrdsvc.exe

c:\program files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\dllhost.exe

c:\windows\RTHDCPL.EXE

c:\windows\eHome\ehmsas.exe

c:\windows\system32\rundll32.exe

c:\windows\system32\wbem\wmiapsrv.exe

.

**************************************************************************

.

Voltooingstijd: 2010-07-25 21:55:57 - machine werd herstart

ComboFix-quarantined-files.txt 2010-07-25 19:55

Pre-Run: 120.761.757.696 bytes beschikbaar

Post-Run: 125.074.550.784 bytes beschikbaar

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - 7C1B0AE9D29A1329F46FDF96DF1B3FC2

kape · 25 juli 2010

Combofix heeft al behoorlijk wat rotzooi opgeruimd. Dit mag je nog extra doen :

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\Ypabaa.exe

c:\windows\system32\IJRMF.exe

c:\windows\system32\drivers\fgskpnoo.sys

Folder::

c:\documents and settings\HP_Administrator\Local Settings\Application Data\flriaoqni

Driver::

fgskpnoo

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Anna_T · 25 juli 2010

hier zijn ze dan:

ComboFix 10-07-24.03 - HP_Administrator 25/07/2010 22:54:53.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.32.1043.18.1022.577 [GMT 2:00]

Gestart vanuit: c:\documents and settings\HP_Administrator\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\HP_Administrator\Bureaublad\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::

"c:\windows\system32\drivers\fgskpnoo.sys"

"c:\windows\system32\IJRMF.exe"

"c:\windows\Ypabaa.exe"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\HP_Administrator\Local Settings\Application Data\flriaoqni

c:\windows\system32\IJRMF.exe

c:\windows\Ypabaa.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_fgskpnoo

(((((((((((((((((((( Bestanden Gemaakt van 2010-06-25 to 2010-07-25 ))))))))))))))))))))))))))))))

.

2010-07-25 13:14 . 2010-07-25 20:45 -------- d--h--r- c:\documents and settings\HP_Administrator\Onlangs geopend