Trojan Virus dat ik helemaal niet wegkrijg

Skippy · 24 januari 2011

Beide zijn gelukt, oef!!! Hieronder vind je het log-bestandje...

ComboFix 11-01-23.07 - Jurgen & Kim 24/01/2011 15:19:06.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1023.292 [GMT 1:00]

Gestart vanuit: c:\documents and settings\Jurgen & Kim\Mijn documenten\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Thumbs.db

c:\windows\system32\Bank.dll

c:\windows\system32\drivers\vompkzes.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_WINDOWS_OVERLAY_COMPONENTS

(((((((((((((((((((( Bestanden Gemaakt van 2010-12-24 to 2011-01-24 ))))))))))))))))))))))))))))))

.

2011-01-24 14:03 . 2011-01-24 14:03 -------- d-----w- c:\program files\@CompanyDir

2011-01-24 10:57 . 2011-01-13 00:41 5890896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CDCF6F3C-0C2D-4BA0-8D8A-3BF7EE9A9C32}\mpengine.dll

2011-01-24 10:19 . 2011-01-24 10:19 -------- d-----w- C:\AVGTemp

2011-01-23 14:45 . 2011-01-13 00:41 5890896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-01-23 11:39 . 2011-01-23 11:39 -------- d-----w- c:\documents and settings\Jurgen & Kim\Application Data\Malwarebytes

2011-01-23 11:38 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-01-23 11:38 . 2011-01-23 11:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-01-23 11:38 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-01-23 11:38 . 2011-01-23 11:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-01-23 10:43 . 2011-01-23 10:43 388096 ----a-r- c:\documents and settings\Jurgen & Kim\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-01-23 10:43 . 2011-01-23 10:43 -------- d-----w- c:\program files\Trend Micro

2011-01-22 18:46 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-01-22 18:41 . 2011-01-22 18:45 -------- d-----w- c:\program files\Microsoft Security Client

2011-01-22 18:40 . 2011-01-22 18:40 8123448 ----a-w- c:\program files\mseinstall.exe

2011-01-13 18:30 . 2011-01-13 18:30 -------- d-----w- c:\program files\MSBuild

2011-01-13 18:28 . 2011-01-13 18:28 -------- d-----w- c:\program files\Microsoft.NET

2011-01-13 18:21 . 2011-01-13 18:21 -------- d-----w- c:\documents and settings\Jurgen & Kim\Local Settings\Application Data\Microsoft Help

2011-01-13 18:21 . 2011-01-22 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2011-01-13 18:06 . 2011-01-13 18:06 -------- d-----r- C:\MSOCache

2011-01-02 15:33 . 2011-01-02 15:34 -------- d-----w- C:\Films

2011-01-02 12:44 . 2011-01-02 12:44 730368 ----a-w- c:\windows\system32\zmipzvgh.dll.bak

2011-01-02 11:51 . 2011-01-07 18:24 -------- d-----w- c:\documents and settings\Jurgen & Kim\Application Data\PriceGong

2011-01-02 11:39 . 2011-01-23 11:57 -------- d-----w- c:\documents and settings\Jurgen & Kim\Application Data\vlc

2011-01-02 11:00 . 2011-01-02 11:00 -------- d-----w- c:\program files\VideoLAN

2011-01-02 10:47 . 2011-01-02 10:47 -------- d-----w- c:\documents and settings\Jurgen & Kim\Local Settings\Application Data\Temp

2011-01-02 10:47 . 2011-01-02 10:47 -------- d-----w- c:\program files\uTorrent

2011-01-02 10:44 . 2011-01-02 15:48 -------- d-----w- c:\documents and settings\Jurgen & Kim\Application Data\uTorrent

2011-01-02 10:43 . 2011-01-02 10:44 396152 ----a-w- c:\program files\utorrent.exe

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-01-24 13:39 . 2005-01-27 11:34 17408 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS

2010-11-18 18:15 . 2005-01-27 09:50 86016 ----a-w- c:\windows\system32\isign32.dll

2010-11-09 14:52 . 2010-11-09 14:52 249856 ----a-w- c:\windows\system32\SETC.tmp

2010-11-09 14:52 . 2010-11-09 14:52 249856 ------w- c:\windows\system32\SET9.tmp

2010-11-09 14:52 . 2005-01-27 09:31 249856 ----a-w- c:\windows\system32\odbc32.dll

2010-11-06 00:25 . 2005-01-27 09:31 832512 ----a-w- c:\windows\system32\wininet.dll

2010-11-06 00:25 . 2005-01-27 09:31 1830912 ----a-w- c:\windows\system32\inetcpl.cpl

2010-11-06 00:25 . 2009-08-11 21:36 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-11-06 00:25 . 2005-01-27 09:31 17408 ----a-w- c:\windows\system32\corpol.dll

2010-11-03 12:26 . 2005-01-27 09:31 389120 ----a-w- c:\windows\system32\html.iec

2010-11-02 15:17 . 2005-01-27 09:31 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys

2010-10-28 13:09 . 2005-01-27 09:31 290048 ----a-w- c:\windows\system32\atmfd.dll

2006-04-01 18:08 . 2006-04-01 18:08 12789248 ----a-w- c:\program files\MP10Setup.exe

2005-12-09 18:42 . 2005-12-09 18:42 173120 ----a-w- c:\program files\yinst_current.exe

2005-11-12 12:48 . 2005-11-12 12:48 10156943 ----a-w- c:\program files\avg70free_289a392.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 88363]

"Dit"="Dit.exe" [2004-07-20 90112]

"Keyboard Status"="c:\progra~1\Medion Tools\KeyStat\KeyStat.exe" [2005-01-25 411648]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-02-21 118926]

"Realtime Monitor"="c:\progra~1\CA\ETRUST~1\realmon.exe" [2004-04-06 504080]

"Ulead AutoDetector"="c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe" [2003-11-19 45056]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-06 524632]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Reader Snelle start.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-1-27 1048576]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"c:\\Program Files\\Home Cinema\\PowerCinema\\PowerCinema.exe"=

"c:\\StubInstaller.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"21920:TCP"= 21920:TCP:@xpsp2res.dll,-22009

"49826:TCP"= 49826:TCP:@xpsp2res.dll,-22009

"163:TCP"= 163:TCP:@xpsp2res.dll,-22009

"47822:TCP"= 47822:TCP:@xpsp2res.dll,-22009

"16289:TCP"= 16289:TCP:@xpsp2res.dll,-22009

"59299:TCP"= 59299:TCP:@xpsp2res.dll,-22009

"58918:TCP"= 58918:TCP:@xpsp2res.dll,-22009

"22947:TCP"= 22947:TCP:@xpsp2res.dll,-22009

"32930:TCP"= 32930:TCP:@xpsp2res.dll,-22009

"49824:TCP"= 49824:TCP:@xpsp2res.dll,-22009

"2977:TCP"= 2977:TCP:@xpsp2res.dll,-22009

"23713:TCP"= 23713:TCP:@xpsp2res.dll,-22009

"43722:TCP"= 43722:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/06/2009 9:58 64160]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/03/2009 20:06 1029456]

R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [13/02/2005 14:02 666368]

R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [20/01/2005 15:05 1272000]

R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [27/01/2005 12:37 19928]

S0 twmqbmmj;twmqbmmj;c:\windows\system32\drivers\twmqbmmj.sys --> c:\windows\system32\drivers\twmqbmmj.sys [?]

S1 ctredrv.sys;ctredrv.sys;\??\c:\windows\system32\drivers\ctredrv.sys --> c:\windows\system32\drivers\ctredrv.sys [?]

S1 MpKsl7fa9674d;MpKsl7fa9674d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CDCF6F3C-0C2D-4BA0-8D8A-3BF7EE9A9C32}\MpKsl7fa9674d.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CDCF6F3C-0C2D-4BA0-8D8A-3BF7EE9A9C32}\MpKsl7fa9674d.sys [?]

S1 MpKslc31f71ee;MpKslc31f71ee;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ACC08993-E71B-48B4-BBFB-B468DB32E369}\MpKslc31f71ee.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ACC08993-E71B-48B4-BBFB-B468DB32E369}\MpKslc31f71ee.sys [?]

S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [27/01/2005 12:34 17408]

S3 SNDO963;Trust DB-1180 Binocular DigiCam;c:\windows\system32\drivers\sndo963.sys [15/01/2006 15:25 221056]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

lkkbaeiq

.

Inhoud van de 'Gedeelde Taken' map

2011-01-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 09:58]

2010-11-29 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 16:13]

2009-02-22 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1100 series5E771253C1676EBED677BF361FDFC537825E15B8161080022.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]

2011-01-24 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 11:26]

2011-01-24 c:\windows\Tasks\User_Feed_Synchronization-{A6A9102E-CE81-42B2-8EF8-26E7479CFFA0}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 10:58]

.

------- Bijkomende Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uStart Page = hxxp://www.hln.be/

mStart Page = hxxp://dutch.toggle.com/nl/index.php?rvs=google

uInternet Settings,ProxyOverride = localhost

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://86.81.214.224/activex/AMC.cab

FF - ProfilePath - c:\documents and settings\Jurgen & Kim\Application Data\Mozilla\Firefox\Profiles\03m92ztn.default\

FF - prefs.js: browser.search.selectedEngine - iMesh Web Search

FF - prefs.js: browser.startup.homepage - hxxp://www.hln.be

FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZUxdm556YYBE&fl=0&ptb=VcbCJJJJ0emGOkmRRfTysQ&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=kwd&searchfor=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com

FF - Ext: uTorrentBar_NL Community Toolbar: {87775fdb-6972-41f9-ae51-8326e38cb206} - %profile%\extensions\{87775fdb-6972-41f9-ae51-8326e38cb206}

.

------- Bestandsassociaties -------

.

.scr=AutoCADScript

.

- - - - ORPHANS VERWIJDERD - - - -

Toolbar-Locked - (no file)

WebBrowser-{15BE7AF0-ADD9-4075-AD13-E87B54A3EAB0} - c:\windows\system32\win7878.dll

WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)

HKLM-Run-Cmaudio - cmicnfg.cpl

HKLM-Run-LogitechVideoRepair - c:\program files\Logitech\Video\ISStart.exe

HKLM-Run-Lexmark X5100 Series - c:\program files\Lexmark X5100 Series\lxbabmgr.exe

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe

AddRemove-mk6vq8hd - c:\windows\mk6vq8hd.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-01-24 15:26

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-3306070157-3809988416-1071509390-1007\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(528)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1232)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe

c:\windows\System32\SCardSvr.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe

c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

c:\program files\CA\eTrust Antivirus\InoRpc.exe

c:\program files\CA\eTrust Antivirus\InoRT.exe

c:\program files\CA\eTrust Antivirus\InoTask.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\AGRSMMSG.exe

c:\windows\Dit.exe

c:\windows\system32\RunDll32.exe

c:\windows\system32\rundll32.exe

c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

c:\program files\Windows Media Player\WMPNetwk.exe

c:\windows\system32\wbem\unsecapp.exe

c:\progra~1\COMMON~1\X10\Common\x10nets.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Voltooingstijd: 2011-01-24 15:33:30 - machine werd herstart

ComboFix-quarantined-files.txt 2011-01-24 14:33

Pre-Run: 23.213.211.648 bytes beschikbaar

Post-Run: 23.832.346.624 bytes beschikbaar

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 807113D9A1BBB26A16CF99406F15D9B6

kape · 24 januari 2011

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\drivers\twmqbmmj.sys

c:\program files\yinst_current.exe

c:\windows\system32\zmipzvgh.dll.bak

c:\program files\MP10Setup.exe

c:\program files\avg70free_289a392.exe

c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CDCF6F3C-0C2D-4BA0-8D8A-3BF7EE9A9C32}\MpKsl7fa9674d.sys

c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ACC08993-E71B-48B4-BBFB-B468DB32E369}\MpKslc31f71ee.sys

Folder::

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong

Driver::

twmqbmmj

MpKsl7fa9674d

MpKslc31f71ee

lkkbaeiq

Firefox::

FF - ProfilePath - c:\documents and settings\Jurgen & Kim\Application Data\Mozilla\Firefox\Profiles\03m92ztn.default\

FF - prefs.js: browser.search.selectedEngine –

FF - prefs.js: keyword.URL –

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Skippy · 24 januari 2011

Hieronder vind je het logje van Combofix: (blijkbaar is de upload mislukt want de server was niet bereikbaar)

ComboFix 11-01-23.07 - Jurgen & Kim 24/01/2011 19:14:27.2.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1023.546 [GMT 1:00]

Gestart vanuit: c:\documents and settings\Jurgen & Kim\Mijn documenten\Downloads\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Jurgen & Kim\Bureaublad\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

FILE ::

"c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ACC08993-E71B-48B4-BBFB-B468DB32E369}\MpKslc31f71ee.sys"

"c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CDCF6F3C-0C2D-4BA0-8D8A-3BF7EE9A9C32}\MpKsl7fa9674d.sys"

"c:\program files\avg70free_289a392.exe"

"c:\program files\MP10Setup.exe"

"c:\program files\yinst_current.exe"

"c:\windows\system32\drivers\twmqbmmj.sys"

"c:\windows\system32\zmipzvgh.dll.bak"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\J.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Jurgen & Kim\Application Data\PriceGong\Data\z.xml

c:\program files\avg70free_289a392.exe

c:\program files\MP10Setup.exe

c:\program files\yinst_current.exe

c:\windows\system32\zmipzvgh.dll.bak

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_LKKBAEIQ

-------\Legacy_MPKSL7FA9674D

-------\Legacy_MPKSLC31F71EE

-------\Service_MpKsl7fa9674d

-------\Service_MpKslc31f71ee

-------\Service_twmqbmmj

(((((((((((((((((((( Bestanden Gemaakt van 2010-12-24 to 2011-01-24 ))))))))))))))))))))))))))))))

.

2011-01-24 17:25 . 2011-01-13 00:41 5890896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00DC232A-9D29-4B8F-92E5-A2AD1700477B}\mpengine.dll