Archief - Antispyware 2008 XP

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:42:42, on 18/08/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\AMT\atchksrv.exe
c:\cachesys\bin\cservice.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
c:\cachesys\bin\cache.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\Intel\AMT\UNS.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
C:\WINDOWS\TEMP\OV5473.EXE
c:\cachesys\bin\cache.exe
C:\CacheSys\httpd\bin\httpd.exe
C:\CacheSys\httpd\bin\httpd.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\CacheSys\bin\csystray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7645E074-97EE-42EB-A918-9BFCF1D0F6BC} - C:\WINDOWS\system32\pmnnNddc.dll (file missing)
O2 - BHO: (no name) - {E482A951-26ED-4898-A1EB-09A942D95A52} - C:\WINDOWS\system32\urqpPJBU.dll (file missing)
O2 - BHO: {488e37c6-49ae-8218-3184-b0cfc3308f8e} - {e8f8033c-fc0b-4813-8128-ea946c73e884} - C:\WINDOWS\system32\dsrbmb.dll
O2 - BHO: mxlivemedia browser optimizer - {f1f032f0-031f-8632-9323-313cc5723f48} - C:\WINDOWS\system32\xkkodxfnmvqatpwop.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [44df3a95] rundll32.exe "C:\WINDOWS\system32\kwuijocd.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: CACHEWEB.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1205765683500
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\Software\..\Telephony: DomainName = DMNGALICO.LOCAL
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O20 - Winlogon Notify: urqpPJBU - urqpPJBU.dll (file missing)
O23 - Service: ActiveFax-Server-Service (ActiveFaxServiceNT) - ActFax Communication - C:\Program Files\ActiveFax\Server\ActSrvNT.exe
O23 - Service: Intel(R) Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: Web Server for CACHEWEB (CACHEWEBhttpd) - Apache Software Foundation - C:\CacheSys\httpd\bin\httpd.exe
O23 - Service: Caché Controller voor CACHEWEB (Cache_c-_cachesys) - Unknown owner - c:\cachesys\bin\cservice.exe
O23 - Service: Intel(R) Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
O23 - Service: Intel(R) Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 7553 bytes

Klik om te vergroten...

Malwarebytes' Anti-Malware 1.25
Database versie: 1065
Windows 5.1.2600 Service Pack 3

13:35:55 18/08/2008
mbam-log-08-18-2008 (13-35-49).txt

Scan type: Volledige Scan (A:\|C:\|D:\|E:\|O:\|S:\|)
Objecten gescand: 144017
Verstreken tijd: 1 hour(s), 26 minute(s), 43 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 2
Registersleutels geïnfecteerd: 16
Registerwaarden geïnfecteerd: 1
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 1
Bestanden geïnfecteerd: 25

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
C:\WINDOWS\system32\kwuijocd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\dsrbmb.dll (Trojan.Vundo.H) -> No action taken.

Registersleutels geïnfecteerd:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e482a951-26ed-4898-a1eb-09a942d95a52} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqppjbu (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{e482a951-26ed-4898-a1eb-09a942d95a52} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e8f8033c-fc0b-4813-8128-ea946c73e884} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{e8f8033c-fc0b-4813-8128-ea946c73e884} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mxlivemedia (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f1f032f0-031f-8632-9323-313cc5723f48} (Adware.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{f1f032f0-031f-8632-9323-313cc5723f48} (Adware.BHO) -> No action taken.

Registerwaarden geïnfecteerd:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\44df3a95 (Trojan.Vundo.H) -> No action taken.

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
C:\Documents and Settings\All Users\Application Data\Secure Solutions (Rogue.Multiple) -> No action taken.

Bestanden geïnfecteerd:
C:\WINDOWS\system32\urqpPJBU.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\dsrbmb.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\kwuijocd.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\dcojiuwk.ini (Trojan.Vundo.H) -> No action taken.
C:\Documents and Settings\administrator.DMNGALICO\Local Settings\Temporary Internet Files\Content.IE5\1HNADMIH\kb456456[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\administrator.DMNGALICO\Local Settings\Temporary Internet Files\Content.IE5\C757QNBY\ico[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\administrator.DMNGALICO\Local Settings\Temporary Internet Files\Content.IE5\C757QNBY\kb767887[1] (Trojan.Vundo.H) -> No action taken.
C:\Documents and Settings\administrator.DMNGALICO\Local Settings\Temporary Internet Files\Content.IE5\TEUD1TGW\ico[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\user17\Local Settings\Temporary Internet Files\Content.IE5\UQ57HP9G\ico[1] (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP85\A0010746.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP86\A0010782.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP88\A0010938.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP88\A0010939.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP88\A0010940.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP88\A0010941.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP88\A0010942.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP88\A0010943.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP91\A0011102.exe (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\mbvtnfit.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> No action taken.
C:\Documents and Settings\administrator.DMNGALICO\Bureaublad\Antivirus 2008 infectie - 9lives.url (Rogue.Antivirus) -> No action taken.
C:\Documents and Settings\user17\Local Settings\Temp\vistasp1.exe (Trojan.FakeAlert) -> No action taken.

Klik om te vergroten...

Malwarebytes' Anti-Malware 1.25
Database versie: 1065
Windows 5.1.2600 Service Pack 3

13:30:04 18/08/2008
mbam-log-08-18-2008 (13-30-00).txt

Scan type: Volledige Scan (C:\|)
Objecten gescand: 125878
Verstreken tijd: 32 minute(s), 27 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 1
Registerwaarden geïnfecteerd: 0
Registerdata bestanden geïnfecteerd: 1
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.

Registerwaarden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerdata bestanden geïnfecteerd:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Klik om te vergroten...

ComboFix 08-08-17.03 - administrator 2008-08-18 13:44:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1043.18.401 [GMT 2:00]
Gestart vanuit: C:\Documents and Settings\administrator.DMNGALICO\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\administrator.DMNGALICO\Cookies\[email protected][2].txt
C:\Documents and Settings\administrator.DMNGALICO\Cookies\[email protected][1].txt
C:\Documents and Settings\administrator.DMNGALICO\UserData
C:\Documents and Settings\administrator.DMNGALICO\UserData\45HYB0D7\sn[1].xml
C:\Documents and Settings\administrator.DMNGALICO\UserData\index.dat
C:\Documents and Settings\administrator.DMNGALICO\UserData\ZBPYWI2M\oWindowsUpdate[1].xml
C:\Documents and Settings\All Users\Application Data\Secure Solutions
C:\Documents and Settings\Default User\UserData
C:\Documents and Settings\Default User\UserData\index.dat
C:\Documents and Settings\user\UserData
C:\Documents and Settings\user\UserData\index.dat
C:\Documents and Settings\user\UserData\V1AFD3KZ\oWindowsUpdate[1].xml
C:\Documents and Settings\user17\Application Data\macromedia\Flash Player\#SharedObjects\BZ943G5Y\interclick.com
C:\Documents and Settings\user17\Application Data\macromedia\Flash Player\#SharedObjects\BZ943G5Y\interclick.com\ud.sol
C:\Documents and Settings\user17\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\user17\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\user17\Cookies\[email protected][2].txt
C:\Documents and Settings\user17\UserData
C:\Documents and Settings\user17\UserData\45HYB0D7\oWindowsUpdate[1].xml
C:\Documents and Settings\user17\UserData\index.dat
C:\Documents and Settings\user17\UserData\USWN82S7\sn[1].xml
C:\Documents and Settings\user17\UserData\V1AFD3KZ\IsOnIE6tbPromo[1].xml
C:\Documents and Settings\user5\UserData
C:\Documents and Settings\user5\UserData\index.dat
C:\Documents and Settings\user5\UserData\ZBPYWI2M\oWindowsUpdate[1].xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\ayxvdhav.ini
C:\WINDOWS\system32\cddNnnmp.ini
C:\WINDOWS\system32\cddNnnmp.ini2
C:\WINDOWS\system32\dcojiuwk.ini
C:\WINDOWS\system32\ddqgwqge.ini
C:\WINDOWS\system32\dsrbmb.dll
C:\WINDOWS\system32\kwuijocd.dll
C:\WINDOWS\system32\mbvtnfit.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\uddnlcro.ini
C:\WINDOWS\system32\wusnhuji.ini

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-07-18 to 2008-08-18 ))))))))))))))))))))))))))))))
.

2008-08-18 11:32 . 2008-08-18 11:32 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-18 11:32 . 2008-08-18 11:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-18 11:32 . 2008-08-18 11:32 <DIR> d-------- C:\Documents and Settings\administrator.DMNGALICO\Application Data\Malwarebytes
2008-08-18 11:32 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-18 11:32 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-18 10:50 . 2008-08-18 10:51 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-18 10:50 . 2008-08-18 11:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-14 15:39 . 2008-04-11 21:06 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-14 15:39 . 2008-05-01 16:37 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-14 11:17 . 2008-08-14 11:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-08-12 15:03 . 2008-08-18 11:19 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-08-12 15:03 . 2008-08-12 15:03 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-08-12 14:52 . 2008-08-12 14:54 3,276 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-12 13:41 . 2008-08-12 17:01 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-11 16:48 . 2008-08-11 16:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\services
2008-08-08 15:03 . 2008-08-08 15:03 0 --a----t- C:\WINDOWS\ActFaxSM.tmp

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-18 08:42 --------- d-----w C:\Program Files\Trend Micro
2008-08-18 07:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-07 08:07 83,136 ----a-w C:\WINDOWS\UIActFax.exe
2008-06-07 08:07 69,632 ----a-w C:\WINDOWS\UIActFax.dll
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:02 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 15:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 15:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 15:00 455168]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-06-13 13:56 142104]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-06-13 13:55 162584]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-06-13 13:55 138008]
"atchk"="C:\Program Files\Intel\AMT\atchk.exe" [2007-07-06 10:55 408088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2006-11-10 01:17 381005]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 14:49 16377344 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 19:02 15360]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
CACHEWEB.lnk - C:\CacheSys\bin\csystray.exe [2008-04-15 12:16:22 540672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R2 atchksrv;Intel(R) Active Management Technology System Status Service;C:\Program Files\Intel\AMT\atchksrv.exe [2007-07-06 10:55]
R2 Cache_c-_cachesys;Caché Controller voor CACHEWEB;c:\cachesys\bin\cservice.exe [2006-06-15 18:34]
R2 LMS;Intel(R) Active Management Technology Local Management Service;C:\Program Files\Intel\AMT\LMS.exe [2007-07-06 10:54]
R2 UNS;Intel(R) Active Management Technology User Notification Service;C:\Program Files\Intel\AMT\UNS.exe [2007-07-06 10:55]
R3 CACHEWEBhttpd;Web Server for CACHEWEB;C:\CacheSys\httpd\bin\httpd.exe [2006-07-17 16:34]
R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2007-06-05 08:04]
S3 ActiveFaxServiceNT;ActiveFax-Server-Service;C:\Program Files\ActiveFax\Server\ActSrvNT.exe [2008-06-07 10:07]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-08-17 15:01]
.
- - - - ORPHANS REMOVED - - - -

BHO-{7645E074-97EE-42EB-A918-9BFCF1D0F6BC} - C:\WINDOWS\system32\pmnnNddc.dll
BHO-{f1f032f0-031f-8632-9323-313cc5723f48} - C:\WINDOWS\system32\xkkodxfnmvqatpwop.dll
HKLM-Run-44df3a95 - C:\WINDOWS\system32\kwuijocd.dll
Notify-urqpPJBU - urqpPJBU.dll


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
O8 -: E&xporteren naar Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-18 14:07:50
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Trend Micro\Client Server Security Agent\NTRtScan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\TmListen.exe
C:\CacheSys\Bin\cache.exe
C:\Program Files\RealVNC\VNC4\winvnc4.exe
C:\Program Files\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\CacheSys\Bin\cache.exe
C:\WINDOWS\Temp\XVDE08.EXE
C:\WINDOWS\system32\igfxsrvc.exe
.
**************************************************************************
.
Voltooingstijd: 2008-08-18 14:09:17 - machine was rebooted [administrator]
ComboFix-quarantined-files.txt 2008-08-18 12:09:14

Pre-Run: 56,556,363,776 bytes beschikbaar
Post-Run: 57,020,489,728 bytes beschikbaar

175 --- E O F --- 2008-08-18 07:09:53

Klik om te vergroten...

• Download en installeer AVG Anti-Spyware.
• Na de installatie open je AVG Anti-Spyware.
• Onder 'Status' klik je naast 'Resident shield' op Change state. (deze moet op 'Inactive' komen te staan)
  Wil je het Resident shield gebruiken in de toekomst, dan laat je dit op "Active" staan.
• Onder 'Status' klik je bij Last Update op Update now.
  Lukt dit niet, dan ga je in het menu naar 'Update' en klik je bij 'Manual update' op de knop Start update.
  
• Onder 'Scanner' ga je naar de tab 'Settings' en zorg je voor de volgende instellingen:
  • onder 'How to act?', klik je op 'Recommended actions' en selecteer je Quarantine.
  • onder 'How to scan?', zorg je dat alle opties geselecteerd zijn.
  • onder 'Possibly unwanted software:', zorg je dat alle opties geselecteerd zijn.
  • onder 'Reports:', selecteer je Automatically generate report after every scan.
  • onder 'Reports:', verwijder je het vinkje bij Only if threats were found.
  • onder 'What to scan?', selecteer je Scan every file.
• Sluit AVG Anti-Spyware. Laat het nog niet scannen.
• Start de computer op in veilige modus. Hoe je dit doet kan je hier lezen.
• Start AVG Anti-Spyware.
• Klik in het menu op 'Scanner'
• Kies Complete system scan.
• AVG Anti-Spyware gaat nu je volledige computer scannen.
• Als de scan be&#65533;indigd is, klik je onderaan op de knop Apply all Actions.
• Wacht to je de melding krijgt 'All actions have been applied'.
• Ga in het menu naar 'Reports', en klik op de knop 'Save report as' en sla het rapport van de scan op op je bureaublad.
• Sluit AVG Anti-Spyware af.
• Herstart de computer in normale modus en post het rapport van AVG Anti-Spyware.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40, on 2008-08-19
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\cachesys\bin\cservice.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
c:\cachesys\bin\cache.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
C:\WINDOWS\TEMP\EN76E7.EXE
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
C:\CacheSys\httpd\bin\httpd.exe
C:\CacheSys\httpd\bin\httpd.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\CacheSys\bin\csystray.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: CACHEWEB.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1205765683500
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\Software\..\Telephony: DomainName = DMNGALICO.LOCAL
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O23 - Service: ActiveFax-Server-Service (ActiveFaxServiceNT) - ActFax Communication - C:\Program Files\ActiveFax\Server\ActSrvNT.exe
O23 - Service: Intel(R) Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Web Server for CACHEWEB (CACHEWEBhttpd) - Apache Software Foundation - C:\CacheSys\httpd\bin\httpd.exe
O23 - Service: Caché Controller voor CACHEWEB (Cache_c-_cachesys) - Unknown owner - c:\cachesys\bin\cservice.exe
O23 - Service: Intel(R) Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
O23 - Service: Intel(R) Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 8241 bytes

Klik om te vergroten...

Malwarebytes' Anti-Malware 1.25
Database versie: 1065
Windows 5.1.2600 Service Pack 3

10:41:26 2008-08-19
mbam-log-08-19-2008 (10-41-24).txt

Scan type: Volledige Scan (C:\|)
Objecten gescand: 96950
Verstreken tijd: 28 minute(s), 26 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 1
Registerwaarden geïnfecteerd: 0
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 4

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mxlivemedia (Trojan.BHO) -> No action taken.

Registerwaarden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
C:\QooBox\Quarantine\C\WINDOWS\system32\kwuijocd.dll.vir (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP85\A0010746.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP86\A0010782.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{F2064527-3F40-4CEC-9411-57011EAFFDDE}\RP92\A0011186.dll (Trojan.Vundo) -> No action taken.

Klik om te vergroten...

Bestand cache.exe ontvangen op 2008.08.21 08:34:43 (CET)Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2008.8.21.0 2008.08.21 -
AntiVir 7.8.1.23 2008.08.21 -
Authentium 5.1.0.4 2008.08.21 -
Avast 4.8.1195.0 2008.08.20 -
AVG 8.0.0.161 2008.08.20 -
BitDefender 7.2 2008.08.21 -
CAT-QuickHeal 9.50 2008.08.20 -
ClamAV 0.93.1 2008.08.21 -
DrWeb 4.44.0.09170 2008.08.21 -
eSafe 7.0.17.0 2008.08.20 -
eTrust-Vet 31.6.6038 2008.08.20 -
Ewido 4.0 2008.08.20 -
F-Prot 4.4.4.56 2008.08.20 -
F-Secure 7.60.13501.0 2008.08.21 -
Fortinet 3.14.0.0 2008.08.21 -
GData 2.0.7306.1023 2008.08.20 -
Ikarus T3.1.1.34.0 2008.08.21 -
K7AntiVirus 7.10.422 2008.08.20 -
Kaspersky 7.0.0.125 2008.08.21 -
McAfee 5365 2008.08.20 -
Microsoft 1.3807 2008.08.21 -
NOD32v2 3373 2008.08.21 -
Norman 5.80.02 2008.08.20 -
Panda 9.0.0.4 2008.08.21 -
PCTools 4.4.2.0 2008.08.20 -
Prevx1 V2 2008.08.21 -
Rising 20.58.30.00 2008.08.21 -
Sophos 4.32.0 2008.08.21 -
Sunbelt 3.1.1564.1 2008.08.20 -
Symantec 10 2008.08.21 -
TheHacker 6.3.0.6.056 2008.08.21 -
TrendMicro 8.700.0.1004 2008.08.21 -
VBA32 3.12.8.3 2008.08.20 -
ViRobot 2008.8.20.1342 2008.08.20 -
VirusBuster 4.5.11.0 2008.08.20 -
Webwasher-Gateway 6.6.2 2008.08.21 -

Extra informatie
File size: 2977792 bytes
MD5...: 19bdf6b878a25c0a55cd438752df82bb
SHA1..: 7bd760537960b7608e487f7590098614f2952bef
SHA256: 71443c7d76c5f8d4d9ec17a139809cc7f7106efe76bfb19d8c6e0368ab32c2ec
SHA512: 23afdfc247be74ad4a1f37c4fb5039dd4e22a37d188c90149c57317e8cab1bc5<BR>41facc30d0cdca7bd369493100802f1412b7dfc12be1424eaeb1e9db0dd57e05
PEiD..: -
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x407dfa<BR>timedatestamp.....: 0x4499601e (Wed Jun 21 15:05:02 2006)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x28dc80 0x28e000 6.66 05a647efdc9bb6af43c4c01b0acfa122<BR>.rdata 0x28f000 0x2bf02 0x2c000 5.96 f836ca0a89b2b641b3f0df02e97b47e4<BR>.data 0x2bb000 0x7aba8 0x1b000 5.32 b1cbff468378bb32f399a09b9398602e<BR>.rsrc 0x336000 0x508 0x1000 1.05 941611de8f917db3cb3f116a0a9981dc<BR><BR>( 7 imports ) <BR>&gt; MSVCR71.dll: _controlfp, _onexit, __dllonexit, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _amsg_exit, __p___initenv, _cexit, _XcptFilter, _exit, _c_exit, _assert, sin, asin, fabs, exp, atan, log10, acos, tan, log, cos, sqrt, gmtime, atof, islower, isdigit, strcat, _wcsnset, fmod, _open_osfhandle, strchr, fprintf, strncmp, _waccess, _errno, mktime, _wchmod, memmove, isalpha, fgets, memcmp, realloc, _aligned_malloc, _aligned_free, _wstat, strtol, isspace, vsprintf, memset, strlen, memcpy, longjmp, exit, fclose, atol, time, toupper, strftime, ctime, localtime, fopen, _setjmp3, _umask, _dup2, _ecvt, _fcvt, _timezone, _tzset, _dup, _write, _memicmp, _chdir, _getpid, _open, _close, strncpy, tolower, wcslen, remove, atoi, _ftime, _wgetenv, fputs, malloc, free, sprintf, _iob, printf, fflush, strcpy, _CIpow<BR>&gt; ADVAPI32.dll: OpenThreadToken, SetSecurityDescriptorGroup, AccessCheck, RegSetValueExA, RegQueryValueExA, DuplicateToken, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegOpenKeyExA, InitializeAcl, AllocateAndInitializeSid, SetSecurityDescriptorOwner, AddAccessAllowedAce, FreeSid, CryptGenRandom, CryptAcquireContextA, CryptReleaseContext, OpenSCManagerA, QueryServiceStatus, StartServiceA, CloseServiceHandle, OpenServiceA, RegEnumValueA, RegDeleteValueA, RegCreateKeyExA, RegDeleteKeyA, LogonUserA, RevertToSelf, ImpersonateLoggedOnUser, RegCloseKey, GetLengthSid, IsValidSecurityDescriptor, GetUserNameA, OpenProcessToken<BR>&gt; KERNEL32.dll: DefineDosDeviceA, GlobalUnlock, GlobalAlloc, GlobalLock, GetSystemTime, QueryPerformanceFrequency, QueryPerformanceCounter, OpenFileMappingA, GetFullPathNameA, GlobalFree, RemoveDirectoryW, MoveFileW, CopyFileW, CreateDirectoryW, DeleteFileW, SetEndOfFile, GetThreadPriority, GetPriorityClass, PurgeComm, BuildCommDCBA, SetConsoleTitleW, WaitCommEvent, SetCommMask, GetCommMask, SetConsoleWindowInfo, GetExitCodeThread, GetFileType, GetConsoleScreenBufferInfo, SetLastError, InterlockedExchange, GetOverlappedResult, SetConsoleMode, ReadConsoleInputA, GetConsoleMode, GlobalHandle, DeviceIoControl, GetEnvironmentVariableW, FillConsoleOutputCharacterA, SetConsoleTextAttribute, Beep, SetConsoleCursorPosition, FillConsoleOutputAttribute, WriteConsoleOutputCharacterW, SetConsoleCursorInfo, WriteConsoleOutputAttribute, ScrollConsoleScreenBufferA, ReadConsoleOutputCharacterW, GetComputerNameExA, SetTapeParameters, GetDriveTypeA, GetFileInformationByHandle, WriteTapemark, SetTapePosition, GetTapeParameters, EraseTape, lstrcmpW, lstrlenW, ConnectNamedPipe, CreateNamedPipeW, DisconnectNamedPipe, CreateMutexW, CreateFileMappingW, CreateEventW, ReleaseMutex, PeekNamedPipe, CreatePipe, GetModuleHandleA, DebugBreak, GetFullPathNameW, ExitProcess, SetProcessAffinityMask, CreateFileA, GetFileSize, GlobalMemoryStatus, SetPriorityClass, FindFirstFileW, SetFilePointer, MapViewOfFile, UnmapViewOfFile, AllocConsole, SetErrorMode, FreeLibrary, CreateProcessW, SetWaitableTimer, MapViewOfFileEx, GetCurrentProcess, GetProfileStringW, WaitForSingleObject, CancelWaitableTimer, GetComputerNameW, SetEvent, GetLogicalDrives, SleepEx, WaitForSingleObjectEx, GetCurrentThread, IsBadReadPtr, WriteFile, WaitForMultipleObjectsEx, InitializeCriticalSection, OpenProcess, GetVolumeInformationA, TerminateThread, Sleep, FreeConsole, CreateEventA, LeaveCriticalSection, GetExitCodeProcess, GetFileAttributesW, CreateProcessA, IsBadWritePtr, TerminateProcess, CreateFileW, GetEnvironmentVariableA, ExitThread, SetThreadPriority, FlushFileBuffers, RaiseException, GetStdHandle, GetLastError, GetCurrentDirectoryW, GetLongPathNameW, GetProcAddress, SetStdHandle, EnterCriticalSection, FindClose, ResetEvent, LoadLibraryA, CreateFileMappingA, LocalAlloc, SetCommTimeouts, OpenEventA, GetSystemInfo, WaitForMultipleObjects, SetEnvironmentVariableA, GetProcessAffinityMask, FindNextFileW, DeleteCriticalSection, GetShortPathNameW, GetCurrentThreadId, DuplicateHandle, SetProcessShutdownParameters, GetVersionExA, GetDiskFreeSpaceExW, CloseHandle, GetCurrentProcessId, CreateWaitableTimerA, LocalFree, SuspendThread, ResumeThread, DeleteFileA, CreateThread, LoadLibraryW, ReadFile, GetCommModemStatus, ClearCommError, GetCommState, WaitNamedPipeA, SetConsoleScreenBufferSize, GetCommProperties, EscapeCommFunction, FormatMessageA, ClearCommBreak, SetCommState, SetConsoleCtrlHandler<BR>&gt; WS2_32.dll: -, -, WSAIoctl, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, WSADuplicateSocketA, -, -, -, -, WSASocketA, -<BR>&gt; WINSPOOL.DRV: StartPagePrinter, OpenPrinterW, EnumPrintersW, EnumPrintersA, EndPagePrinter, StartDocPrinterW, ClosePrinter, EndDocPrinter, WritePrinter<BR>&gt; CLUSAPI.dll: CloseClusterGroup, OpenClusterGroup, CloseCluster, GetClusterInformation, ClusterEnum, ClusterGroupOpenEnum, ClusterOpenEnum, ClusterGroupEnum, ClusterCloseEnum, OpenClusterResource, CloseClusterResource, ClusterGroupCloseEnum, OpenCluster, ClusterResourceControl<BR>&gt; RESUTILS.dll: ResUtilFindSzProperty<BR><BR>( 0 exports ) <BR>

Klik om te vergroten...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:36, on 2008-08-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\cachesys\bin\cservice.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\Intel\AMT\UNS.exe
c:\cachesys\bin\cache.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
c:\cachesys\bin\cache.exe
C:\CacheSys\httpd\bin\httpd.exe
C:\CacheSys\httpd\bin\httpd.exe
C:\WINDOWS\TEMP\MQE5C5.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\CacheSys\bin\csystray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: CACHEWEB.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1205765683500
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\Software\..\Telephony: DomainName = DMNGALICO.LOCAL
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = DMNGALICO.LOCAL
O23 - Service: ActiveFax-Server-Service (ActiveFaxServiceNT) - ActFax Communication - C:\Program Files\ActiveFax\Server\ActSrvNT.exe
O23 - Service: Intel(R) Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Web Server for CACHEWEB (CACHEWEBhttpd) - Apache Software Foundation - C:\CacheSys\httpd\bin\httpd.exe
O23 - Service: Caché Controller voor CACHEWEB (Cache_c-_cachesys) - Unknown owner - c:\cachesys\bin\cservice.exe
O23 - Service: Intel(R) Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
O23 - Service: Intel(R) Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 8137 bytes

Klik om te vergroten...