Antimalware Doctor

keffievs · 31 maart 2011

Ik heb sinds gister ook dit irritante virus.

Nu had ik op dit forum al wat gelezen hierover via deze link, http://www.pc-helpforum.be/f201/antimalware-doctor-volledig-verwijderen-maar-hoe-26165/

Ik heb dit gevolgd maar helaas nog steeds problemen. Als ik deze stappen volg wordt antimalware wel uitgeschakeld. Alleen als ik de pc opnieuw opstart begint alles weer opnieuw. Het lijkt er dus op dat het hoofdbestand die alles opstart niet verwijderd wordt.

Misschien dat er ook nog wel een ander virus gelijk is meegekomen. Kan iemand dit zien middels een HiJackThis log?

het zou kunnen dat dit komt omdat er in HiJackThis andere stukken staan dan die in de link worden genoemd. Doordat mijn pc erg traag is door dit virus zet ik nu alvast een discussie op. Vanavond als ik thuis ben zal ik de HiJackthis log en de MBAM log plaatsen. Hopelijk kan iemand me dan helpen om dit vervelende virus voorgoed te verwijderen.

Alvast heel erg bedankt.

Grt

Kevin

kweezie wabbit · 31 maart 2011

Je moet nooit de analyse van een ander zijn hijackthis log toepassen op jouw pc.

Deze logs zijn per pc te bekijken en te behandelen.

Vergeet dus wat in die link staat en plaats een logje van je eigen pc.

Dan zullen we dit nazien en stap voor stap uitleggen hoe het verder moet.

keffievs · 31 maart 2011

Ok :-( Misschien dat ik daar dan l wat mee heb verziekt, maar dat zie ik later wel weer. Eerst dit probleem maar eens zien op te lossen. Want mijn pc is hierdoor echt zo traag, niet normaal! Maar ik weet dus niet of dat nu nog komt door die antimalware doctor of een ander virus. Hopelijk kunnen jullie dat middels onderstaand logje achterhalen.

Log HiJackThis:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:49:14, on 31-3-2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\Ati2evxx.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\spoolsv.exe

E:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe

E:\WINDOWS\Explorer.EXE

E:\Program Files\PC Tools Security\pctsAuxs.exe

E:\Program Files\PC Tools Security\pctsSvc.exe

E:\WINDOWS\system32\rundll32.exe

E:\WINDOWS\VistaDrive\VistaDrive.exe

E:\WINDOWS\AGRSMMSG.exe

E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

E:\Program Files\DivX\DivX Update\DivXUpdate.exe

E:\Program Files\PC Tools Security\BDT\FGuard.exe

E:\Program Files\PC Tools Security\pctsGui.exe

E:\WINDOWS\system32\ctfmon.exe

E:\WINDOWS\system32\rundll32.exe

E:\Program Files\Sweex\Installer\WINXP\SWU.exe

E:\WINDOWS\system32\svchost.exe

E:\Program Files\UPHClean\uphclean.exe

E:\Program Files\Internet Explorer\iexplore.exe

E:\WINDOWS\system32\wuauclt.exe

E:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = FR12.nl - Waar Feyenoord is zijn wij!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - E:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll

O1 - Hosts: 173.192.170.88 drghwaweg45j4i6u3q32fg2h.com

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - E:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll

O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - E:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - E:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {A2F4369D-ACB7-EE88-86A5-3D8E4226F8FD} - e:\windows\system32\aoigwerg.dll (file missing)

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - E:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [VistaDrive] E:\WINDOWS\VistaDrive\VistaDrive.exe

O4 - HKLM\..\Run: [skinClock] E:\Program Files\Desktop Tray Clock\DTClock.exe

O4 - HKLM\..\Run: [startCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [DivXUpdate] "E:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKLM\..\Run: [PCTools FGuard] E:\Program Files\PC Tools Security\BDT\FGuard.exe

O4 - HKLM\..\Run: [iSTray] "E:\Program Files\PC Tools Security\pctsGui.exe" /hideGUI

O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skinClock] E:\Program Files\Desktop Tray Clock\DTClock.exe

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "E:\Program Files\DAEMON Tools Pro\DTAgent.exe" -autorun

O4 - HKCU\..\Run: [Kraxuquga] rundll32.exe "E:\WINDOWS\usysg3dp.dll",Startup

O4 - HKCU\..\Run: [Q8PS7ZCLN6] E:\WINDOWS\Epekoh.exe

O4 - HKCU\..\Run: [NtWqIVLZEWZU] E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Ens.exe

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-20\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Sweex WiFi Utility.lnk = E:\Program Files\Sweex\Installer\WINXP\SWU.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - Help and Support (file missing)

O9 - Extra 'Tools' menuitem: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - Help and Support (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583},CLSID,0,{1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583},Exec,0,E: - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583},MenuText,0,@xpsp3res.dll - (no file)

O16 - DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} (VaioInfo.CMClass) - http://esupport.sony.com/VaioInfo.CAB

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O20 - Winlogon Notify: gmecoss - E:\Documents and Settings\NetworkService\Local Settings\Application Data\gmecoss.dll

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - E:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - E:\WINDOWS\system32\browseui.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Browser Defender Update Service - Unknown owner - E:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - E:\Program Files\PC Tools Security\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - E:\Program Files\PC Tools Security\pctsSvc.exe

--

End of file - 7489 bytes

Log MBAM:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Databaseversie: 6208

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

31-3-2011 6:09:55

mbam-log-2011-03-31 (06-09-55).txt

Scantype: Volledige scan (C:\|D:\|E:\|)

Objecten gescand: 302291

Verstreken tijd: 4 uur/uren, 24 minuut/minuten, 4 seconde(n)

Geheugenprocessen geïnfecteerd: 1

Geheugenmodulen geïnfecteerd: 1

Registersleutels geïnfecteerd: 5

Registerwaarden geïnfecteerd: 2

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 39

Geheugenprocessen geïnfecteerd:

e:\documents and settings\administrator\ruyif.exe (Heuristics.Shuriken) -> 3564 -> Unloaded process successfully.

Geheugenmodulen geïnfecteerd:

e:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.

Registersleutels geïnfecteerd:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\OUU6KC5WPX (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ruyif (Heuristics.Shuriken) -> Value: ruyif -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OUU6KC5WPX (Trojan.FakeAlert) -> Value: OUU6KC5WPX -> Quarantined and deleted successfully.

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:

e:\documents and settings\administrator\ruyif.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.

c:\documents and settings\kevin & deborah\application data\dwm.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\documents and settings\kevin & deborah\application data\microsoft\conhost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\kevin & deborah\local settings\Temp\csrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\kevin & deborah\local settings\Temp\44.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlls.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlls64.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlph.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlservice.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlvknlg.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlvknlg64.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\rlxf.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\relevantknowledge\components\rlxg.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.

c:\program files\vso\convertxtodvd\convertxtodvdv2x_goldcrackb2.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

c:\program files\internet explorer\conhost.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\DpiSca.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\sshnas21.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\nbnnlwzg.dll (Trojan.Boaxxe) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\drivers\lunpteoo.sys (Rootkit.Agent.BO) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\10.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\27.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\29.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\Abv.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\Abw.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\Abx.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\Aby.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\B.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\C.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\D.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\doskeya.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\E.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\F.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\ifvb\setup.exe (Trojan.Agent) -> Quarantined and deleted successfully.

e:\documents and settings\administrator\local settings\Temp\7.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

e:\WINDOWS\Temp\9.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

e:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.

e:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

e:\WINDOWS\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

e:\documents and settings\administrator\local settings\Temp\Enr.exe (Trojan.FakeAlert) -> Delete on reboot.

Hoop echt dat dit snel opgelost is!

Alvast heel erg bedank voor de reacties en de hulp!

Groeten,

Kevin

kweezie wabbit · 31 maart 2011

Volgens mij is er iets aan de hand met de klok van je pc.

Kijk maar naar de tijd van het HJT logje (Scan saved at 20:49:14, on 31-3-2011) en dan naar de tijd dat je het bericht plaatste.

Malwarebytes heeft heel wat rotzooi opgeruimd maar ik denk dat dit gedaan is nadat je het logje met hijackthis had gamaakt.

Kan je een nieuw hjt logje maken en plaatsen (maar zet eerst de klok juist )

keffievs · 31 maart 2011

tuurlijk...nieuw logje

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:43:54, on 31-3-2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\csrss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\Ati2evxx.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\system32\spoolsv.exe

E:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe

E:\WINDOWS\Explorer.EXE

E:\WINDOWS\system32\svchost.exe

E:\Program Files\PC Tools Security\pctsAuxs.exe

E:\Program Files\PC Tools Security\pctsSvc.exe

E:\WINDOWS\system32\rundll32.exe

E:\WINDOWS\VistaDrive\VistaDrive.exe

E:\WINDOWS\AGRSMMSG.exe

E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

E:\Program Files\DivX\DivX Update\DivXUpdate.exe

E:\Program Files\PC Tools Security\BDT\FGuard.exe

E:\Program Files\PC Tools Security\pctsGui.exe

E:\WINDOWS\system32\ctfmon.exe

E:\WINDOWS\system32\rundll32.exe

E:\Program Files\Sweex\Installer\WINXP\SWU.exe

E:\WINDOWS\system32\svchost.exe

E:\Program Files\UPHClean\uphclean.exe

E:\Program Files\Internet Explorer\iexplore.exe

E:\WINDOWS\system32\wuauclt.exe

E:\Program Files\PC Tools Security\Update.exe

E:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe

E:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe

E:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe

E:\Program Files\Internet Explorer\iexplore.exe

E:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

E:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = FR12.nl - Waar Feyenoord is zijn wij!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl