Torino

Dag Kape, inderdaad je hebt (weeral) gelijk, 't is opgelost. Nogmaals veel dank voor de assistentie, goed weekend!!!!!! T

Hallo Kape, heb gedaan wat je zei: ComboFix via start => uitvoeren => combofix / u. Combofix doet dan weer een analyse zoals voorheen en maakt een log aan, is dat wat je bedoelde? Ik bedoel, ik zie niet dat Combofix verwijderd werd door deze stap... Groetjes, T

Merk er in ieder geval niets meer van!!!!! Kan ik alle anti-virus programma's (Ad-Aware, AVG, Spybot) terug aanzetten? (moest die uitzetten om ComboFix te runnen). En dan maar hopen dat die pop-ups niet terugkeren... Je hebt me heel goed, duidelijk en snel geholpen, waarvoor ontzettend veel dank!!!!!! Groetjes

Dag Kape, Hieronder de Combofix log... Groetjes ComboFix 09-06-23.01 - ca309 24/06/2009 16:27.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.34.1033.18.502.258 [GMT 2:00] Running from: c:\documents and settings\ca309\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\ca309\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: FortiClient AntiVirus *On-access scanning disabled* (Updated) {C86EC76D-5A4C-40E7-BD94-59358E544D81} AV: Panda Antivirus Platinum 7 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0} FW: Panda Antivirus Platinum 7 *disabled* {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0} FILE :: "C:\a1Z58a.bat" "C:\ANV.bat" "C:\b95ZO.bat" "C:\bAoa5.bat" "C:\bfXHw.bat" "C:\BXiJ.bat" "C:\Bxue8L6.bat" "C:\Ce1p1.bat" "C:\Ckx.bat" "C:\CqmH.bat" "C:\cscT7ZI.bat" "C:\DCN3V3.bat" "C:\DfF.bat" "C:\DR6.bat" "C:\e1f.bat" "C:\EqD3UyiB.bat" "C:\Fa6tYf3z.bat" "C:\fYBJuxF.bat" "C:\GGAUq7H.bat" "C:\gWA.bat" "C:\H0l.exe" "C:\HCzgssU.bat" "C:\hDfC.bat" "C:\I4BWrOiF.bat" "C:\igyrrA1d.bat" "C:\IkhgG5g.bat" "C:\IT3bS41k.bat" "C:\J0tMjQl.bat" "C:\jn4Rt7p.bat" "C:\jRow83M.bat" "C:\JUeapgE.bat" "C:\jvmMd6KX.bat" "C:\jyfp.bat" "C:\k05U2f.bat" "C:\l6uI98ED.bat" "C:\Ml4Z.bat" "C:\mLQqn.bat" "C:\mME78bx1.bat" "C:\NKt8.bat" "C:\nwfXotW.bat" "C:\ofM.bat" "C:\PUxMA5rd.bat" "C:\qnOIv.bat" "C:\rbesiBnr.bat" "C:\rfJSLUF.bat" "C:\rFWb9C.bat" "C:\rsa3.bat" "C:\rX7Zwerz.bat" "C:\S8jMFtB.exe" "C:\sRr6So7G.bat" "C:\ss4LI.bat" "C:\Taa9ml3J.bat" "C:\tF5G7.bat" "C:\TrHkb.bat" "C:\u8Rv5.bat" "C:\Vc8noP.bat" "C:\VGw7VJ1.bat" "C:\viCnCTt.exe" "C:\vXUo.bat" "c:\windows\system32\1887270788.dat" "C:\WLFttP.exe" "C:\wUZLs.bat" "C:\X54L.bat" "C:\X5X1pq.bat" "C:\X7LjL.bat" "C:\x8qBZG3.bat" "C:\XrEc7zAx.bat" "C:\xyB.bat" "C:\xZU1r.bat" "C:\Y1e.bat" "C:\Y8n.bat" "C:\zx8BPR.bat" "C:\ZZAnDVw6.bat" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\a1Z58a.bat C:\ANV.bat C:\b95ZO.bat C:\bAoa5.bat C:\bfXHw.bat C:\BXiJ.bat C:\Bxue8L6.bat C:\Ce1p1.bat C:\Ckx.bat C:\CqmH.bat C:\cscT7ZI.bat C:\DCN3V3.bat C:\DfF.bat C:\DR6.bat C:\e1f.bat C:\EqD3UyiB.bat C:\Fa6tYf3z.bat C:\fYBJuxF.bat C:\GGAUq7H.bat C:\gWA.bat C:\H0l.exe C:\HCzgssU.bat C:\hDfC.bat C:\I4BWrOiF.bat C:\igyrrA1d.bat C:\IkhgG5g.bat C:\IT3bS41k.bat C:\J0tMjQl.bat C:\jn4Rt7p.bat C:\jRow83M.bat C:\JUeapgE.bat C:\jvmMd6KX.bat C:\jyfp.bat C:\k05U2f.bat C:\l6uI98ED.bat C:\Ml4Z.bat C:\mLQqn.bat C:\mME78bx1.bat C:\NKt8.bat C:\nwfXotW.bat C:\ofM.bat C:\PUxMA5rd.bat C:\qnOIv.bat C:\rbesiBnr.bat C:\rfJSLUF.bat C:\rFWb9C.bat C:\rsa3.bat C:\rX7Zwerz.bat C:\S8jMFtB.exe C:\sRr6So7G.bat C:\ss4LI.bat C:\Taa9ml3J.bat C:\tF5G7.bat C:\TrHkb.bat C:\u8Rv5.bat C:\Vc8noP.bat C:\VGw7VJ1.bat C:\viCnCTt.exe C:\vXUo.bat c:\windows\system32\1887270788.dat C:\WLFttP.exe C:\wUZLs.bat C:\X54L.bat C:\X5X1pq.bat C:\X7LjL.bat C:\x8qBZG3.bat C:\XrEc7zAx.bat C:\xyB.bat C:\xZU1r.bat C:\Y1e.bat C:\Y8n.bat C:\zx8BPR.bat C:\ZZAnDVw6.bat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_kpem ((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-06-24 ))))))))))))))))))))))))))))))) . 2009-06-24 12:31 . 2009-06-24 12:31 -------- dc----w- c:\windows\system32\dllcache\cache 2009-06-24 07:12 . 2009-06-24 07:12 -------- d-----w- c:\program files\Trend Micro 2009-06-22 14:34 . 2009-06-24 11:38 -------- dc-h--w- C:\$AVG8.VAULT$ 2009-06-22 13:08 . 2009-06-22 13:08 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-06-22 13:08 . 2009-06-22 13:08 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-06-22 13:08 . 2009-06-22 13:08 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-06-22 13:08 . 2009-06-22 13:08 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-06-22 13:07 . 2009-06-24 11:49 -------- d-----w- c:\windows\system32\drivers\Avg 2009-06-22 13:07 . 2009-06-22 13:07 -------- dc----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar 2009-06-22 08:19 . 2009-06-22 08:08 15688 ----a-w- c:\windows\system32\lsdelete.exe 2009-06-22 08:08 . 2009-06-22 08:07 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-06-22 08:08 . 2009-06-22 08:08 314200 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe 2009-06-22 08:08 . 2009-06-22 08:08 25440 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll 2009-06-22 08:08 . 2009-06-22 08:08 15688 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe 2009-06-22 08:08 . 2009-06-22 08:08 169312 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll 2009-06-22 08:06 . 2009-06-22 08:06 627536 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe 2009-06-22 08:06 . 2009-06-22 08:06 518488 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe 2009-06-22 08:06 . 2009-06-22 08:06 1003344 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe 2009-06-22 08:03 . 2009-06-22 08:03 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-06-22 08:03 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe 2009-06-22 08:02 . 2009-06-22 08:02 -------- dc----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-06-21 10:20 . 2009-06-21 10:20 -------- d-----w- c:\program files\CCleaner 2009-06-21 09:47 . 2009-06-21 09:47 -------- dc----w- c:\documents and settings\ca309\Application Data\Malwarebytes 2009-06-21 09:47 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-21 09:47 . 2009-06-21 09:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-21 09:47 . 2009-06-21 09:47 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-21 09:47 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-06-21 09:44 . 2009-06-21 09:44 -------- d--h--w- c:\windows\PIF 2009-06-20 22:50 . 2009-06-20 22:50 -------- dc----w- c:\documents and settings\ca309\Application Data\TeamViewer 2009-06-20 16:35 . 2009-06-20 16:36 -------- d-----w- c:\program files\Windows Live Safety Center 2009-06-20 16:08 . 2009-06-20 16:08 -------- dc----w- c:\documents and settings\ca309\temp 2009-06-20 15:24 . 2009-06-22 15:51 -------- d-----w- c:\program files\Protector 2009-06-20 15:23 . 2009-06-20 15:23 -------- dc----w- c:\documents and settings\ca309\Application Data\none . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-24 12:07 . 2006-03-16 17:24 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-22 15:55 . 2008-11-12 07:29 -------- dc----w- c:\documents and settings\All Users\Application Data\Avg8 2009-06-22 10:55 . 2006-03-16 11:52 -------- d-----w- c:\program files\Lavasoft 2009-06-22 10:55 . 2006-03-16 11:53 -------- dc----w- c:\documents and settings\ca309\Application Data\Lavasoft 2009-06-08 06:46 . 2008-11-14 18:23 -------- dc----w- c:\documents and settings\ca309\Application Data\ZoomBrowser EX 2009-06-08 06:45 . 2009-05-12 14:45 -------- dc----w- c:\documents and settings\ca309\Application Data\CameraWindowDC 2009-05-12 14:45 . 2009-05-12 14:45 -------- dc----w- c:\documents and settings\ca309\Application Data\CANON INC 2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-29 04:56 . 2004-08-04 12:00 827392 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:55 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-17 12:26 . 2004-08-04 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2004-08-04 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2006-12-29 14:15 . 2007-12-17 13:05 3100672 ----a-w- c:\program files\Common Files\sapxlhelper.dll 2006-12-29 14:15 . 2007-12-17 13:05 192512 ----a-w- c:\program files\Common Files\sapconsr3.dll 2006-12-29 14:15 . 2007-12-17 13:05 626688 ----a-w- c:\program files\Common Files\sapconsaccess.dll 2006-12-29 14:15 . 2007-12-17 13:05 40960 ----a-w- c:\program files\Common Files\DigitalSignature.ocx 2006-12-07 09:26 . 2007-12-17 13:05 1124864 ----a-w- c:\program files\Common Files\SAPActiveXL_nosig.xlt 2006-12-07 09:26 . 2007-12-17 13:05 1129984 ----a-w- c:\program files\Common Files\SAPActiveXL.xlt . ------- Sigcheck ------- [-] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys [-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys [-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys [-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtServicePackUninstall$\tcpip.sys [7] 2004-08-04 12:00 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB913446$\tcpip.sys [-] 2006-01-13 02:28 359808 583E063FDC888CA30D05C2724B0D7EF4 c:\windows\$NtUninstallKB917953$\tcpip.sys [-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys [7] 2008-04-13 22:50 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys [-] 2008-04-13 22:50 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows\ServicePackFiles\i386\tcpip.sys [-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\dllcache\tcpip.sys [-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( SnapShot@2009-06-24_12.28.51 ))))))))))))))))))))))))))))))))))))))))) . + 2009-06-24 12:31 . 2008-10-16 13:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe + 2009-06-24 12:31 . 2008-04-14 03:42 82432 c:\windows\system32\dllcache\cache\ws2_32.dll + 2009-06-24 12:31 . 2008-04-14 03:42 26112 c:\windows\system32\dllcache\cache\userinit.exe + 2009-06-24 12:31 . 2008-04-14 03:42 14336 c:\windows\system32\dllcache\cache\svchost.exe + 2009-06-24 12:31 . 2008-04-14 03:42 57856 c:\windows\system32\dllcache\cache\spoolsv.exe + 2009-06-24 12:31 . 2008-04-14 03:42 17408 c:\windows\system32\dllcache\cache\powrprof.dll + 2009-06-24 12:31 . 2008-04-14 03:42 13312 c:\windows\system32\dllcache\cache\lsass.exe + 2009-06-24 12:31 . 2008-04-13 22:09 24576 c:\windows\system32\dllcache\cache\kbdclass.sys + 2009-06-24 12:31 . 2008-04-13 22:23 36608 c:\windows\system32\dllcache\cache\ip6fw.sys + 2009-06-24 12:31 . 2008-04-14 03:42 15360 c:\windows\system32\dllcache\cache\ctfmon.exe + 2009-06-24 12:31 . 2008-04-14 03:42 507904 c:\windows\system32\dllcache\cache\winlogon.exe + 2009-06-24 12:31 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll + 2009-06-24 12:31 . 2008-04-14 03:42 578560 c:\windows\system32\dllcache\cache\user32.dll + 2009-06-24 12:31 . 2008-04-14 03:42 295424 c:\windows\system32\dllcache\cache\termsrv.dll + 2009-06-24 12:31 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe + 2009-06-24 12:31 . 2008-04-13 22:50 182656 c:\windows\system32\dllcache\cache\ndis.sys + 2009-06-24 12:31 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll + 2009-06-24 12:31 . 2008-04-14 03:41 110080 c:\windows\system32\dllcache\cache\imm32.dll + 2009-06-24 12:31 . 2008-04-14 03:41 167936 c:\windows\system32\dllcache\cache\appmgmts.dll + 2009-06-24 12:31 . 2008-04-14 03:42 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll + 2009-06-24 12:31 . 2009-02-06 11:08 2189056 c:\windows\system32\dllcache\cache\ntoskrnl.exe + 2009-06-24 12:31 . 2009-02-07 17:02 2066048 c:\windows\system32\dllcache\cache\ntkrnlpa.exe + 2009-06-24 12:31 . 2008-04-14 03:42 1033728 c:\windows\system32\dllcache\cache\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-06-14 14:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2007-08-10 110592] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-08-10 512000] "PRONoMgrWired"="c:\program files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2003-08-06 86016] "BMMLREF"="c:\program files\ThinkPad\Utilities\BMMLREF.EXE" [2005-04-19 20480] "QCWLICON"="c:\program files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2005-03-18 86016] "SpeedTouch USB Diagnostics"="c:\program files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2002-11-12 860672] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-07-14 57344] "BMMMONWND"="c:\progra~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2005-04-19 396288] "BMMGAG"="c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2005-04-19 110592] "BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-04-19 208896] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-22 518488] "MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-22 1948440] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-06-22 13:08 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] 2003-10-31 09:01 8704 ----a-w- c:\windows\system32\PCANotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina] 2005-03-18 01:07 262144 ----a-w- c:\windows\system32\QConGina.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2004-08-12 18:11 24576 ----a-w- c:\windows\system32\tphklock.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "dnlsvc"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "TpKmpSVC"=2 (0x2) "SoundMAX Agent Service (default)"=2 (0x2) "ose"=3 (0x3) "MDM"=2 (0x2) "IBMPMSVC"=2 (0x2) "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Symantec\\pcAnywhere\\WinAw32.exe"= "c:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"= "c:\\Program Files\\SAP\\FrontEnd\\SAPgui\\saplogon.exe"= "c:\\FTPCAMPER\\FTPCamper.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "8484:TCP"= 8484:TCP:TINYPROXY "53:TCP"= 53:TCP:TINYPROXY R0 EFlashAssist;EFlashAssist;c:\windows\system32\drivers\EFLASHAS.SYS [18/07/2005 22:49 8476] R0 FAFileMon;Fortinet FMonitor;c:\windows\system32\drivers\fortimon.sys [28/06/2005 12:46 17664] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [22/06/2009 10:08 64160] R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [18/07/2005 22:45 59776] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [22/06/2009 15:08 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [22/06/2009 15:08 108552] R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [18/07/2005 22:45 4608] R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [18/07/2005 22:44 16384] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [22/06/2009 15:07 298776] R3 QCNDISIF;QCNDISIF;c:\windows\system32\drivers\qcndisif.sys [18/07/2005 22:48 12288] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1003344] . Contents of the 'Scheduled Tasks' folder 2009-06-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 08:07] 2009-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 16:13] 2005-07-18 c:\windows\Tasks\BMMTask.job - c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2005-07-18 23:38] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.skynet.be/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyServer = http=127.0.0.1:8484 DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2009-06-24 16:35 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1104) c:\windows\system32\tphklock.dll - - - - - - - > 'explorer.exe'(3656) c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\program files\AVG\AVG8\avgtray.exe c:\windows\system32\HPZipm12.exe c:\windows\system32\QCONSVC.EXE c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\system32\TPHDEXLG.exe c:\windows\system32\wscntfy.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\Canon\CAL\CALMAIN.exe . ************************************************************************** . Completion time: 2009-06-24 16:39 - machine was rebooted ComboFix-quarantined-files.txt 2009-06-24 14:39 ComboFix2.txt 2009-06-24 12:55 ComboFix3.txt 2009-06-24 12:33 Pre-Run: 14.288.650.240 bytes free Post-Run: 14.290.194.432 bytes free 393 --- E O F --- 2009-06-10 15:40

Hallo Kape, Bedankt, sorry dat ik zo lang wacht met mijn reacties maar ik moet telkens de tijd vinden. Maar 't is dus eindelijk achter de rug (leer je wel mee bij, amai) ; hieronder de log van Combofix en de recentste log van HiJackThis. ComboFix 09-06-23.01 - ca309 24/06/2009 14:48.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.34.1033.18.502.161 [GMT 2:00] Running from: c:\documents and settings\ca309\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\ca309\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: FortiClient AntiVirus *On-access scanning disabled* (Updated) {C86EC76D-5A4C-40E7-BD94-59358E544D81} AV: Panda Antivirus Platinum 7 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0} FW: Panda Antivirus Platinum 7 *disabled* {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0} . ((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-06-24 ))))))))))))))))))))))))))))))) . 2009-06-24 12:31 . 2009-06-24 12:31 -------- dc----w- c:\windows\system32\dllcache\cache 2009-06-24 11:51 . 2009-06-24 11:51 328704 -c--a-w- C:\H0l.exe 2009-06-24 11:51 . 2009-06-24 11:51 6998 -c--a-w- C:\rbesiBnr.bat 2009-06-24 11:51 . 2009-06-24 11:51 231 -c--a-w- C:\GGAUq7H.bat 2009-06-24 11:47 . 2009-06-24 11:47 6998 -c--a-w- C:\X5X1pq.bat 2009-06-24 11:47 . 2009-06-24 11:47 239 -c--a-w- C:\Ce1p1.bat 2009-06-24 11:37 . 2009-06-24 11:37 6998 -c--a-w- C:\hDfC.bat 2009-06-24 11:37 . 2009-06-24 11:37 251 -c--a-w- C:\EqD3UyiB.bat 2009-06-24 07:43 . 2009-06-24 07:43 6998 -c--a-w- C:\rFWb9C.bat 2009-06-24 07:43 . 2009-06-24 07:43 238 -c--a-w- C:\cscT7ZI.bat 2009-06-24 07:28 . 2009-06-24 07:28 6998 -c--a-w- C:\b95ZO.bat 2009-06-24 07:28 . 2009-06-24 07:28 239 -c--a-w- C:\Bxue8L6.bat 2009-06-24 07:12 . 2009-06-24 07:12 -------- d-----w- c:\program files\Trend Micro 2009-06-24 07:08 . 2009-06-24 07:08 6998 -c--a-w- C:\u8Rv5.bat 2009-06-24 07:08 . 2009-06-24 07:08 247 -c--a-w- C:\DR6.bat 2009-06-24 06:59 . 2009-06-24 06:59 6998 -c--a-w- C:\TrHkb.bat 2009-06-24 06:59 . 2009-06-24 06:59 235 -c--a-w- C:\X7LjL.bat 2009-06-24 06:50 . 2009-06-24 06:50 6998 -c--a-w- C:\XrEc7zAx.bat 2009-06-24 06:49 . 2009-06-24 06:49 262 -c--a-w- C:\Fa6tYf3z.bat 2009-06-22 16:20 . 2009-06-22 16:20 328704 -c--a-w- C:\viCnCTt.exe 2009-06-22 16:20 . 2009-06-22 16:20 6998 -c--a-w- C:\sRr6So7G.bat 2009-06-22 16:20 . 2009-06-22 16:20 266 -c--a-w- C:\PUxMA5rd.bat 2009-06-22 16:08 . 2009-06-22 16:08 328704 -c--a-w- C:\S8jMFtB.exe 2009-06-22 16:07 . 2009-06-22 16:07 6998 -c--a-w- C:\Taa9ml3J.bat 2009-06-22 16:07 . 2009-06-22 16:07 268 -c--a-w- C:\ss4LI.bat 2009-06-22 16:05 . 2009-06-22 16:05 6998 -c--a-w- C:\J0tMjQl.bat 2009-06-22 16:04 . 2009-06-22 16:04 257 -c--a-w- C:\x8qBZG3.bat 2009-06-22 14:34 . 2009-06-24 11:38 -------- dc-h--w- C:\$AVG8.VAULT$ 2009-06-22 13:09 . 2009-06-22 13:12 50400 -c--a-w- C:\WLFttP.exe 2009-06-22 13:09 . 2009-06-22 13:09 6998 -c--a-w- C:\igyrrA1d.bat 2009-06-22 13:09 . 2009-06-22 13:09 255 -c--a-w- C:\Vc8noP.bat 2009-06-22 13:08 . 2009-06-22 13:08 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-06-22 13:08 . 2009-06-22 13:08 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-06-22 13:08 . 2009-06-22 13:08 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-06-22 13:08 . 2009-06-22 13:08 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-06-22 13:07 . 2009-06-24 11:49 -------- d-----w- c:\windows\system32\drivers\Avg 2009-06-22 13:07 . 2009-06-22 13:07 -------- dc----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar 2009-06-22 12:58 . 2009-06-22 12:58 6998 -c--a-w- C:\ZZAnDVw6.bat 2009-06-22 12:58 . 2009-06-22 12:58 240 -c--a-w- C:\zx8BPR.bat 2009-06-22 12:44 . 2009-06-22 12:44 6998 -c--a-w- C:\fYBJuxF.bat 2009-06-22 12:44 . 2009-06-22 12:44 243 -c--a-w- C:\VGw7VJ1.bat 2009-06-22 12:40 . 2009-06-22 12:40 6998 -c--a-w- C:\CqmH.bat 2009-06-22 12:40 . 2009-06-22 12:40 264 -c--a-w- C:\nwfXotW.bat 2009-06-22 12:05 . 2009-06-22 12:05 6998 -c--a-w- C:\Ckx.bat 2009-06-22 12:05 . 2009-06-22 12:05 264 -c--a-w- C:\IkhgG5g.bat 2009-06-22 12:04 . 2009-06-22 12:04 6998 -c--a-w- C:\jyfp.bat 2009-06-22 12:04 . 2009-06-22 12:04 239 -c--a-w- C:\Y1e.bat 2009-06-22 12:02 . 2009-06-22 12:02 6998 -c--a-w- C:\BXiJ.bat 2009-06-22 12:02 . 2009-06-22 12:02 258 -c--a-w- C:\wUZLs.bat 2009-06-22 08:47 . 2009-06-22 08:47 6998 -c--a-w- C:\I4BWrOiF.bat 2009-06-22 08:47 . 2009-06-22 08:47 262 -c--a-w- C:\a1Z58a.bat 2009-06-22 08:41 . 2009-06-22 08:41 6998 -c--a-w- C:\gWA.bat 2009-06-22 08:41 . 2009-06-22 08:41 241 -c--a-w- C:\ANV.bat 2009-06-22 08:28 . 2009-06-22 08:28 6998 -c--a-w- C:\k05U2f.bat 2009-06-22 08:28 . 2009-06-22 08:28 234 -c--a-w- C:\Ml4Z.bat 2009-06-22 08:19 . 2009-06-22 08:08 15688 ----a-w- c:\windows\system32\lsdelete.exe 2009-06-22 08:08 . 2009-06-22 08:07 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-06-22 08:08 . 2009-06-22 08:08 314200 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe 2009-06-22 08:08 . 2009-06-22 08:08 25440 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll 2009-06-22 08:08 . 2009-06-22 08:08 15688 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe 2009-06-22 08:08 . 2009-06-22 08:08 169312 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll 2009-06-22 08:06 . 2009-06-22 08:06 627536 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe 2009-06-22 08:06 . 2009-06-22 08:06 518488 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe 2009-06-22 08:06 . 2009-06-22 08:06 1003344 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe 2009-06-22 08:03 . 2009-06-22 08:03 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-06-22 08:03 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe 2009-06-22 08:02 . 2009-06-22 08:02 -------- dc----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-06-22 07:57 . 2009-06-22 07:57 6998 -c--a-w- C:\DfF.bat 2009-06-22 07:57 . 2009-06-22 07:57 239 -c--a-w- C:\rsa3.bat 2009-06-22 07:07 . 2009-06-22 07:07 6998 -c--a-w- C:\JUeapgE.bat 2009-06-22 07:07 . 2009-06-22 07:07 231 -c--a-w- C:\tF5G7.bat 2009-06-21 11:44 . 2009-06-21 11:44 6998 -c--a-w- C:\vXUo.bat 2009-06-21 11:44 . 2009-06-21 11:44 275 -c--a-w- C:\mLQqn.bat 2009-06-21 11:28 . 2009-06-21 11:28 6998 -c--a-w- C:\qnOIv.bat 2009-06-21 11:28 . 2009-06-21 11:28 268 -c--a-w- C:\X54L.bat 2009-06-21 11:08 . 2009-06-21 11:08 6998 -c--a-w- C:\rX7Zwerz.bat 2009-06-21 11:08 . 2009-06-21 11:08 239 -c--a-w- C:\jvmMd6KX.bat 2009-06-21 10:45 . 2009-06-21 10:45 6998 -c--a-w- C:\xZU1r.bat 2009-06-21 10:45 . 2009-06-21 10:45 255 -c--a-w- C:\l6uI98ED.bat 2009-06-21 10:38 . 2009-06-21 10:38 6998 -c--a-w- C:\rfJSLUF.bat 2009-06-21 10:38 . 2009-06-21 10:38 250 -c--a-w- C:\IT3bS41k.bat 2009-06-21 10:28 . 2009-06-21 10:28 6998 -c--a-w- C:\bfXHw.bat 2009-06-21 10:28 . 2009-06-21 10:28 248 -c--a-w- C:\Y8n.bat 2009-06-21 10:20 . 2009-06-21 10:20 -------- d-----w- c:\program files\CCleaner 2009-06-21 09:47 . 2009-06-21 09:47 -------- dc----w- c:\documents and settings\ca309\Application Data\Malwarebytes 2009-06-21 09:47 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-21 09:47 . 2009-06-21 09:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-21 09:47 . 2009-06-21 09:47 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-21 09:47 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-06-21 09:44 . 2009-06-21 09:44 -------- d--h--w- c:\windows\PIF 2009-06-20 22:50 . 2009-06-20 22:50 -------- dc----w- c:\documents and settings\ca309\Application Data\TeamViewer 2009-06-20 16:35 . 2009-06-20 16:36 -------- d-----w- c:\program files\Windows Live Safety Center 2009-06-20 16:08 . 2009-06-20 16:08 -------- dc----w- c:\documents and settings\ca309\temp 2009-06-20 15:56 . 2009-06-20 15:56 6998 -c--a-w- C:\e1f.bat 2009-06-20 15:56 . 2009-06-20 15:56 248 -c--a-w- C:\bAoa5.bat 2009-06-20 15:46 . 2009-06-20 15:46 6998 -c--a-w- C:\DCN3V3.bat 2009-06-20 15:46 . 2009-06-20 15:46 255 -c--a-w- C:\ofM.bat 2009-06-20 15:42 . 2009-06-20 15:42 6998 -c--a-w- C:\xyB.bat 2009-06-20 15:42 . 2009-06-20 15:42 245 -c--a-w- C:\NKt8.bat 2009-06-20 15:30 . 2009-06-20 15:30 6998 -c--a-w- C:\jn4Rt7p.bat 2009-06-20 15:30 . 2009-06-20 15:30 270 -c--a-w- C:\mME78bx1.bat 2009-06-20 15:24 . 2009-06-22 15:51 -------- d-----w- c:\program files\Protector 2009-06-20 15:23 . 2009-06-20 15:23 6998 -c--a-w- C:\jRow83M.bat 2009-06-20 15:23 . 2009-06-20 15:23 269 -c--a-w- C:\HCzgssU.bat 2009-06-20 15:23 . 2009-06-20 15:23 -------- dc----w- c:\documents and settings\ca309\Application Data\none 2009-06-20 14:36 . 2009-06-20 14:43 109 --sha-w- c:\windows\system32\1887270788.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-24 12:07 . 2006-03-16 17:24 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-22 15:55 . 2008-11-12 07:29 -------- dc----w- c:\documents and settings\All Users\Application Data\Avg8 2009-06-22 10:55 . 2006-03-16 11:52 -------- d-----w- c:\program files\Lavasoft 2009-06-22 10:55 . 2006-03-16 11:53 -------- dc----w- c:\documents and settings\ca309\Application Data\Lavasoft 2009-06-08 06:46 . 2008-11-14 18:23 -------- dc----w- c:\documents and settings\ca309\Application Data\ZoomBrowser EX 2009-06-08 06:45 . 2009-05-12 14:45 -------- dc----w- c:\documents and settings\ca309\Application Data\CameraWindowDC 2009-05-12 14:45 . 2009-05-12 14:45 -------- dc----w- c:\documents and settings\ca309\Application Data\CANON INC 2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-29 04:56 . 2004-08-04 12:00 827392 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:55 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-17 12:26 . 2004-08-04 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2004-08-04 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2006-12-29 14:15 . 2007-12-17 13:05 3100672 ----a-w- c:\program files\Common Files\sapxlhelper.dll 2006-12-29 14:15 . 2007-12-17 13:05 192512 ----a-w- c:\program files\Common Files\sapconsr3.dll 2006-12-29 14:15 . 2007-12-17 13:05 626688 ----a-w- c:\program files\Common Files\sapconsaccess.dll 2006-12-29 14:15 . 2007-12-17 13:05 40960 ----a-w- c:\program files\Common Files\DigitalSignature.ocx 2006-12-07 09:26 . 2007-12-17 13:05 1124864 ----a-w- c:\program files\Common Files\SAPActiveXL_nosig.xlt 2006-12-07 09:26 . 2007-12-17 13:05 1129984 ----a-w- c:\program files\Common Files\SAPActiveXL.xlt . ------- Sigcheck ------- [-] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys [-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys [-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys [7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys [-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtServicePackUninstall$\tcpip.sys [7] 2004-08-04 12:00 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB913446$\tcpip.sys [-] 2006-01-13 02:28 359808 583E063FDC888CA30D05C2724B0D7EF4 c:\windows\$NtUninstallKB917953$\tcpip.sys [-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys [7] 2008-04-13 22:50 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys [-] 2008-04-13 22:50 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows\ServicePackFiles\i386\tcpip.sys [-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\dllcache\tcpip.sys [-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( SnapShot@2009-06-24_12.28.51 ))))))))))))))))))))))))))))))))))))))))) . + 2009-06-24 12:31 . 2008-10-16 13:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe + 2009-06-24 12:31 . 2008-04-14 03:42 82432 c:\windows\system32\dllcache\cache\ws2_32.dll + 2009-06-24 12:31 . 2008-04-14 03:42 26112 c:\windows\system32\dllcache\cache\userinit.exe + 2009-06-24 12:31 . 2008-04-14 03:42 14336 c:\windows\system32\dllcache\cache\svchost.exe + 2009-06-24 12:31 . 2008-04-14 03:42 57856 c:\windows\system32\dllcache\cache\spoolsv.exe + 2009-06-24 12:31 . 2008-04-14 03:42 17408 c:\windows\system32\dllcache\cache\powrprof.dll + 2009-06-24 12:31 . 2008-04-14 03:42 13312 c:\windows\system32\dllcache\cache\lsass.exe + 2009-06-24 12:31 . 2008-04-13 22:09 24576 c:\windows\system32\dllcache\cache\kbdclass.sys + 2009-06-24 12:31 . 2008-04-13 22:23 36608 c:\windows\system32\dllcache\cache\ip6fw.sys + 2009-06-24 12:31 . 2008-04-14 03:42 15360 c:\windows\system32\dllcache\cache\ctfmon.exe + 2009-06-24 12:31 . 2008-04-14 03:42 507904 c:\windows\system32\dllcache\cache\winlogon.exe + 2009-06-24 12:31 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll + 2009-06-24 12:31 . 2008-04-14 03:42 578560 c:\windows\system32\dllcache\cache\user32.dll + 2009-06-24 12:31 . 2008-04-14 03:42 295424 c:\windows\system32\dllcache\cache\termsrv.dll + 2009-06-24 12:31 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe + 2009-06-24 12:31 . 2008-04-13 22:50 182656 c:\windows\system32\dllcache\cache\ndis.sys + 2009-06-24 12:31 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll + 2009-06-24 12:31 . 2008-04-14 03:41 110080 c:\windows\system32\dllcache\cache\imm32.dll + 2009-06-24 12:31 . 2008-04-14 03:41 167936 c:\windows\system32\dllcache\cache\appmgmts.dll + 2009-06-24 12:31 . 2008-04-14 03:42 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll + 2009-06-24 12:31 . 2009-02-06 11:08 2189056 c:\windows\system32\dllcache\cache\ntoskrnl.exe + 2009-06-24 12:31 . 2009-02-07 17:02 2066048 c:\windows\system32\dllcache\cache\ntkrnlpa.exe + 2009-06-24 12:31 . 2008-04-14 03:42 1033728 c:\windows\system32\dllcache\cache\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-06-14 14:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2007-08-10 110592] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-08-10 512000] "PRONoMgrWired"="c:\program files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2003-08-06 86016] "BMMLREF"="c:\program files\ThinkPad\Utilities\BMMLREF.EXE" [2005-04-19 20480] "QCWLICON"="c:\program files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2005-03-18 86016] "SpeedTouch USB Diagnostics"="c:\program files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2002-11-12 860672] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-07-14 57344] "BMMMONWND"="c:\progra~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2005-04-19 396288] "BMMGAG"="c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2005-04-19 110592] "BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-04-19 208896] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-22 518488] "MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-22 1948440] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-06-22 13:08 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] 2003-10-31 09:01 8704 ----a-w- c:\windows\system32\PCANotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina] 2005-03-18 01:07 262144 ----a-w- c:\windows\system32\QConGina.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2004-08-12 18:11 24576 ----a-w- c:\windows\system32\tphklock.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "dnlsvc"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "TpKmpSVC"=2 (0x2) "SoundMAX Agent Service (default)"=2 (0x2) "ose"=3 (0x3) "MDM"=2 (0x2) "IBMPMSVC"=2 (0x2) "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Symantec\\pcAnywhere\\WinAw32.exe"= "c:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"= "c:\\Program Files\\SAP\\FrontEnd\\SAPgui\\saplogon.exe"= "c:\\FTPCAMPER\\FTPCamper.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "8484:TCP"= 8484:TCP:TINYPROXY "53:TCP"= 53:TCP:TINYPROXY R0 EFlashAssist;EFlashAssist;c:\windows\system32\drivers\EFLASHAS.SYS [18/07/2005 22:49 8476] R0 FAFileMon;Fortinet FMonitor;c:\windows\system32\drivers\fortimon.sys [28/06/2005 12:46 17664] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [22/06/2009 10:08 64160] R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [18/07/2005 22:45 59776] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [22/06/2009 15:08 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [22/06/2009 15:08 108552] R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [18/07/2005 22:45 4608] R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [18/07/2005 22:44 16384] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [22/06/2009 15:07 298776] R3 QCNDISIF;QCNDISIF;c:\windows\system32\drivers\qcndisif.sys [18/07/2005 22:48 12288] S1 kpem;kpem; [x] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1003344] . Contents of the 'Scheduled Tasks' folder 2009-06-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 08:07] 2009-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 16:13] 2005-07-18 c:\windows\Tasks\BMMTask.job - c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2005-07-18 23:38] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.skynet.be/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyServer = http=127.0.0.1:8484 DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2009-06-24 14:53 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1104) c:\windows\system32\tphklock.dll - - - - - - - > 'explorer.exe'(3384) c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll . Completion time: 2009-06-24 14:55 ComboFix-quarantined-files.txt 2009-06-24 12:55 ComboFix2.txt 2009-06-24 12:33 Pre-Run: 14.294.966.272 bytes free Post-Run: 14.296.428.544 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 302 --- E O F --- 2009-06-10 15:40 HiJackThis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:00:26, on 24/06/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16850) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\RunDll32.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\QCONSVC.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TPHDEXLG.EXE C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\ca309\Local Settings\temp\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Skynet.be - LE portail belge – DE Belgische portaalsite! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8484 R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [bMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [bMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [bLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96C8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Servicio de host de pcAnywhere (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE -- End of file - 6917 bytes Weeral: bedankt! Groetjes, Torino

Hallo Kape, Bedankt voor je snelle reactie. Ik heb je instructies opgevolgd, hieronder vind je de logs. HiJackThis heb ik laten lopen na nieuwe opstart. Blijkbaar is nog niet alles opgelost want terwijl ik dit typ krijg ik pop-ups die me vertellen dat bepaalde .exe files (bijv. MflzpF.exe) niet kunnen opstarten, en die me vragen te kiezen tussen "close" en "debug". HiJackThis Logfile of HijackThis v1.99.1 Scan saved at 18:04:49, on 22/06/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16850) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\QCONSVC.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TPHDEXLG.EXE C:\Program Files\Canon\CAL\CALMAIN.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\WINDOWS\System32\mshta.exe C:\Documents and Settings\ca309\Local Settings\Temp\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Skynet.be - LE portail belge – DE Belgische portaalsite! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8484 R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [bMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [bMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [bLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96C8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Servicio de host de pcAnywhere (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE MbAM Malwarebytes' Anti-Malware 1.38 Database versie: 2322 Windows 5.1.2600 Service Pack 3 22/06/2009 17:51:43 mbam-log-2009-06-22 (17-51-43).txt Scan type: Snelle Scan Objecten gescand: 129002 Verstreken tijd: 39 minute(s), 2 second(s) Geheugenprocessen geïnfecteerd: 3 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 0 Registerwaarden geïnfecteerd: 0 Registerdata bestanden geïnfecteerd: 0 Mappen geïnfecteerd: 0 Bestanden geïnfecteerd: 5 Geheugenprocessen geïnfecteerd: c:\igb9.exe (Trojan.Downloader) -> Unloaded process successfully. c:\igb9.exe (Trojan.Downloader) -> Unloaded process successfully. c:\igb9.exe (Trojan.Downloader) -> Unloaded process successfully. Geheugenmodulen geïnfecteerd: (Geen kwaadaardige items gevonden) Registersleutels geïnfecteerd: (Geen kwaadaardige items gevonden) Registerwaarden geïnfecteerd: (Geen kwaadaardige items gevonden) Registerdata bestanden geïnfecteerd: (Geen kwaadaardige items gevonden) Mappen geïnfecteerd: (Geen kwaadaardige items gevonden) Bestanden geïnfecteerd: c:\igb9.exe (Trojan.Downloader) -> Quarantined and deleted successfully. c:\mQcKuk.exe (Trojan.Downloader) -> Quarantined and deleted successfully. c:\cpQL.exe (Trojan.Downloader) -> Quarantined and deleted successfully. c:\yDwK.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Program Files\Protector\sound.wav (Rogue.Terminator2009) -> Quarantined and deleted successfully. Op hoop van zegen.. tot later en nogmaals bedankt voor de hulp! T

Hallo, Gisteren is mijn PC geïnfecteerd geraakt met naar ik vermoed het "security service" virus. Enkel Internet Explorer werkte nog. Ik heb al wat info gelezen op deze website en heb op basis daarvan het volgende reeds gedaan: - Hijackthis laten lopen en log gesaved; - MbAM gedownload en laten lopen (en de richtlijnen gevolgd: snelle scan, verwijderen, etc...) En dan CCleaner gedownload en laten lopen. Het lijkt nu beter maar bij opstart verschijnt nog steeds het scherm "STOP" security warning van security services. Als ik dan de task manager opendoe om dit programma te beëindigen zie ik "Terminator - running" staan. Ik stop dit programma en dan start de computer verder op en beland ik op mijn desktop. Af en toe krijg ik nog pop-ups met melding dat een bepaald programma "......exe" moet afsluiten wegens problemen, ik krijg dan de keuze tussen debug of close. Hieronder voeg ik de laatste logs toe van HijackThis en MbAM. Zou het mogelijk zijn hier eens naar te kijken? Zijn er misschien nog zaken die verwijderd moeten worden? Alvast bedankt voor de hulp!!! HiJackThis: Logfile of HijackThis v1.99.1 Scan saved at 14:09:50, on 21/06/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16850) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\System32\QCONSVC.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TPHDEXLG.EXE C:\WINDOWS\system32\TpKmpSVC.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\svchost.exe c:\ERk6K.exe c:\ERk6K.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE c:\ERk6K.exe c:\ERk6K.exe c:\ERk6K.exe C:\WINDOWS\explorer.exe c:\SJl7rCfR.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\ca309\Local Settings\Temp\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Skynet.be - LE portail belge – DE Belgische portaalsite! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8484 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local> O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [bMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [bMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [bLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\RunOnce: [Protector] C:\Program Files\Protector\protector.exe -startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [gamma] c:\z_Drivers\svchost.exe O4 - HKCU\..\Run: [DDriver] c:\z_Drivers\svchost.exe O4 - HKCU\..\Run: [CDriver] c:\z_Drivers\svchost.exe O4 - HKCU\..\Run: [beta] c:\z_Drivers\svchost.exe O4 - HKCU\..\Run: [alpha] c:\z_Drivers\svchost.exe O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96C8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll O20 - Winlogon Notify: ssqRHBQh - ssqRHBQh.dll (file missing) O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Servicio de host de pcAnywhere (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe MbAM: Malwarebytes' Anti-Malware 1.38 Database versie: 2297 Windows 5.1.2600 Service Pack 3 21/06/2009 12:07:31 mbam-log-2009-06-21 (12-07-31).txt Scan type: Snelle Scan Objecten gescand: 122801 Verstreken tijd: 18 minute(s), 23 second(s) Geheugenprocessen geïnfecteerd: 0 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 12 Registerwaarden geïnfecteerd: 54 Registerdata bestanden geïnfecteerd: 2 Mappen geïnfecteerd: 4 Bestanden geïnfecteerd: 74 Geheugenprocessen geïnfecteerd: (Geen kwaadaardige items gevonden) Geheugenmodulen geïnfecteerd: (Geen kwaadaardige items gevonden) Registersleutels geïnfecteerd: HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\systemsecurity2009 (Rogue.SystemSecurity) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\dnlsvc (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\msdirect (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully. Registerwaarden geïnfecteerd: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\amoumain (Trojan.FakeAlert.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16918084 (Rogue.Multiple.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\96928076 (Rogue.Multiple.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odby (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netc (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\alg (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskmg (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\servicelayer (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sms (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netx (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netw (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdmon (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysberay2 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ddriver (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alpha (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\beta (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gamma (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\OLE\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\System\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverCheck (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemDriverLoad (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemDriver (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FDriver (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ADriver (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverLoad (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DriverLoad (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DriverCheck (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SystemDriverLoad (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost1 (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost2 (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost3 (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost4 (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\FDriver (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ADriver (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msn (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msnhost (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msnload (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msnconvert (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msnmessendger (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SystemDriver (Trojan.Clicker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass (Trojan.Alphabet) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cdriver (Trojan.Agent) -> Quarantined and deleted successfully. Registerdata bestanden geïnfecteerd: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully. Mappen geïnfecteerd: C:\Documents and Settings\All Users\Application Data\16918084 (Rogue.Multiple.H) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\96928076 (Rogue.Multiple.H) -> Quarantined and deleted successfully. c:\documents and settings\ca309\Start Menu\Programs\System Security (Rogue.SystemSecurity) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot. Bestanden geïnfecteerd: C:\WINDOWS\amoumain.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully. c:\documents and settings\all users\application data\16918084\16918084.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully. c:\documents and settings\all users\application data\16918084\16918084.glu (Rogue.Multiple.H) -> Quarantined and deleted successfully. c:\documents and settings\all users\application data\16918084\pc16918084cnf (Rogue.Multiple.H) -> Quarantined and deleted successfully. c:\documents and settings\all users\application data\16918084\pc16918084ins (Rogue.Multiple.H) -> Quarantined and deleted successfully. c:\documents and settings\all users\application data\96928076\96928076.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully. C:\WINDOWS\odb.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\svc.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\alg.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\taskmg.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\servicelayer.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\sms.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\svx.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\svw.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\wdmon.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\vlc.exe (Trojan.Clicker) -> Quarantined and deleted successfully. C:\WINDOWS\system.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\tmp3133475.log (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\tmp4628740.log (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\tmp4748939.log (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\tmp6064111.log (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\tmp6142278.log (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\tmp8044751.log (Trojan.Clicker) -> Quarantined and deleted successfully. c:\0xf9.exe (Trojan.Downloader) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\5_odb.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\avto.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\avto1.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\avto2.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\avto3.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\avto4.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\nopmulti1.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\nopmulti3.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\nopmulti4.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q1.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q2.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q3.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q4.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q5.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q6.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q7.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q8.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\q9.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\teste1_p.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\teste3_p.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\teste4_p.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\5_odb.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\avto.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\avto1.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\avto2.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\avto3.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\avto4.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\nopmulti1.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\nopmulti5.exe (Trojan.Clicker) -> Quarantined and deleted successfully. c:\documents and settings\ca309\start menu\Programs\system security\System Security 2009 Support.lnk (Rogue.SystemSecurity) -> Quarantined and deleted successfully. c:\documents and settings\ca309\start menu\Programs\system security\System Security 2009.lnk (Rogue.SystemSecurity) -> Quarantined and deleted successfully. c:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot. c:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot. c:\documents and settings\ca309\Desktop\System Security 2009.lnk (Rogue.SystemSecurity) -> Quarantined and deleted successfully. C:\WINDOWS\fmark2.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\ctfmon.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\4_pinnew.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\6_ldr3.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\IslkW7od.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\w.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\60325cahp25ca0.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\60325cahp25caa.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\teste2_p.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\tt_1224797271.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\ca309\local settings\Temp\tt_1224797274.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\3076f.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\uSSrWrxc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sdra64.exe (Trojan.FakeAlert) -> Delete on reboot. c:\documents and settings\ca309\local settings\Temp\xrg1.exe (Trojan.Zlob) -> Quarantined and deleted successfully. C:\WINDOWS\f49f4daa.dat (Worm.Koobface) -> Quarantined and deleted successfully. Vriendelijke groeten, Torino - hijackthis.log