virus

kape · 19 december 2011

Heb je Combofix uitgevoerd ? Dan mag je het logje in een volgend bericht hangen. Kunnen we eens meekijken of alles OK is ?

omervd · 20 december 2011

ComboFix 11-12-19.03 - gebruiker 20/12/2011 13:39:45.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.32.1043.18.1023.746 [GMT 1:00]

Gestart vanuit: c:\documents and settings\gebruiker\Bureaublad\ComboFix.exe

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\gebruiker\Application Data\28EB8

c:\documents and settings\gebruiker\Application Data\28EB8\53C60.exe

c:\documents and settings\gebruiker\Application Data\28EB8\82DC.8EB

c:\documents and settings\gebruiker\Application Data\facemoods.com

c:\documents and settings\gebruiker\Application Data\gebruikerlog.dat

c:\documents and settings\gebruiker\Application Data\nt.bat

c:\documents and settings\gebruiker\Application Data\system32

c:\documents and settings\gebruiker\Onlangs geopend\Thumbs.db

c:\program files\LP

c:\program files\LP\60C2\191.tmp

c:\program files\LP\60C2\192.tmp

c:\program files\LP\60C2\196.tmp

c:\program files\LP\60C2\199.tmp

c:\program files\LP\60C2\19A.exe

c:\program files\LP\60C2\19A.tmp

c:\program files\LP\60C2\19B.tmp

c:\program files\LP\60C2\19C.tmp

c:\program files\LP\60C2\19D.tmp

c:\program files\LP\60C2\1B7.tmp

c:\program files\LP\60C2\1BB.tmp

c:\program files\LP\60C2\1CF.tmp

c:\program files\LP\60C2\1D0.tmp

c:\program files\LP\60C2\1D1.tmp

c:\program files\LP\60C2\1E3.tmp

c:\program files\LP\60C2\1E4.tmp

c:\program files\LP\60C2\1E5.tmp

c:\program files\LP\60C2\1EB.tmp

c:\program files\LP\60C2\219.exe

c:\program files\LP\60C2\219.tmp

c:\program files\LP\60C2\238.tmp

c:\program files\LP\60C2\261.tmp

c:\program files\LP\60C2\284.tmp

c:\program files\LP\60C2\2B0.tmp

c:\program files\LP\60C2\2BA.exe

c:\program files\LP\60C2\2BA.tmp

c:\program files\LP\60C2\33D.tmp

c:\program files\LP\60C2\35B.tmp

c:\windows\$NtUninstallKB24118$\2148082112\@

c:\windows\$NtUninstallKB24118$\2148082112\L\ioxrmnuv

c:\windows\$NtUninstallKB24118$\2148082112\loader.tlb

c:\windows\$NtUninstallKB24118$\2148082112\U\@00000001

c:\windows\$NtUninstallKB24118$\2148082112\U\@000000c0

c:\windows\$NtUninstallKB24118$\2148082112\U\@000000cb

c:\windows\$NtUninstallKB24118$\2148082112\U\@000000cf

c:\windows\$NtUninstallKB24118$\2148082112\U\@80000000

c:\windows\$NtUninstallKB24118$\2148082112\U\@800000c0

c:\windows\$NtUninstallKB24118$\2148082112\U\@800000cb

c:\windows\$NtUninstallKB24118$\2148082112\U\@800000cf

c:\windows\$NtUninstallKB24118$\3995485614

c:\windows\alcrmv.exe

c:\windows\assembly\GAC_MSIL\desktop.ini

c:\windows\system32\

c:\windows\system32\A9C92CF056.dll

c:\windows\system32\install

c:\windows\system32\SET1A4.tmp

c:\windows\system32\SET1A8.tmp

c:\windows\system32\SET1B0.tmp

c:\windows\system32\windir

c:\windows\$NtUninstallKB24118$ . . . . konden niet verwijderd worden

.

Besmet exemplaar van c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\system volume information\_restore{005930A1-7C4A-4A97-89C6-909115EAE965}\RP387\A0075986.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-11-20 to 2011-12-20 ))))))))))))))))))))))))))))))

.

2011-12-20 12:25 . 2009-07-22 23:13 306 ----a-w- c:\windows\myClean.bat

2011-12-18 18:56 . 2011-12-18 18:56 -------- d-----w- c:\documents and settings\gebruiker\Application Data\Malwarebytes

2011-12-18 18:56 . 2011-12-18 18:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-12-18 18:56 . 2011-12-18 18:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-18 18:56 . 2011-08-31 16:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-18 10:33 . 2011-12-18 10:33 388096 ----a-r- c:\documents and settings\gebruiker\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-12-15 19:12 . 2011-12-15 19:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth

2011-12-12 20:24 . 2011-12-12 20:24 -------- d-----r- c:\documents and settings\LocalService\Favorieten

2011-12-11 15:39 . 2011-12-18 10:33 -------- d-----w- c:\program files\Trend Micro

2011-12-11 13:18 . 2011-12-11 13:18 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files

2011-12-11 12:59 . 2011-12-11 13:00 -------- d-----w- c:\documents and settings\Gast

2011-12-11 12:30 . 2011-12-11 13:19 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData

2011-12-06 16:03 . 2011-12-06 16:03 -------- d-sh--w- c:\documents and settings\LocalService\UserData

2011-12-06 15:56 . 2011-12-18 19:54 -------- d-sh--w- c:\documents and settings\gebruiker\Local Settings\Application Data\800921c0

2011-12-06 15:40 . 2011-12-18 19:32 -------- d-----w- c:\program files\B82DC

2011-12-05 18:40 . 2011-12-05 18:40 -------- d-----w- c:\documents and settings\gebruiker\Local Settings\Application Data\Help

2011-12-01 15:31 . 2011-12-01 15:32 -------- d-----w- c:\program files\Seterra

2011-11-20 22:14 . 2011-11-20 22:14 -------- d-----w- c:\program files\ADLSoft UnCompressor

2011-11-20 22:14 . 2011-11-20 22:14 -------- d-----w- c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon

2011-11-20 22:14 . 2011-11-20 22:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Babylon

2011-11-20 22:14 . 2011-11-20 22:14 -------- d-----w- c:\documents and settings\gebruiker\Application Data\Babylon

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-06 16:03 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe

2011-11-23 14:40 . 2008-04-14 20:05 1859712 ----a-w- c:\windows\system32\win32k.sys

2011-11-04 19:13 . 2008-04-14 20:32 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 19:13 . 2008-04-14 20:33 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-11-04 19:13 . 2008-04-14 20:32 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-04 11:25 . 2008-04-14 20:05 385024 ----a-w- c:\windows\system32\html.iec

2011-11-01 16:07 . 2008-04-14 20:32 1288192 ----a-w- c:\windows\system32\ole32.dll

2011-10-28 05:32 . 2008-04-14 20:32 33280 ----a-w- c:\windows\system32\csrsrv.dll

2011-10-18 11:13 . 2008-04-14 20:32 186880 ----a-w- c:\windows\system32\encdec.dll

2011-10-10 14:22 . 2010-09-10 16:35 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-10-03 03:06 . 2010-09-12 08:35 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-03 00:37 . 2010-09-12 08:35 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-09-28 07:06 . 2008-04-14 20:32 602624 ----a-w- c:\windows\system32\crypt32.dll

2011-09-26 09:41 . 2008-07-29 17:59 614912 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 09:41 . 2007-10-29 11:00 23040 ----a-w- c:\windows\system32\oleaccrc.dll

2011-09-26 09:41 . 2007-10-29 11:00 220160 ----a-w- c:\windows\system32\oleacc.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2009-11-02 . 497BEF5C5FAD126CA16437C1682F64EA . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-05-15 399736]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-02 1028096]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]

"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"_nltide_3"="advpack.dll" [2009-03-08 128512]

.

c:\documents and settings\gebruiker\Menu Start\Programma's\Opstarten\

Ubisoft register.lnk - c:\program files\UBISOFT\Register\schedule.exe [2010-11-30 28672]

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Documents and Settings\\gebruiker\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=

"c:\\Program Files\\Google\\Update\\GoogleUpdate.exe"=

"c:\\Documents and Settings\\gebruiker\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Program Files\\DivX\\DivX Update\\DivXUpdate.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=

"c:\\WINDOWS\\system32\\Adobe\\Shockwave 11\\SwHelper_1159620.exe"=

"c:\\WINDOWS\\system32\\dwwin.exe"=

.

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/11/2010 14:39 136176]

S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/11/2010 14:39 136176]

S3 pfsvgae;pfsvgae;\??\c:\docume~1\GEBRUI~1\LOCALS~1\Temp\pfsvgae.sys --> c:\docume~1\GEBRUI~1\LOCALS~1\Temp\pfsvgae.sys [?]

.

Inhoud van de 'Gedeelde Taken' map

.

2011-11-11 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

.

2011-12-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-12 13:39]

.

2011-12-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-12 13:39]

.

2011-12-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1677128483-1606980848-1003Core.job

- c:\documents and settings\gebruiker\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-03-16 13:39]

.

2011-12-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1677128483-1606980848-1003UA.job

- c:\documents and settings\gebruiker\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-03-16 13:39]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Free YouTube Download - c:\documents and settings\gebruiker\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

Trusted Zone: //about.htm/

Trusted Zone: //Exclude.htm/

Trusted Zone: //LanguageSelection.htm/

Trusted Zone: //Message.htm/

Trusted Zone: //MyAgttryCmd.htm/

Trusted Zone: //MyAgttryNag.htm/

Trusted Zone: //MyNotification.htm/

Trusted Zone: //NOCLessUpdate.htm/

Trusted Zone: //quarantine.htm/

Trusted Zone: //ScanNow.htm/

Trusted Zone: //strings.vbs/

Trusted Zone: //Template.htm/

Trusted Zone: //Update.htm/

Trusted Zone: //VirFound.htm/

Trusted Zone: mcafee.com\*

Trusted Zone: mcafeeasap.com\betavscan

Trusted Zone: mcafeeasap.com\vs

Trusted Zone: mcafeeasap.com\www

TCP: DhcpNameServer = 192.168.0.1

.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-Macromedia Shockwave Player - c:\windows\system32\Macromed\SHOCKW~1\UNWISE.EXE

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-12-20 14:46

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'explorer.exe'(2792)

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\program files\CDBurnerXP\NMSAccessU.exe

c:\windows\system32\wscntfy.exe

c:\windows\SOUNDMAN.EXE

c:\windows\system32\RUNDLL32.EXE

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Voltooingstijd: 2011-12-20 14:49:59 - machine werd herstart

ComboFix-quarantined-files.txt 2011-12-20 13:49

.

Pre-Run: 10.537.996.288 bytes beschikbaar

Post-Run: 12.003.733.504 bytes beschikbaar

.

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

- - End Of File - - 05D2518FD7D4EB0EE0D3E5FCA4EAF129

kape · 20 december 2011

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\documents and settings\gebruiker\Local Settings\Application Data\800921c0

c:\program files\B82DC

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon

c:\documents and settings\All Users\Application Data\Babylon

c:\documents and settings\gebruiker\Application Data\Babylon

Driver::

pfsvgae

Sla dit bestand op je bureaublad op als CFScript.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

omervd · 21 december 2011

Oke, zal ik doen!

omervd · 21 december 2011

ComboFix 11-12-21.01 - gebruiker 21/12/2011 14:11:39.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.32.1043.18.1023.551 [GMT 1:00]

Gestart vanuit: c:\documents and settings\gebruiker\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\gebruiker\Bureaublad\CFScript.txt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Babylon

c:\documents and settings\gebruiker\Application Data\Babylon

c:\documents and settings\gebruiker\Application Data\Babylon\log_file.txt

c:\documents and settings\gebruiker\Local Settings\Application Data\800921c0

c:\documents and settings\gebruiker\Local Settings\Application Data\800921c0\@

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\bab033.tbinst.dat

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\Babylon.dat

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\BabylonTBUpdater.dll

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\BabylonTBUpdater.exe

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\HtmlScreens\common.js

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\HtmlScreens\eula.html

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\HtmlScreens\page2.css

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\HtmlScreens\page2.html

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\HtmlScreens\page2.js

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\HtmlScreens\page2Lrg.css

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\HtmlScreens\title2.png

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\HtmlScreens\toolBar.jpg

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\MyBabylonTB.exe

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\Setup.exe

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\SetupStrings.dat

c:\documents and settings\gebruiker\Local Settings\Application Data\Babylon\Setup\sqlite3.dll

c:\program files\B82DC

c:\windows\system32\oobe\isperror

c:\windows\system32\oobe\isperror\ispcnerr.htm

c:\windows\system32\oobe\isperror\ispdtone.htm

c:\windows\system32\oobe\isperror\isphdshk.htm

c:\windows\system32\oobe\isperror\ispins.htm

c:\windows\system32\oobe\isperror\ispnoanw.htm

c:\windows\system32\oobe\isperror\isppberr.htm

c:\windows\system32\oobe\isperror\ispphbsy.htm

c:\windows\system32\oobe\isperror\ispsbusy.htm

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_PFSVGAE

-------\Service_pfsvgae

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-11-21 to 2011-12-21 ))))))))))))))))))))))))))))))