Archief - logje :)

yo kzit met een (trojan) probleemke
kheb dus enkele minuten geleden de avg updates afgehaalt en plots kreeg ik trojan en virus meldingen
heb dus spybot en avg laten lopen achter dak die meldingen gekregen heb maar die vonden niets.
heb ook al op het avg forum gekeken enzovoort maar zij weten niets over die trojan(generic 6.umu /.ums) heb ook gegoogled maar daar ook niets te vinden over die trojan.dus hier is m'n logje



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:46:52, on 21/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\CPUCooL\CooLSrv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://update.zonelabs.com/checkupd...0&License=1&Language=EN&Query=Manual&OEM=1038
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4695 bytes


greetz wacko

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

ComboFix 07-08-17.2 - "trolle" 2007-08-22 0:15:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.1467 [GMT 2:00]
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-21 to 2007-08-21 )))))))))))))))))))))))))))))))


2007-08-22 00:14 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-21 22:46 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-29 23:18 40,960 --a------ C:\WINDOWS\system32\psfind.dll
2007-07-29 23:18 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-07-25 23:37 3,670,016 --a------ C:\DOCUME~1\trolle\ntuser.dat


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-16 04:21 --------- d-------- C:\Program Files\World of Warcraft
2007-08-10 22:19 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-10 22:19 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-07-29 23:14 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-20 00:14 --------- d-------- C:\Program Files\MSN Messenger
2007-07-19 13:48 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\Command & Conquer 3 Tiberium Wars
2007-07-04 22:17 --------- d-------- C:\Program Files\CPUCooL
2007-07-02 14:45 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-02 14:45 --------- dr-h----- C:\DOCUME~1\trolle\APPLIC~1\SecuROM
2007-07-01 23:10 --------- d-------- C:\Program Files\THQ
2007-07-01 23:08 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\InstallShield
2007-07-01 22:44 --------- d-------- C:\Program Files\Electronic Arts
2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-24 14:01 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\Ventrilo
2007-06-22 22:07 --------- d-------- C:\Program Files\Winamp
2007-06-22 20:41 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\WinRAR
2007-06-22 19:20 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-06-22 19:20 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-06-21 19:43 --------- d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-06-21 19:35 --------- d-------- C:\Program Files\Logitech
2007-06-21 18:29 --------- d-------- C:\Program Files\Ventrilo
2007-06-21 18:29 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-21 18:28 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\ATI
2007-06-21 18:26 --------- d-------- C:\Program Files\ATI Technologies
2007-06-21 18:19 --------- d-------- C:\Program Files\Messenger
2007-06-21 18:04 --------- d-------- C:\Program Files\Common Files\SpeechEngines
2007-06-21 18:04 --------- d-------- C:\Program Files\Common Files\ODBC
2007-06-21 16:58 --------- d-------- C:\Program Files\Lavasoft
2007-06-21 16:53 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-06-21 16:53 348160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-06-21 16:49 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-06-21 16:41 --------- d-------- C:\Program Files\Realtek
2007-06-21 16:38 --------- d-------- C:\Program Files\Analog Devices
2007-06-21 16:30 --------- d-------- C:\Program Files\Intel
2007-06-21 16:18 0 -rahs---- C:\MSDOS.SYS
2007-06-21 16:18 0 -rahs---- C:\IO.SYS
2007-06-21 16:18 0 --a------ C:\CONFIG.SYS
2007-06-21 16:18 0 --a------ C:\AUTOEXEC.BAT
2007-06-21 16:18 --------- d-------- C:\Program Files\microsoft frontpage
2007-06-21 16:17 --------- d--h----- C:\Program Files\WindowsUpdate
2007-06-21 16:17 --------- d-------- C:\Program Files\Online Services
2007-06-21 16:16 --------- d-------- C:\Program Files\Movie Maker
2007-06-21 16:16 --------- d-------- C:\Program Files\Common Files\MSSoap
2007-06-21 16:15 --------- d-------- C:\Program Files\Windows NT
2007-06-21 16:15 --------- d-------- C:\Program Files\MSN Gaming Zone
2007-06-19 15:33 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 15:24 1036800 --a------ C:\WINDOWS\explorer.exe
2006-06-23 08:48 32768 -ra------ C:\WINDOWS\inf\UpdateUSB.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-07-13 07:12]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 14:44]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 14:44]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-16 16:20]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-01-08 14:29]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
"Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 17:31]
"Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 17:14]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-02-07 15:39]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys
R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys
R3 SenFiltService;SenFilt Service;C:\WINDOWS\system32\drivers\Senfilt.sys


Contents of the 'Scheduled Tasks' folder
2007-06-23 22:28:03 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-22 00:16:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-22 0:16:28

--- E O F ---



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:17:24, on 22/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\CPUCooL\CooLSrv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://update.zonelabs.com/checkupd...0&License=1&Language=EN&Query=Manual&OEM=1038
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4729 bytes

ComboFix 07-08-17.2 - "trolle" 2007-08-22 0:26:15.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.1542 [GMT 2:00]


((((((((((((((((((((((((( Files Created from 2007-07-21 to 2007-08-21 )))))))))))))))))))))))))))))))


2007-08-22 00:14 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-21 22:46 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-29 23:18 40,960 --a------ C:\WINDOWS\system32\psfind.dll
2007-07-29 23:18 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-07-25 23:37 3,670,016 --a------ C:\DOCUME~1\trolle\ntuser.dat


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-16 04:21 --------- d-------- C:\Program Files\World of Warcraft
2007-08-10 22:19 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-10 22:19 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-07-29 23:14 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-20 00:14 --------- d-------- C:\Program Files\MSN Messenger
2007-07-19 13:48 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\Command & Conquer 3 Tiberium Wars
2007-07-04 22:17 --------- d-------- C:\Program Files\CPUCooL
2007-07-02 14:45 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-02 14:45 --------- dr-h----- C:\DOCUME~1\trolle\APPLIC~1\SecuROM
2007-07-01 23:10 --------- d-------- C:\Program Files\THQ
2007-07-01 23:08 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\InstallShield
2007-07-01 22:44 --------- d-------- C:\Program Files\Electronic Arts
2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-24 14:01 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\Ventrilo
2007-06-22 22:07 --------- d-------- C:\Program Files\Winamp
2007-06-22 20:41 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\WinRAR
2007-06-22 19:20 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-06-22 19:20 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-06-21 19:43 --------- d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-06-21 19:35 --------- d-------- C:\Program Files\Logitech
2007-06-21 18:29 --------- d-------- C:\Program Files\Ventrilo
2007-06-21 18:29 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-21 18:28 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\ATI
2007-06-21 18:26 --------- d-------- C:\Program Files\ATI Technologies
2007-06-21 18:19 --------- d-------- C:\Program Files\Messenger
2007-06-21 18:04 --------- d-------- C:\Program Files\Common Files\SpeechEngines
2007-06-21 18:04 --------- d-------- C:\Program Files\Common Files\ODBC
2007-06-21 16:58 --------- d-------- C:\Program Files\Lavasoft
2007-06-21 16:53 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-06-21 16:53 348160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-06-21 16:49 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-06-21 16:41 --------- d-------- C:\Program Files\Realtek
2007-06-21 16:38 --------- d-------- C:\Program Files\Analog Devices
2007-06-21 16:30 --------- d-------- C:\Program Files\Intel
2007-06-21 16:18 0 -rahs---- C:\MSDOS.SYS
2007-06-21 16:18 0 -rahs---- C:\IO.SYS
2007-06-21 16:18 0 --a------ C:\CONFIG.SYS
2007-06-21 16:18 0 --a------ C:\AUTOEXEC.BAT
2007-06-21 16:18 --------- d-------- C:\Program Files\microsoft frontpage
2007-06-21 16:17 --------- d--h----- C:\Program Files\WindowsUpdate
2007-06-21 16:17 --------- d-------- C:\Program Files\Online Services
2007-06-21 16:16 --------- d-------- C:\Program Files\Movie Maker
2007-06-21 16:16 --------- d-------- C:\Program Files\Common Files\MSSoap
2007-06-21 16:15 --------- d-------- C:\Program Files\Windows NT
2007-06-21 16:15 --------- d-------- C:\Program Files\MSN Gaming Zone
2007-06-19 15:33 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 15:24 1036800 --a------ C:\WINDOWS\explorer.exe
2006-06-23 08:48 32768 -ra------ C:\WINDOWS\inf\UpdateUSB.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-07-13 07:12]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 14:44]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 14:44]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-16 16:20]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-01-08 14:29]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
"Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 17:31]
"Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 17:14]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-02-07 15:39]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys
R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys
R3 SenFiltService;SenFilt Service;C:\WINDOWS\system32\drivers\Senfilt.sys


Contents of the 'Scheduled Tasks' folder
2007-06-23 22:28:03 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-22 00:26:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-22 0:26:44
C:\ComboFix2.txt ... 2007-08-22 00:25
C:\ComboFix3.txt ... 2007-08-22 00:18

--- E O F ---
nog s gedaan em vond de trojan nu op m'n D schijf(waar supcom inzat) eerts vond hij hem op de C schijf

* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
• Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
• Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
• Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
• Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
• Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
• Klik daarna de groene pijl rechts om de scan te starten.
• Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
• Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
  
• Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
  
  
  
  Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
• Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
• Sluit daarna Dr.Web Cureit.
• Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
• Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.

ik denk aan valse meldingen van avg want dr.web vond ook niets(is nog eens aan het herscannen)

EDIT

redbull2580 zei:

bij mij zegt mijn virus scanner dat er een virus in de zip zit!!!

Trojan horse Generic6
AVG antivirus

Klik om te vergroten...

gevonden in shooter general forum kzat ook op 9lives en kreeg die melding heb wel die bioshock demo nie ge download(had em wel gedaan)

EDIT2 niets gevonden en kan ook geen log tonen van cureit

de laatste uren geen meldingen meer gehad.avg,spybot en dr. nogiets hebben niets gevonden en hier nog een logje

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:49:37, on 22/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\CPUCooL\CooLSrv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://update.zonelabs.com/checkupd...0&License=1&Language=EN&Query=Manual&OEM=1038
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4732 bytes

ComboFix 07-08-17.2 - "trolle" 2007-08-22 7:27:00.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.1417 [GMT 2:00]


((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 )))))))))))))))))))))))))))))))


2007-08-22 01:29 <DIR> d-------- C:\DOCUME~1\trolle\DoctorWeb
2007-08-22 00:14 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-21 22:46 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-29 23:18 40,960 --a------ C:\WINDOWS\system32\psfind.dll
2007-07-29 23:18 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2007-07-25 23:37 3,670,016 --a------ C:\DOCUME~1\trolle\ntuser.dat


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-16 04:21 --------- d-------- C:\Program Files\World of Warcraft
2007-08-10 22:19 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-10 22:19 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-07-29 23:14 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-20 00:14 --------- d-------- C:\Program Files\MSN Messenger
2007-07-19 13:48 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\Command & Conquer 3 Tiberium Wars
2007-07-04 22:17 --------- d-------- C:\Program Files\CPUCooL
2007-07-02 14:45 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-07-02 14:45 --------- dr-h----- C:\DOCUME~1\trolle\APPLIC~1\SecuROM
2007-07-01 23:10 --------- d-------- C:\Program Files\THQ
2007-07-01 23:08 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\InstallShield
2007-07-01 22:44 --------- d-------- C:\Program Files\Electronic Arts
2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-24 14:01 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\Ventrilo
2007-06-22 22:07 --------- d-------- C:\Program Files\Winamp
2007-06-22 20:41 --------- d-------- C:\DOCUME~1\trolle\APPLIC~1\WinRAR
2007-06-22 19:20 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-06-22 19:20 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-06-21 16:53 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-06-21 16:53 348160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-06-21 16:18 0 -rahs---- C:\MSDOS.SYS
2007-06-21 16:18 0 -rahs---- C:\IO.SYS
2007-06-21 16:18 0 --a------ C:\CONFIG.SYS
2007-06-21 16:18 0 --a------ C:\AUTOEXEC.BAT
2007-06-19 15:33 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 15:24 1036800 --a------ C:\WINDOWS\explorer.exe
2006-06-23 08:48 32768 -ra------ C:\WINDOWS\inf\UpdateUSB.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-07-13 07:12]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 14:44]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 14:44]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-16 16:20]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-01-08 14:29]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
"Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 17:31]
"Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 17:14]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 00:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-02-07 15:39]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys
R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys
R3 SenFiltService;SenFilt Service;C:\WINDOWS\system32\drivers\Senfilt.sys


Contents of the 'Scheduled Tasks' folder
2007-06-23 22:28:03 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-22 07:27:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-22 7:27:39
C:\ComboFix2.txt ... 2007-08-22 03:29
C:\ComboFix3.txt ... 2007-08-22 00:26

--- E O F ---

Deze mag je nog fixen in hijackthis:


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Voor de rest ziet het er goed uit.

ok hebk gedaan vree wel merci

Graag gedaan.