TROJAN : GENERIC24.AAWJ mappen zijn plots snelkoppelingen

diederikdesmet · 13 september 2011

Office 2007 gekregen van mijn kameraad = leerkracht aan een hogeschool en die krijgen regelmatig software met schoollicentie.

Misschien heeft hij ondertussen de nieuwere versie.

Kan ook nog altijd mijn oudere XP versie installeren.

De ramp PC.

PC die ik bijna 6 jaar terug zelf ineen gestoken heb. Er zitten 2 hdd in + ik heb 2 hdd die in een sleuvensysteem ingebracht kunnen worden met besturingssysteem.

1 had ik voor de vereniging waar ik bij was (website) ondertussen is deze geformateerd en XP geinstalleerd met Office, maar kan die office dus niet meer installeren.

de andere had ik opgemaakt met 4 partities voor mezelf, maar deze is dus naar mijn dochter gegaan.

HijackThis van de hdd met partities

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:52:08, on 12/09/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

C:\PROGRA~1\AVG\AVG10\avgrsx.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Application Updater\ApplicationUpdater.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE

C:\Program Files\AVG\AVG10\avgwdsvc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\HP\HP UT\bin\hppusg.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\AVG\AVG10\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\AVG\AVG10\avgnsx.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\rundll32.exe

C:\PROGRA~1\AVG\AVG10\avgrsx.exe

C:\Program Files\AVG\AVG10\avgcsrvx.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Google

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Google

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Google

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Google

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Google

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = Google

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Google

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: {9589c4fa-2efe-ef59-a114-c8ed007302d2} - {2d203700-de8c-411a-95fe-efe2af4c9859} - (no file)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

O2 - BHO: (no name) - {4AA5D1B0-C80F-4B73-BA71-7EE4533032C2} - (no file)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {A0B8A2E4-0C24-4DC0-A60A-C5B3DC374B27} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll

O2 - BHO: (no name) - {D1F0E831-8A3F-4EBE-8AC5-427DC723B36A} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: (no name) - {DC033CA0-9195-491B-993B-971CED369A14} - (no file)

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O4 - HKLM\..\Run: [MSN Messenger] live.messenger.com

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [HPUsageTracking] C:\Program Files\HP\HP UT\bin\hppusg.exe "C:\Program Files\HP\HP UT\"

O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [searchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://L:\OFFICE~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Mobiele favorieten maken... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - L:\OFFICE~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1168982691522

O16 - DPF: {680285A8-96D3-43DA-9D3D-51DD987D0B77} (NeroVersionCheckerControl Control) - http://www.nero.com/doc/NeroVersionCheckerControl.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1184190775792

O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://boromirgrobbendonk.spaces.live.com/PhotoUpload/MsnPUpld.cab

O16 - DPF: {82CF9738-0BDA-4AAF-AB08-5AC5875FF3BB} (YMultiRecord Class) - file:///G:/computerlessen/files/localplayer/recording/yrecording.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Monopoly/Images/armhelper.ocx

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 14323 bytes

Malwarebytes log :

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Databaseversie: 7702

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/09/2011 21:06:32

mbam-log-2011-09-12 (21-06-32).txt

Scantype: Snelle scan

Objecten gescand: 166969

Verstreken tijd: 9 minuut/minuten, 29 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 0

Registerwaarden geïnfecteerd: 1

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 2

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pdeiex (Backdoor.Bot.WPM) -> Value: Pdeiex -> Quarantined and deleted successfully.

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:

c:\documents and settings\diederik\application data\Pdeiex.exe (Backdoor.Bot.WPM) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\conhost.exe (Trojan.Agent.BTMGen) -> Quarantined and deleted successfully.

Heb ook McAfee door die harde schijf laten gaan (9 zaken werden gecleand)

9/13/2011 9:27:35 AM Engine version = 5400.1158

9/13/2011 9:27:35 AM AntiVirus DAT version = 6467.0

9/13/2011 9:27:35 AM Number of detection signatures in EXTRA.DAT = None

9/13/2011 9:27:35 AM Names of detection signatures in EXTRA.DAT = None

9/13/2011 9:27:35 AM Scan Started PC_DDE\DDE On-Demand Scan

9/13/2011 9:29:20 AM Deleted DDE ODS d:\Documents and Settings\diederik\Cookies\diederik@atdmt.combing[2].txt\00000000.ie Cookie-Atdmt (Potentially Unwanted Program)

9/13/2011 9:29:23 AM Deleted DDE ODS d:\Documents and Settings\diederik\Cookies\diederik@atdmt.combing[2].txt\00000000.ie Cookie-Atdmt (Potentially Unwanted Program)

9/13/2011 9:30:39 AM Deleted DDE ODS d:\Documents and Settings\LocalService\Cookies\system@ads.addynamix[1].txt\00000000.ie Cookie-AdDynamix (Potentially Unwanted Program)

9/13/2011 9:30:39 AM Deleted DDE ODS d:\Documents and Settings\LocalService\Cookies\system@doubleclick[1].txt\00000000.ie Cookie-Doubleclick (Potentially Unwanted Program)

9/13/2011 9:30:39 AM Deleted DDE ODS d:\Documents and Settings\LocalService\Cookies\system@statcounter[1].txt\00000000.ie Cookie-Statcounter (Potentially Unwanted Program)

9/13/2011 9:31:42 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\BehavioralEventProcessors.dat

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\BehavioralEvents.dat

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\Characteristics.dat

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\md5Cache.dat

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\internalList.zip

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\internalList.zip.bak

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\quarantinedList.zip

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\quarantinedList.zip.bak

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\registryCoverage.dat

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\Relationships.dat

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\userList.zip

9/13/2011 9:31:45 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\AVG10\IDS\config\userList.zip.bak

9/13/2011 9:35:13 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\MFAData\pack\bins\f10idatx1392vj.bin

9/13/2011 9:35:53 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\QuadRegistryCleaner.zip

9/13/2011 9:35:53 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SpyHunter.zip

9/13/2011 9:35:53 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SpyHunter1.zip

9/13/2011 9:35:53 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip

9/13/2011 9:35:53 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip

9/13/2011 9:35:53 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde2.zip

9/13/2011 9:35:53 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SpyHunter2.zip

9/13/2011 9:35:53 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde3.zip

9/13/2011 9:35:54 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumondedll2.zip

9/13/2011 9:35:54 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumondedll1.zip

9/13/2011 9:35:54 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde4.zip

9/13/2011 9:35:54 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumondeprx.zip

9/13/2011 9:35:54 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumondesdn1.zip

9/13/2011 9:35:54 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumondesdn2.zip

9/13/2011 9:35:54 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumondesdn.zip

9/13/2011 9:35:54 AM Not scanned (The file is encrypted) d:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumondedll.zip

9/13/2011 9:37:44 AM Deleted DDE ODS d:\Documents and Settings\NetworkService\Cookies\system@ads.addynamix[1].txt\00000000.ie Cookie-AdDynamix (Potentially Unwanted Program)

9/13/2011 9:37:44 AM Deleted DDE ODS d:\Documents and Settings\NetworkService\Cookies\system@doubleclick[2].txt\00000000.ie Cookie-Doubleclick (Potentially Unwanted Program)

9/13/2011 9:49:36 AM Deleted DDE ODS d:\Documents and Settings\diederik\Local Settings\Temp\Cookies\diederik@atdmt.combing[2].txt\00000000.ie Cookie-Atdmt (Potentially Unwanted Program)

9/13/2011 9:50:01 AM Deleted DDE ODS d:\Documents and Settings\diederik\Local Settings\Temp\Cookies\diederik@atdmt.combing[2].txt\00000000.ie Cookie-Atdmt (Potentially Unwanted Program)

9/13/2011 9:53:01 AM Not scanned (The file is encrypted) d:\Program Files\Common Files\Adobe\Installers\Adobe Dreamweaver CS4 10.0 11-16-2008.log.gz

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Scan Summary

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Processes scanned : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Processes detected : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Processes cleaned : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Boot sectors scanned : 1

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Boot sectors detected: 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Boot sectors cleaned : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Files scanned : 107692

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Files with detections: 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE File detections : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Files cleaned : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Files deleted : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Files not scanned : 29

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Scan Summary (Registry Scanning)

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Keys scanned : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Keys detected : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Keys cleaned : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Keys deleted : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Scan Summary (Cookie Scanning)

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Cookies scanned : 857

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Cookies detected : 9

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Cookies cleaned : 0

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Cookies deleted : 9

9/13/2011 10:38:58 AM Scan Summary PC_DDE\DDE Run time : 1:11:22

9/13/2011 10:38:58 AM Scan Complete PC_DDE\DDE On-Demand Scan

Wat ik opmerk is dat de in partitie met documenten, deze worden weergegeven heel doorzichtig - precies watermerk.

Deze harde schijf is ook volledig gecrascht geweest, zwart scherm en alles weg van bureaublad, supertraag - gewoon onwerkbaar - heb ik door een herstelpunt terug te zetten min of meer een beetje aan de praat kunnen kijgen.

Zou fijn zijn voor mijn dochter, moest deze hdd min of meer een een beperkte werkbare staat gesteld worden zodat ze stilaan de juiste versies van progs kan zoeken om ze opnieuw te installeren op de andere hdd die ik voor haar heb klaargemaakt. Eens alles overgezet kan ik deze hdd terug formatteren en als datadisk in de case plaatsen.

als het er echt hopeloos uitziet, mag je het ook zeggen hoor, dan heeft ze pech.

Bedankt om ook hier even naar te kijken.

kweezie wabbit · 13 september 2011

Ga naar start - alle programma's - bureauaccesoires.

Zoek het icoon van het opdrachtprompt en klik er op met de rechter muisknop en kies dan in het lijstje voor uitvoeren als administrator om het opdrachtprompt te openen.

Tik in: sc stop "Lavasoft Ad-Aware Service" en druk op Enter.

Tik in: sc delete "Lavasoft Ad-Aware Service" en druk op Enter

Start Hijackthis op. Ben je gebruiker van Vista of windows 7, klik dan met de rechter muisknop op de icoon en kies dan voor “Run as administrator" of "Uitvoeren als administrator".

Selecteer “Do a system scan only”.

Vink alleen de items aan die hieronder zijn genoemd:

O2 - BHO: {9589c4fa-2efe-ef59-a114-c8ed007302d2} - {2d203700-de8c-411a-95fe-efe2af4c9859} - (no file)

O2 - BHO: (no name) - {4AA5D1B0-C80F-4B73-BA71-7EE4533032C2} - (no file)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: (no name) - {A0B8A2E4-0C24-4DC0-A60A-C5B3DC374B27} - (no file)

O2 - BHO: (no name) - {D1F0E831-8A3F-4EBE-8AC5-427DC723B36A} - (no file)

O2 - BHO: (no name) - {DC033CA0-9195-491B-993B-971CED369A14} - (no file)

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

Klik op 'Fix checked' om de items te verwijderen.

Maak dan een nieuw logje.

Verwijder IObit Advanced System Care want dit "beveiligingsprogramma" zit zelf vol lekken waardoor je malware en spyware binnen krijgt.

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:
Klik hier
Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.
Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.
**Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.
Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Indien je problemen hebt bij het uitvoeren van ComboFix, gelieve dit te melden.

diederikdesmet · 13 september 2011

jullie zijn onwaarschijnlijk.

heb naar best vermogen instructies opgevolgd. (bij opstarten ComboFix moest ik een uurtje weg, dus die virusscan is terug opgesprongen, ook na de heropstart + was vergeten bv malawarebytes af te zetten, dus hopelijk geen probleem.

Ik heb ook eerst Advance Systemcare verwijderd. Dus niet na het verwijderen van de HijackThis resultaten.

Bij sc stop commando kreeg ik eerst een foutmelding met een nummer

het sc delete was succesvol

Logjes :

Hijackthis

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 18:47:05, on 13/09/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Application Updater\ApplicationUpdater.exe

C:\Program Files\AVG\AVG10\avgwdsvc.exe

C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe

C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\HP\HP UT\bin\hppusg.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\AVG\AVG10\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\AVG\AVG10\avgnsx.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\WINDOWS\System32\ping.exe

C:\PROGRA~1\AVG\AVG10\avgrsx.exe

C:\Program Files\AVG\AVG10\avgcsrvx.exe

C:\Program Files\AVG\AVG10\avgscanx.exe

C:\Program Files\AVG\AVG10\avgcsrvx.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\cmd.exe