Geteisterd door Troyan horse backdoor generic 14 & Katusha.A

kape · 20 oktober 2011

Wel heel erg vreemd dat AVG bestanden van Malwarebytes en van zichzelf als besmetting herkent ???

Download ComboFix van één van deze locaties:

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier. Normaal gaat AVG hier moeilijk doen, maar wacht even met uitschakelen en klik gewoon door als hij opmerkingen maakt !!!

Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.

2. Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.

3. ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.

**Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.

4. Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

5. Wanneer ComboFix klaar is, zal het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Dommel1984 · 20 oktober 2011

Ok ik heb het hele proces wat je beschreef doorlopen. Hier volgt het rapport

Combofix

ComboFix 11-10-20.05 - Joost 20-10-2011 19:14:28.1.4 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.2943.2423 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Administrator\Bureaublad\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Joost\Application Data\inst.exe

c:\documents and settings\Joost\Application Data\vso_ts_preview.xml

c:\documents and settings\Joost\Bureaublad\Internet Explorer.lnk

c:\documents and settings\Joost\Local Settings\Application Data\1378f99a\U

c:\documents and settings\Joost\Local Settings\Application Data\1378f99a\U\800000cb.@

c:\program files\Autodesk_Revit_Architecture_2011_English_Win_32-64bit.exe

c:\windows\$NtUninstallKB5405$\326695322\@

c:\windows\$NtUninstallKB5405$\326695322\L\vvgbeohk

c:\windows\$NtUninstallKB5405$\326695322\loader.tlb

c:\windows\$NtUninstallKB5405$\326695322\U\@00000001

c:\windows\$NtUninstallKB5405$\326695322\U\@000000c0

c:\windows\$NtUninstallKB5405$\326695322\U\@000000cb

c:\windows\$NtUninstallKB5405$\326695322\U\@000000cf

c:\windows\$NtUninstallKB5405$\326695322\U\@80000000

c:\windows\$NtUninstallKB5405$\326695322\U\@800000c0

c:\windows\$NtUninstallKB5405$\326695322\U\@800000cb

c:\windows\$NtUninstallKB5405$\326695322\U\@800000cf

c:\windows\$NtUninstallKB5405$\4242094643

c:\windows\{2521BB91-29B1-4d7e-9137-AC9875D77735}

c:\windows\2600040467

c:\windows\assembly\GAC_MSIL\desktop.ini

c:\windows\ehome\medctrro.exe

c:\windows\system32\

c:\windows\system32\d3d9caps.dat

c:\windows\$NtUninstallKB5405$ . . . . konden niet verwijderd worden

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_1378f99a

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-09-20 to 2011-10-20 ))))))))))))))))))))))))))))))

.

2011-10-20 14:45 . 2011-10-20 14:53 -------- d-----w- c:\windows\system32\drivers\AVG

2011-10-19 17:34 . 2011-10-20 14:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2

2011-10-19 17:34 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-19 15:04 . 2011-10-19 15:04 388096 ----a-r- c:\documents and settings\Joost\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-10-17 18:56 . 2011-10-20 17:00 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software

2011-10-17 18:56 . 2011-10-17 18:56 -------- d-----w- c:\program files\AVAST Software

2011-10-17 16:52 . 2011-10-17 16:52 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2011-10-17 16:41 . 2011-10-17 16:41 -------- d-----w- c:\program files\Trend Micro

2011-10-17 16:19 . 2011-10-17 16:19 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache

2011-10-17 16:16 . 2011-10-17 16:16 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2011-10-17 15:38 . 2011-10-17 15:38 -------- d-----r- c:\documents and settings\LocalService\Favorieten

2011-10-16 18:56 . 2011-10-16 18:56 -------- d-----w- c:\documents and settings\Joost\Application Data\AVG2012

2011-10-16 18:48 . 2011-10-16 18:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG2012

2011-10-16 18:47 . 2011-10-20 14:45 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2012

2011-10-16 17:15 . 2011-10-16 17:15 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2011-10-16 17:00 . 2011-01-17 07:10 251560 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2011-10-16 17:00 . 2010-07-16 12:59 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys

2011-10-16 17:00 . 2010-07-16 12:59 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys

2011-10-16 17:00 . 2010-12-10 14:57 160448 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2011-10-16 17:00 . 2010-12-10 11:24 239168 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2011-10-16 17:00 . 2010-12-16 06:46 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2011-10-16 17:00 . 2011-10-16 19:19 -------- d-----w- c:\program files\PC Tools Security

2011-10-16 17:00 . 2011-10-16 17:05 -------- d-----w- c:\program files\Common Files\PC Tools

2011-10-16 17:00 . 2011-10-16 17:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools

2011-10-16 16:55 . 2011-10-16 16:55 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2011-10-16 16:53 . 2011-10-16 16:53 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google

2011-10-16 16:53 . 2011-10-16 16:53 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2011-10-16 16:00 . 2011-10-16 16:00 -------- d-----w- c:\windows\system32\wbem\Repository

2011-10-16 15:51 . 2011-10-16 15:51 -------- d-----w- c:\windows\system32\LogFiles

2011-10-16 15:40 . 2011-10-20 14:53 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData

2011-10-16 14:11 . 2011-10-20 17:22 -------- d-sh--w- c:\documents and settings\Joost\Local Settings\Application Data\1378f99a

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-13 04:30 . 2011-09-13 04:30 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2011-08-08 04:08 . 2011-08-08 04:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2011-07-27 20:24 . 2009-08-31 17:46 78813 ----a-w- c:\documents and settings\Joost\Application Data\mdb.bin

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="d:\programma's\Deamon Tools\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

"DAEMON Tools Pro Agent"="d:\programma's\DAEMON Tools Pro\DTAgent.exe" [2010-11-11 570688]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-30 7634944]

"nwiz"="nwiz.exe" [2006-10-30 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-30 86016]

"RTHDCPL"="RTHDCPL.EXE" [2007-09-27 16844800]

"SkyTel"="SkyTel.EXE" [2007-08-03 1826816]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]

"iTunesHelper"="d:\programma's\Itunes\iTunesHelper.exe" [2011-03-07 421160]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]

"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]

"ISTray"="c:\program files\PC Tools Security\pctsGui.exe" [2011-01-13 1589208]

"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-09-23 2404704]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware2\mbamgui.exe" [2011-08-31 449608]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

c:\documents and settings\Joost\Menu Start\Programma's\Opstarten\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"d:\\Programma's\\BitTorrent\\bittorrent.exe"=

"d:\\Programma's\\VLC\\vlc.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=

"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

"d:\\Programma's\\Itunes\\iTunes.exe"=

"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=

"c:\\Program Files\\DivX\\DivX Update\\DivXUpdate.exe"=

"c:\\Program Files\\Google\\Update\\GoogleUpdate.exe"=

"c:\\Program Files\\Windows Live\\Contacts\\wlcomm.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Documents and Settings\\Joost\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=

"c:\\Documents and Settings\\Joost\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

"d:\\Programma's\\Picasa3\\PicasaUpdater.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=

"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware2\\mbam.exe"=

"c:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe"=

"c:\\Program Files\\Common Files\\Java\\Java Update\\jucheck.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1032:TCP"= 1032:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [11-7-2011 1:14 23120]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [13-9-2011 6:30 32592]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [16-10-2011 19:00 239168]

R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [16-10-2011 19:00 338880]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11-7-2011 1:13 229840]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11-7-2011 1:14 295248]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [30-12-2010 19:58 219200]

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4-8-2004 1:03 14336]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [12-9-2011 6:23 5265248]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware2\mbamservice.exe [19-10-2011 19:34 359008]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [11-7-2011 1:14 134608]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [11-7-2011 1:14 24272]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [11-7-2011 1:14 16720]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [19-10-2011 19:34 22216]

R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [8-11-2009 13:49 47360]

S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2-8-2011 6:09 192776]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5-1-2010 17:39 135664]

S2 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe --> c:\program files\PC Tools Security\pctsAuxs.exe [?]

S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [5-1-2010 17:39 135664]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Inhoud van de 'Gedeelde Taken' map

.

2011-10-16 c:\windows\Tasks\AdobeAAMUpdater-1.0-JOOSTWIELAND-Joost.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-04-26 01:44]

.

2011-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-05 15:39]

.

2011-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-05 15:39]

.

2011-10-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-73586283-630328440-725345543-1003Core.job

- c:\documents and settings\Joost\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-10-17 16:24]

.

2011-10-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-73586283-630328440-725345543-1003UA.job

- c:\documents and settings\Joost\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-10-17 16:24]

.

2011-10-16 c:\windows\Tasks\Norton Security Scan for Joost.job

- c:\progra~1\NORTON~2\Engine\311~1.6\Nss.exe [2011-05-05 10:23]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

TCP: DhcpNameServer = 62.179.104.196 213.46.228.196

DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab

.

- - - - ORPHANS VERWIJDERD - - - -

.

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

SafeBoot-klmdb.sys

AddRemove-{bf769cf6-1953-4e23-8429-6937fc40b7f4} - c:\program files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-10-20 19:26

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-73586283-630328440-725345543-1003\Software\G*e*n*i*e*"!\FM Genie Scout 11]

"GameDir"="d:\\Programma's\\FM Genie Scout 11\\games"

"ShortlistDir"="d:\\Programma's\\FM Genie Scout 11\\shortlists"

"FMPath"=""

"ScreenshotsDir"="d:\\Programma's\\FM Genie Scout 11"

"SaveDir"="d:\\Programma's\\FM Genie Scout 11\\"

"HistoryDir"="d:\\Programma's\\FM Genie Scout 11\\History Points"

"LangDB"="d:\\Programma's\\FM Genie Scout 11\\lang_db.dat"

"LastSaveGame"="c:\\Documents and Settings\\Joost\\Mijn documenten\\Sports Interactive\\Football Manager 2011\\games\\JW_Spurs.fm"

"Language"="English"

"LoadLangDB"=dword:00000001

"CompressHistoryPoints"=dword:00000000

"HighlightedAttributes"=dword:00000000

"MinCondition"=dword:0000004b

"GraphStep"=dword:00000000

"SkinName"="PSV Eindhoven"

"LastUpdateCheck"=dword:00009f6c

"VersionOf"=dword:0000007b

"HighQualityGUI"=dword:00000001

"AutomaticallyUpdateCheck"=dword:00000001

"AdvancedGeneration"=dword:00000000

"TranslateStaffSkills"=dword:00000001

"TranslatePlayerSkills"=dword:00000001

"TranslatePositions"=dword:00000001

"ShowHistory"=dword:00000001

"Version"=dword:00000081

"UniqueID"="C4-F435-2813"

"Currency"=dword:00000056

"UseProxy"=dword:00000000

"ProxyHost"=""

"ProxyPort"=""

"UseAuthentication"=dword:00000000

"UserName"=""

"UserPassword"=""

"PlayerSearchFeatureNum"=dword:00000038

"StaffSearchFeatureNum"=dword:0000000f

"ClubSearchFeatureNum"=dword:00000021

"FilterByClubFeatureNum"=dword:0000004d

"CompareFeatureNum"=dword:00000000

"ShortlistFeatureNum"=dword:00000000

"ExportFeatureNum"=dword:00000000

"HistoryFeatureNum"=dword:00000000

"LanguageDBFeatureNum"=dword:00000052

"HintsFeatureNum"=dword:00000000

"GenieReportFeatureNum"=dword:00000005

"TopFormationFeatureNum"=dword:00000017

"ScreenshotFeatureNum"=dword:00000000

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'lsass.exe'(1104)

c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

.

- - - - - - - > 'explorer.exe'(1708)

c:\windows\system32\msi.dll

c:\windows\system32\webcheck.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\progra~1\AVG\AVG2012\avgrsx.exe

c:\program files\AVG\AVG2012\avgcsrvx.exe

c:\program files\Linksys\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

c:\program files\Linksys\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\RTHDCPL.EXE

c:\program files\Common Files\Java\Java Update\jucheck.exe

.

**************************************************************************

.

Voltooingstijd: 2011-10-20 19:33:07 - machine werd herstart

ComboFix-quarantined-files.txt 2011-10-20 17:33

.

Pre-Run: 18.368.139.264 bytes beschikbaar

Post-Run: 34.641.297.408 bytes beschikbaar

.

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

- - End Of File - - 728CBD8A9AD9A2874163972DD49408DA

kape · 20 oktober 2011

En wat heeft AVG nu te vertellen ? Nog steeds foutmeldingen ?

Vraagje : er zitten nog sporen van Norton/Symantec en AVAST op deze PC. Neem aan dat die niet meer actief zijn ? Dan kunnen die best ook verwijderd worden.

Dommel1984 · 20 oktober 2011

Whooo, het probleem lijkt opgelost. Ik heb de AVG2012 gedraaid en die gaf echt een enorme berg problemen weer. Die zijn allemaal hersteld/verwijderd. Daarna nog een keer "Malwarebytes' Anti-Malware" gedraaid. Die gaf geen probleem meer, het enige wat gebeurde was dat tijdens het draaien van de "Malwarebytes' Anti-Malware scan" AVG ineens dit probleem weer gaf

Uit de Malwarebytes' Anti-Malware scan kwam helemaal niks maar ik heb voor de zekerheid nogmaals AVG met een full-scan nu draaien.

Kun jij aangeven of die melding nog problemen kan opleveren? Daarnaast ben ik nog even benieuwd of ik met AVG2012 en Malwarebytes' Anti-Malware volledig gedekt ben tegen dergelijke problemen of dat ik nog aanvullende dingen moet installeren??

Alvast super bedankt voor dit alles want volgens mij werkt het weer helemaal zoals het hoort!!

kape · 20 oktober 2011

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop “avast! Antivirus”

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete “avast! Antivirus”

Druk op Enter.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\Tasks\Norton Security Scan for Joost.job

Folder::

c:\program files\AVAST Software

c:\documents and settings\Joost\Local Settings\Application Data\1378f99a

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

matlock123456789 · 20 oktober 2011

http://norton-removal-tool.nl.malavida.com/d1223-gratis-downloaden-windows 20 oktober 2011 aangepast door matlock123456789

Dommel1984 · 20 oktober 2011

Kape, hierbij de twee logs zoals je vroeg.

ComboFix

ComboFix 11-10-20.05 - Joost 20-10-2011 22:43:32.2.4 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.2943.2023 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Administrator\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Joost\Bureaublad\CFScript.txt

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

FILE ::

"c:\windows\Tasks\Norton Security Scan for Joost.job"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Joost\Local Settings\Application Data\1378f99a

c:\documents and settings\Joost\Local Settings\Application Data\1378f99a\@

c:\program files\AVAST Software

c:\program files\AVAST Software\Avast\Setup\setup.ini

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-09-20 to 2011-10-20 ))))))))))))))))))))))))))))))

.

2011-10-20 19:30 . 2011-10-20 19:30 -------- d-----w- c:\program files\MALWAREBYTES ANTI-MALWARE

2011-10-20 19:30 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-20 14:45 . 2011-10-20 14:53 -------- d-----w- c:\windows\system32\drivers\AVG

2011-10-19 17:34 . 2011-10-20 19:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2