Torino

26 juni 2009

Dag Kape, inderdaad je hebt (weeral) gelijk, 't is opgelost. Nogmaals veel dank voor de assistentie, goed weekend!!!!!!

T

26 juni 2009

Hallo Kape, heb gedaan wat je zei: ComboFix via start => uitvoeren => combofix / u.

Combofix doet dan weer een analyse zoals voorheen en maakt een log aan, is dat wat je bedoelde? Ik bedoel, ik zie niet dat Combofix verwijderd werd door deze stap...

Groetjes,

T

24 juni 2009

Merk er in ieder geval niets meer van!!!!! Kan ik alle anti-virus programma's (Ad-Aware, AVG, Spybot) terug aanzetten? (moest die uitzetten om ComboFix te runnen). En dan maar hopen dat die pop-ups niet terugkeren...

Je hebt me heel goed, duidelijk en snel geholpen, waarvoor ontzettend veel dank!!!!!!

Groetjes

24 juni 2009

Dag Kape,

Hieronder de Combofix log... Groetjes

ComboFix 09-06-23.01 - ca309 24/06/2009 16:27.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.34.1033.18.502.258 [GMT 2:00]

Running from: c:\documents and settings\ca309\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\ca309\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: FortiClient AntiVirus *On-access scanning disabled* (Updated) {C86EC76D-5A4C-40E7-BD94-59358E544D81}

AV: Panda Antivirus Platinum 7 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}

FW: Panda Antivirus Platinum 7 *disabled* {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}

FILE ::

"C:\a1Z58a.bat"

"C:\ANV.bat"

"C:\b95ZO.bat"

"C:\bAoa5.bat"

"C:\bfXHw.bat"

"C:\BXiJ.bat"

"C:\Bxue8L6.bat"

"C:\Ce1p1.bat"

"C:\Ckx.bat"

"C:\CqmH.bat"

"C:\cscT7ZI.bat"

"C:\DCN3V3.bat"

"C:\DfF.bat"

"C:\DR6.bat"

"C:\e1f.bat"

"C:\EqD3UyiB.bat"

"C:\Fa6tYf3z.bat"

"C:\fYBJuxF.bat"

"C:\GGAUq7H.bat"

"C:\gWA.bat"

"C:\H0l.exe"

"C:\HCzgssU.bat"

"C:\hDfC.bat"

"C:\I4BWrOiF.bat"

"C:\igyrrA1d.bat"

"C:\IkhgG5g.bat"

"C:\IT3bS41k.bat"

"C:\J0tMjQl.bat"

"C:\jn4Rt7p.bat"

"C:\jRow83M.bat"

"C:\JUeapgE.bat"

"C:\jvmMd6KX.bat"

"C:\jyfp.bat"

"C:\k05U2f.bat"

"C:\l6uI98ED.bat"

"C:\Ml4Z.bat"

"C:\mLQqn.bat"

"C:\mME78bx1.bat"

"C:\NKt8.bat"

"C:\nwfXotW.bat"

"C:\ofM.bat"

"C:\PUxMA5rd.bat"

"C:\qnOIv.bat"

"C:\rbesiBnr.bat"

"C:\rfJSLUF.bat"

"C:\rFWb9C.bat"

"C:\rsa3.bat"

"C:\rX7Zwerz.bat"

"C:\S8jMFtB.exe"

"C:\sRr6So7G.bat"

"C:\ss4LI.bat"

"C:\Taa9ml3J.bat"

"C:\tF5G7.bat"

"C:\TrHkb.bat"

"C:\u8Rv5.bat"

"C:\Vc8noP.bat"

"C:\VGw7VJ1.bat"

"C:\viCnCTt.exe"

"C:\vXUo.bat"

"c:\windows\system32\1887270788.dat"

"C:\WLFttP.exe"

"C:\wUZLs.bat"

"C:\X54L.bat"

"C:\X5X1pq.bat"

"C:\X7LjL.bat"

"C:\x8qBZG3.bat"

"C:\XrEc7zAx.bat"

"C:\xyB.bat"

"C:\xZU1r.bat"

"C:\Y1e.bat"

"C:\Y8n.bat"

"C:\zx8BPR.bat"

"C:\ZZAnDVw6.bat"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\a1Z58a.bat

C:\ANV.bat

C:\b95ZO.bat

C:\bAoa5.bat

C:\bfXHw.bat

C:\BXiJ.bat

C:\Bxue8L6.bat

C:\Ce1p1.bat

C:\Ckx.bat

C:\CqmH.bat

C:\cscT7ZI.bat

C:\DCN3V3.bat

C:\DfF.bat

C:\DR6.bat

C:\e1f.bat

C:\EqD3UyiB.bat

C:\Fa6tYf3z.bat

C:\fYBJuxF.bat

C:\GGAUq7H.bat

C:\gWA.bat

C:\H0l.exe

C:\HCzgssU.bat

C:\hDfC.bat

C:\I4BWrOiF.bat

C:\igyrrA1d.bat

C:\IkhgG5g.bat

C:\IT3bS41k.bat

C:\J0tMjQl.bat

C:\jn4Rt7p.bat

C:\jRow83M.bat

C:\JUeapgE.bat

C:\jvmMd6KX.bat

C:\jyfp.bat

C:\k05U2f.bat

C:\l6uI98ED.bat

C:\Ml4Z.bat

C:\mLQqn.bat

C:\mME78bx1.bat

C:\NKt8.bat

C:\nwfXotW.bat

C:\ofM.bat

C:\PUxMA5rd.bat

C:\qnOIv.bat

C:\rbesiBnr.bat

C:\rfJSLUF.bat

C:\rFWb9C.bat

C:\rsa3.bat

C:\rX7Zwerz.bat

C:\S8jMFtB.exe

C:\sRr6So7G.bat

C:\ss4LI.bat

C:\Taa9ml3J.bat

C:\tF5G7.bat

C:\TrHkb.bat

C:\u8Rv5.bat

C:\Vc8noP.bat

C:\VGw7VJ1.bat

C:\viCnCTt.exe

C:\vXUo.bat

c:\windows\system32\1887270788.dat

C:\WLFttP.exe

C:\wUZLs.bat

C:\X54L.bat

C:\X5X1pq.bat

C:\X7LjL.bat

C:\x8qBZG3.bat

C:\XrEc7zAx.bat

C:\xyB.bat

C:\xZU1r.bat

C:\Y1e.bat

C:\Y8n.bat

C:\zx8BPR.bat

C:\ZZAnDVw6.bat

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_kpem

((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-06-24 )))))))))))))))))))))))))))))))

.

2009-06-24 12:31 . 2009-06-24 12:31 -------- dc----w- c:\windows\system32\dllcache\cache

2009-06-24 07:12 . 2009-06-24 07:12 -------- d-----w- c:\program files\Trend Micro

2009-06-22 14:34 . 2009-06-24 11:38 -------- dc-h--w- C:\$AVG8.VAULT$

2009-06-22 13:08 . 2009-06-22 13:08 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-06-22 13:08 . 2009-06-22 13:08 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-06-22 13:08 . 2009-06-22 13:08 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-06-22 13:08 . 2009-06-22 13:08 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-06-22 13:07 . 2009-06-24 11:49 -------- d-----w- c:\windows\system32\drivers\Avg

2009-06-22 13:07 . 2009-06-22 13:07 -------- dc----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2009-06-22 08:19 . 2009-06-22 08:08 15688 ----a-w- c:\windows\system32\lsdelete.exe

2009-06-22 08:08 . 2009-06-22 08:07 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys

2009-06-22 08:08 . 2009-06-22 08:08 314200 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe

2009-06-22 08:08 . 2009-06-22 08:08 25440 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll

2009-06-22 08:08 . 2009-06-22 08:08 15688 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe

2009-06-22 08:08 . 2009-06-22 08:08 169312 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll

2009-06-22 08:06 . 2009-06-22 08:06 627536 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe

2009-06-22 08:06 . 2009-06-22 08:06 518488 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe

2009-06-22 08:06 . 2009-06-22 08:06 1003344 -c--a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe

2009-06-22 08:03 . 2009-06-22 08:03 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

2009-06-22 08:03 . 2009-01-18 21:43 2892112 -c--a-w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe

2009-06-22 08:02 . 2009-06-22 08:02 -------- dc----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-06-21 10:20 . 2009-06-21 10:20 -------- d-----w- c:\program files\CCleaner

2009-06-21 09:47 . 2009-06-21 09:47 -------- dc----w- c:\documents and settings\ca309\Application Data\Malwarebytes

2009-06-21 09:47 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-06-21 09:47 . 2009-06-21 09:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-06-21 09:47 . 2009-06-21 09:47 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-06-21 09:47 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-06-21 09:44 . 2009-06-21 09:44 -------- d--h--w- c:\windows\PIF

2009-06-20 22:50 . 2009-06-20 22:50 -------- dc----w- c:\documents and settings\ca309\Application Data\TeamViewer

2009-06-20 16:35 . 2009-06-20 16:36 -------- d-----w- c:\program files\Windows Live Safety Center

2009-06-20 16:08 . 2009-06-20 16:08 -------- dc----w- c:\documents and settings\ca309\temp

2009-06-20 15:24 . 2009-06-22 15:51 -------- d-----w- c:\program files\Protector

2009-06-20 15:23 . 2009-06-20 15:23 -------- dc----w- c:\documents and settings\ca309\Application Data\none

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-24 12:07 . 2006-03-16 17:24 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-06-22 15:55 . 2008-11-12 07:29 -------- dc----w- c:\documents and settings\All Users\Application Data\Avg8

2009-06-22 10:55 . 2006-03-16 11:52 -------- d-----w- c:\program files\Lavasoft

2009-06-22 10:55 . 2006-03-16 11:53 -------- dc----w- c:\documents and settings\ca309\Application Data\Lavasoft

2009-06-08 06:46 . 2008-11-14 18:23 -------- dc----w- c:\documents and settings\ca309\Application Data\ZoomBrowser EX

2009-06-08 06:45 . 2009-05-12 14:45 -------- dc----w- c:\documents and settings\ca309\Application Data\CameraWindowDC

2009-05-12 14:45 . 2009-05-12 14:45 -------- dc----w- c:\documents and settings\ca309\Application Data\CANON INC

2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll

2009-04-29 04:56 . 2004-08-04 12:00 827392 ----a-w- c:\windows\system32\wininet.dll

2009-04-29 04:55 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2009-04-17 12:26 . 2004-08-04 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys

2009-04-15 14:51 . 2004-08-04 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll

2006-12-29 14:15 . 2007-12-17 13:05 3100672 ----a-w- c:\program files\Common Files\sapxlhelper.dll

2006-12-29 14:15 . 2007-12-17 13:05 192512 ----a-w- c:\program files\Common Files\sapconsr3.dll

2006-12-29 14:15 . 2007-12-17 13:05 626688 ----a-w- c:\program files\Common Files\sapconsaccess.dll

2006-12-29 14:15 . 2007-12-17 13:05 40960 ----a-w- c:\program files\Common Files\DigitalSignature.ocx

2006-12-07 09:26 . 2007-12-17 13:05 1124864 ----a-w- c:\program files\Common Files\SAPActiveXL_nosig.xlt

2006-12-07 09:26 . 2007-12-17 13:05 1129984 ----a-w- c:\program files\Common Files\SAPActiveXL.xlt

.

------- Sigcheck -------

[-] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys

[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys

[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys

[7] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtServicePackUninstall$\tcpip.sys

[7] 2004-08-04 12:00 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB913446$\tcpip.sys

[-] 2006-01-13 02:28 359808 583E063FDC888CA30D05C2724B0D7EF4 c:\windows\$NtUninstallKB917953$\tcpip.sys

[-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys

[7] 2008-04-13 22:50 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys

[-] 2008-04-13 22:50 361344 ACCF5A9A1FFAA490F33DBA1C632B95E1 c:\windows\ServicePackFiles\i386\tcpip.sys

[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 11:51 361600 9425B72F40257B45D45D24773273DAD0 c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((( SnapShot@2009-06-24_12.28.51 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-06-24 12:31 . 2008-10-16 13:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe

+ 2009-06-24 12:31 . 2008-04-14 03:42 82432 c:\windows\system32\dllcache\cache\ws2_32.dll

+ 2009-06-24 12:31 . 2008-04-14 03:42 26112 c:\windows\system32\dllcache\cache\userinit.exe

+ 2009-06-24 12:31 . 2008-04-14 03:42 14336 c:\windows\system32\dllcache\cache\svchost.exe

+ 2009-06-24 12:31 . 2008-04-14 03:42 57856 c:\windows\system32\dllcache\cache\spoolsv.exe

+ 2009-06-24 12:31 . 2008-04-14 03:42 17408 c:\windows\system32\dllcache\cache\powrprof.dll

+ 2009-06-24 12:31 . 2008-04-14 03:42 13312 c:\windows\system32\dllcache\cache\lsass.exe

+ 2009-06-24 12:31 . 2008-04-13 22:09 24576 c:\windows\system32\dllcache\cache\kbdclass.sys

+ 2009-06-24 12:31 . 2008-04-13 22:23 36608 c:\windows\system32\dllcache\cache\ip6fw.sys

+ 2009-06-24 12:31 . 2008-04-14 03:42 15360 c:\windows\system32\dllcache\cache\ctfmon.exe

+ 2009-06-24 12:31 . 2008-04-14 03:42 507904 c:\windows\system32\dllcache\cache\winlogon.exe

+ 2009-06-24 12:31 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll

+ 2009-06-24 12:31 . 2008-04-14 03:42 578560 c:\windows\system32\dllcache\cache\user32.dll

+ 2009-06-24 12:31 . 2008-04-14 03:42 295424 c:\windows\system32\dllcache\cache\termsrv.dll

+ 2009-06-24 12:31 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe

+ 2009-06-24 12:31 . 2008-04-13 22:50 182656 c:\windows\system32\dllcache\cache\ndis.sys

+ 2009-06-24 12:31 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll

+ 2009-06-24 12:31 . 2008-04-14 03:41 110080 c:\windows\system32\dllcache\cache\imm32.dll

+ 2009-06-24 12:31 . 2008-04-14 03:41 167936 c:\windows\system32\dllcache\cache\appmgmts.dll

+ 2009-06-24 12:31 . 2008-04-14 03:42 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll

+ 2009-06-24 12:31 . 2009-02-06 11:08 2189056 c:\windows\system32\dllcache\cache\ntoskrnl.exe

+ 2009-06-24 12:31 . 2009-02-07 17:02 2066048 c:\windows\system32\dllcache\cache\ntkrnlpa.exe

+ 2009-06-24 12:31 . 2008-04-14 03:42 1033728 c:\windows\system32\dllcache\cache\explorer.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-06-14 14:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2007-08-10 110592]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-08-10 512000]

"PRONoMgrWired"="c:\program files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2003-08-06 86016]

"BMMLREF"="c:\program files\ThinkPad\Utilities\BMMLREF.EXE" [2005-04-19 20480]

"QCWLICON"="c:\program files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2005-03-18 86016]

"SpeedTouch USB Diagnostics"="c:\program files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2002-11-12 860672]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-07-14 57344]

"BMMMONWND"="c:\progra~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2005-04-19 396288]

"BMMGAG"="c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2005-04-19 110592]

"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2005-04-19 208896]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-22 518488]

"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-22 1948440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-06-22 13:08 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]

2003-10-31 09:01 8704 ----a-w- c:\windows\system32\PCANotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]

2005-03-18 01:07 262144 ----a-w- c:\windows\system32\QConGina.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]

2004-08-12 18:11 24576 ----a-w- c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"dnlsvc"=2 (0x2)

"WMPNetworkSvc"=3 (0x3)

"TpKmpSVC"=2 (0x2)

"SoundMAX Agent Service (default)"=2 (0x2)

"ose"=3 (0x3)

"MDM"=2 (0x2)

"IBMPMSVC"=2 (0x2)

"Apple Mobile Device"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\PandaFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Symantec\\pcAnywhere\\WinAw32.exe"=

"c:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"=

"c:\\Program Files\\SAP\\FrontEnd\\SAPgui\\saplogon.exe"=

"c:\\FTPCAMPER\\FTPCamper.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"8484:TCP"= 8484:TCP:TINYPROXY

"53:TCP"= 53:TCP:TINYPROXY

R0 EFlashAssist;EFlashAssist;c:\windows\system32\drivers\EFLASHAS.SYS [18/07/2005 22:49 8476]

R0 FAFileMon;Fortinet FMonitor;c:\windows\system32\drivers\fortimon.sys [28/06/2005 12:46 17664]

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [22/06/2009 10:08 64160]

R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [18/07/2005 22:45 59776]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [22/06/2009 15:08 327688]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [22/06/2009 15:08 108552]

R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [18/07/2005 22:45 4608]

R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [18/07/2005 22:44 16384]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [22/06/2009 15:07 298776]

R3 QCNDISIF;QCNDISIF;c:\windows\system32\drivers\qcndisif.sys [18/07/2005 22:48 12288]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1003344]

.

Contents of the 'Scheduled Tasks' folder

2009-06-22 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 08:07]

2009-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 16:13]

2005-07-18 c:\windows\Tasks\BMMTask.job

- c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2005-07-18 23:38]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.skynet.be/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyServer = http=127.0.0.1:8484

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-06-24 16:35

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1104)

c:\windows\system32\tphklock.dll

- - - - - - - > 'explorer.exe'(3656)

c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\windows\system32\rundll32.exe

c:\program files\AVG\AVG8\avgtray.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\QCONSVC.EXE

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\windows\system32\TPHDEXLG.exe

c:\windows\system32\wscntfy.exe

c:\program files\AVG\AVG8\avgrsx.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

c:\program files\Canon\CAL\CALMAIN.exe

.

**************************************************************************

.

Completion time: 2009-06-24 16:39 - machine was rebooted

ComboFix-quarantined-files.txt 2009-06-24 14:39

ComboFix2.txt 2009-06-24 12:55

ComboFix3.txt 2009-06-24 12:33

Pre-Run: 14.288.650.240 bytes free

Post-Run: 14.290.194.432 bytes free

393 --- E O F --- 2009-06-10 15:40

24 juni 2009

Hallo Kape,

Bedankt, sorry dat ik zo lang wacht met mijn reacties maar ik moet telkens de tijd vinden. Maar 't is dus eindelijk achter de rug (leer je wel mee bij, amai) ; hieronder de log van Combofix en de recentste log van HiJackThis.

ComboFix 09-06-23.01 - ca309 24/06/2009 14:48.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.34.1033.18.502.161 [GMT 2:00]

Running from: c:\documents and settings\ca309\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\ca309\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: FortiClient AntiVirus *On-access scanning disabled* (Updated) {C86EC76D-5A4C-40E7-BD94-59358E544D81}

AV: Panda Antivirus Platinum 7 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}

FW: Panda Antivirus Platinum 7 *disabled* {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}

.

((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-06-24 )))))))))))))))))))))))))))))))

.

2009-06-24 12:31 . 2009-06-24 12:31 -------- dc----w- c:\windows\system32\dllcache\cache

2009-06-24 11:51 . 2009-06-24 11:51 328704 -c--a-w- C:\H0l.exe

2009-06-24 11:51 . 2009-06-24 11:51 6998 -c--a-w- C:\rbesiBnr.bat

2009-06-24 11:51 . 2009-06-24 11:51 231 -c--a-w- C:\GGAUq7H.bat

2009-06-24 11:47 . 2009-06-24 11:47 6998 -c--a-w- C:\X5X1pq.bat

2009-06-24 11:47 . 2009-06-24 11:47 239 -c--a-w- C:\Ce1p1.bat

2009-06-24 11:37 . 2009-06-24 11:37 6998 -c--a-w- C:\hDfC.bat

2009-06-24 11:37 . 2009-06-24 11:37 251 -c--a-w- C:\EqD3UyiB.bat

2009-06-24 07:43 . 2009-06-24 07:43 6998 -c--a-w- C:\rFWb9C.bat

2009-06-24 07:43 . 2009-06-24 07:43 238 -c--a-w- C:\cscT7ZI.bat

2009-06-24 07:28 . 2009-06-24 07:28 6998 -c--a-w- C:\b95ZO.bat

2009-06-24 07:28 . 2009-06-24 07:28 239 -c--a-w- C:\Bxue8L6.bat

2009-06-24 07:12 . 2009-06-24 07:12 -------- d-----w- c:\program files\Trend Micro

2009-06-24 07:08 . 2009-06-24 07:08 6998 -c--a-w- C:\u8Rv5.bat

2009-06-24 07:08 . 2009-06-24 07:08 247 -c--a-w- C:\DR6.bat

2009-06-24 06:59 . 2009-06-24 06:59 6998 -c--a-w- C:\TrHkb.bat

2009-06-24 06:59 . 2009-06-24 06:59 235 -c--a-w- C:\X7LjL.bat

2009-06-24 06:50 . 2009-06-24 06:50 6998 -c--a-w- C:\XrEc7zAx.bat

2009-06-24 06:49 . 2009-06-24 06:49 262 -c--a-w- C:\Fa6tYf3z.bat

2009-06-22 16:20 . 2009-06-22 16:20 328704 -c--a-w- C:\viCnCTt.exe

2009-06-22 16:20 . 2009-06-22 16:20 6998 -c--a-w- C:\sRr6So7G.bat

2009-06-22 16:20 . 2009-06-22 16:20 266 -c--a-w- C:\PUxMA5rd.bat

2009-06-22 16:08 . 2009-06-22 16:08 328704 -c--a-w- C:\S8jMFtB.exe

2009-06-22 16:07 . 2009-06-22 16:07 6998 -c--a-w- C:\Taa9ml3J.bat

2009-06-22 16:07 . 2009-06-22 16:07 268 -c--a-w- C:\ss4LI.bat

2009-06-22 16:05 . 2009-06-22 16:05 6998 -c--a-w- C:\J0tMjQl.bat

2009-06-22 16:04 . 2009-06-22 16:04 257 -c--a-w- C:\x8qBZG3.bat

2009-06-22 14:34 . 2009-06-24 11:38 -------- dc-h--w- C:\$AVG8.VAULT$

2009-06-22 13:09 . 2009-06-22 13:12 50400 -c--a-w- C:\WLFttP.exe

2009-06-22 13:09 . 2009-06-22 13:09 6998 -c--a-w- C:\igyrrA1d.bat

2009-06-22 13:09 . 2009-06-22 13:09 255 -c--a-w- C:\Vc8noP.bat

2009-06-22 13:08 . 2009-06-22 13:08 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-06-22 13:08 . 2009-06-22 13:08 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-06-22 13:08 . 2009-06-22 13:08 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-06-22 13:08 . 2009-06-22 13:08 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-06-22 13:07 . 2009-06-24 11:49 -------- d-----w- c:\windows\system32\drivers\Avg

2009-06-22 13:07 . 2009-06-22 13:07 -------- dc----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2009-06-22 12:58 . 2009-06-22 12:58 6998 -c--a-w- C:\ZZAnDVw6.bat

2009-06-22 12:58 . 2009-06-22 12:58 240 -c--a-w- C:\zx8BPR.bat

2009-06-22 12:44 . 2009-06-22 12:44 6998 -c--a-w- C:\fYBJuxF.bat

2009-06-22 12:44 . 2009-06-22 12:44 243 -c--a-w- C:\VGw7VJ1.bat

2009-06-22 12:40 . 2009-06-22 12:40 6998 -c--a-w- C:\CqmH.bat

2009-06-22 12:40 . 2009-06-22 12:40 264 -c--a-w- C:\nwfXotW.bat

2009-06-22 12:05 . 2009-06-22 12:05 6998 -c--a-w- C:\Ckx.bat

2009-06-22 12:05 . 2009-06-22 12:05 264 -c--a-w- C:\IkhgG5g.bat

2009-06-22 12:04 . 2009-06-22 12:04 6998 -c--a-w- C:\jyfp.bat

2009-06-22 12:04 . 2009-06-22 12:04 239 -c--a-w- C:\Y1e.bat

2009-06-22 12:02 . 2009-06-22 12:02 6998 -c--a-w- C:\BXiJ.bat

2009-06-22 12:02 . 2009-06-22 12:02 258 -c--a-w- C:\wUZLs.bat

2009-06-22 08:47 . 2009-06-22 08:47 6998 -c--a-w- C:\I4BWrOiF.bat

2009-06-22 08:47 . 2009-06-22 08:47 262 -c--a-w- C:\a1Z58a.bat

2009-06-22 08:41 . 2009-06-22 08:41 6998 -c--a-w- C:\gWA.bat

2009-06-22 08:41 . 2009-06-22 08:41 241 -c--a-w- C:\ANV.bat

2009-06-22 08:28 . 2009-06-22 08:28 6998 -c--a-w- C:\k05U2f.bat

2009-06-22 08:28 . 2009-06-22 08:28 234 -c--a-w- C:\Ml4Z.bat