Archief - miserie

Logfile of HijackThis v1.99.1
Scan saved at 19:12:27, on 14/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Sophie\Application Data\?ecurity\u?erinit.exe
C:\Program Files\Hijack This\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {E3254844-A0D8-A10A-D14A-F94DF7FB24BC} - C:\WINDOWS\system32\ausmad.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F3 - REG:win.ini: run=C:\WINDOWS\inet20000\services.exe
O2 - BHO: C:\WINDOWS\system32\zsPeCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zsPeCrypt.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Microsoft WPCEmail] C:\WINDOWS\inet20000\svchost.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Mcmt] "C:\DOCUME~1\Sophie\APPLIC~1\YSTEM~1\rundll32.exe" -vt yazb
O4 - HKCU\..\Run: [Uibndses] C:\Documents and Settings\Sophie\Application Data\?ecurity\u?erinit.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\system32\nordsys.exe
O4 - HKCU\..\Run: [system spool] C:\WINDOWS\system32\syspools.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: zXnBBFlCM - {E41FFCAA-4EB5-5600-E7D2-9774BBA60127} - C:\WINDOWS\system32\pcu.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Klik om te vergroten...

Logfile of HijackThis v1.99.1
Scan saved at 18:07:40, on 15/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {E3254844-A0D8-A10A-D14A-F94DF7FB24BC} - C:\WINDOWS\system32\ausmad.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: C:\WINDOWS\system32\zsPeCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zsPeCrypt.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mcmt] "C:\DOCUME~1\Sophie\APPLIC~1\YSTEM~1\rundll32.exe" -vt yazb
O4 - HKCU\..\Run: [Uibndses] C:\Documents and Settings\Sophie\Application Data\?ecurity\u?erinit.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\system32\nordsys.exe
O4 - HKCU\..\Run: [system spool] C:\WINDOWS\system32\syspools.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: zXnBBFlCM - {E41FFCAA-4EB5-5600-E7D2-9774BBA60127} - C:\WINDOWS\system32\pcu.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Klik om te vergroten...

Sophie - 06-12-14 21:53:47,67 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Sophie\Bureaublad"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\comdlg64.dll
C:\Program Files\Common Files\{341FFCA9-0647-2067-0512-061005050020}
C:\Program Files\Common Files\{E41FFCA9-0647-2067-0512-061005050020}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Sophie\Application Data\ECURIT~1
C:\QooBox\Purity\Documents and Settings\Sophie\Application Data\YSTEM~1
C:\QooBox\Purity\Documents and Settings\Sophie\Application Data\ECURIT~1\u?erinit.exe
C:\QooBox\Purity\Documents and Settings\Sophie\Application Data\YSTEM~1\?ystem
C:\QooBox\Purity\WINDOWS\system32\SMANTE~1


((((((((((((((((((((((((((((((( Files Created from 2006-11-14 to 2006-12-14 ))))))))))))))))))))))))))))))))))


2006-12-14 21:37 684,032 --a------ C:\WINDOWS\system32\libeay32.dll
2006-12-14 21:37 155,648 --a------ C:\WINDOWS\system32\ssleay32.dll
2006-12-14 21:37 15,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2006-12-14 21:37 15,360 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2006-12-14 21:37 14,848 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys
2006-12-14 21:37 122,368 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2006-12-14 21:37 <DIR> d-------- C:\Program Files\Webroot
2006-12-14 21:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2006-12-14 21:36 <DIR> d-------- C:\Documents and Settings\Sophie\Application Data\Webroot
2006-12-14 18:23 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-14 18:23 <DIR> d-------- C:\Program Files\Grisoft
2006-12-13 21:31 <DIR> d-------- C:\Program Files\Lavasoft
2006-12-13 21:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-12-13 21:28 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
2006-12-13 21:28 <DIR> d-------- C:\Program Files\Hitman Pro
2006-12-13 21:01 57,384 --a------ C:\WINDOWS\system32\avsda.dll
2006-12-13 21:01 32,768 --a------ C:\WINDOWS\system32\drivers\avgntdd.sys
2006-12-13 21:01 14,848 --a------ C:\WINDOWS\system32\drivers\avgntmgr.sys
2006-12-13 21:01 <DIR> d-------- C:\Program Files\AntiVir PersonalEdition Classic
2006-12-13 21:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic
2006-12-13 20:38 <DIR> d-------- C:\Program Files\Hijack This
2006-12-13 20:27 <DIR> d-------- C:\WINDOWS\pss
2006-12-08 11:51 29,696 --------- C:\WINDOWS\system32\rpcc.dll
2006-12-08 11:50 81,920 --a------ C:\WINDOWS\system32\Packet.dll
2006-12-08 11:50 61,440 --a------ C:\WINDOWS\system32\WanPacket.dll
2006-12-08 11:50 53,299 --a------ C:\WINDOWS\system32\pthreadVC.dll
2006-12-08 11:50 32,512 --a------ C:\WINDOWS\system32\drivers\npf.sys
2006-12-08 11:50 233,472 --a------ C:\WINDOWS\system32\wpcap.dll
2006-12-04 18:05 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2006-11-28 20:44 <DIR> d-------- C:\Documents and Settings\Sophie\Application Data\Macromedia
2006-11-26 13:58 <DIR> d-------- C:\Documents and Settings\Sophie\Contacts
2006-11-24 10:09 <DIR> d-------- C:\Program Files\FirstClass
2006-11-15 20:14 95,232 --a------ C:\WINDOWS\system32\Lfkodak.dll
2006-11-15 20:14 93,184 --a------ C:\WINDOWS\system32\lftif70n.dll
2006-11-15 20:14 77,824 --a------ C:\WINDOWS\system32\ipeapi12.dll
2006-11-15 20:14 667,648 --a------ C:\WINDOWS\system32\ipeistor12.dll
2006-11-15 20:14 55,808 --a------ C:\WINDOWS\system32\lffax70n.dll
2006-11-15 20:14 55,296 --a------ C:\WINDOWS\system32\ltfil70n.DLL
2006-11-15 20:14 350,208 --a------ C:\WINDOWS\system32\ltkrn70n.dll
2006-11-15 20:14 35,328 --a------ C:\WINDOWS\system32\lffpx70n.dll
2006-11-15 20:14 331,776 --a------ C:\WINDOWS\system32\ipebase12.dll
2006-11-15 20:14 32,768 --a------ C:\WINDOWS\system32\lfgif70n.dll
2006-11-15 20:14 32,768 --a------ C:\WINDOWS\system32\hpsj32.dll
2006-11-15 20:14 32,768 --a------ C:\WINDOWS\system32\hpgreg32.dll
2006-11-15 20:14 306,688 --a------ C:\WINDOWS\system32\Lffpx7.dll
2006-11-15 20:14 24,576 --a------ C:\WINDOWS\system32\lfpcx70n.dll
2006-11-15 20:14 224,768 --a------ C:\WINDOWS\system32\LFCMP70n.DLL
2006-11-15 20:14 118,784 --a------ C:\WINDOWS\system32\hpsjvset.dll
2006-11-15 20:14 111,104 --a------ C:\WINDOWS\system32\lfpng70n.dll
2006-11-15 20:14 1,080 --a------ C:\WINDOWS\AUTOLNCH.REG
2006-11-15 20:13 95,902 --a------ C:\WINDOWS\system32\drivers\stihp2k.sys
2006-11-15 20:13 49,152 --a------ C:\WINDOWS\system32\Hpgdtppg.dll
2006-11-15 20:13 327,427 --a------ C:\WINDOWS\IsUn0413.exe
2006-11-15 20:13 28,672 --a------ C:\WINDOWS\system32\hpgdtup.dll
2006-11-15 20:13 135,168 --a------ C:\WINDOWS\system32\hpgdtt.dll
2006-11-15 20:13 <DIR> d-------- C:\sj652
2006-11-15 20:13 <DIR> d-------- C:\Program Files\Hewlett-Packard


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required

2006-12-14 21:54 -------- d-------- C:\Program Files\Common Files
2006-11-28 20:15 -------- d---s---- C:\Documents and Settings\Sophie\Application Data\Microsoft
2006-11-27 19:50 -------- d-------- C:\Program Files\MSN Messenger
2006-11-24 10:09 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-24 10:09 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-11-12 19:21 -------- d-------- C:\Program Files\Winamp
2006-11-12 19:14 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-11-12 18:25 -------- d-------- C:\Program Files\Microsoft Office
2006-11-12 18:24 -------- d-------- C:\Program Files\Snapshot Viewer
2006-11-12 18:19 -------- d-------- C:\Program Files\Microsoft Visual Studio
2006-11-12 18:19 -------- d-------- C:\Program Files\Common Files\Designer
2006-11-12 18:17 -------- d-------- C:\Program Files\Common Files\System
2006-11-12 17:58 -------- d-------- C:\Program Files\Windows Media Player
2006-11-12 17:55 -------- d-------- C:\Program Files\Internet Explorer
2006-11-12 17:41 -------- d-------- C:\Documents and Settings\Sophie\Application Data\Identities
2006-11-12 17:25 -------- d-------- C:\Program Files\PowerQuest
2006-11-12 17:24 -------- d-------- C:\Program Files\WinRAR
2006-11-12 16:59 -------- d-------- C:\Program Files\Messenger
2006-11-12 16:56 62 --ahs---- C:\Documents and Settings\Sophie\Application Data\desktop.ini
2006-11-12 16:56 -------- d-------- C:\Program Files\Outlook Express
2006-11-12 16:56 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-11-12 16:56 -------- d-------- C:\Program Files\Common Files\ODBC
2006-11-12 16:29 -------- d-------- C:\Program Files\AMD
2006-11-12 16:25 -------- d-------- C:\Program Files\Realtek
2006-11-12 16:14 -------- d--h----- C:\Program Files\Uninstall Information
2006-11-12 16:08 -------- d-------- C:\Program Files\xerox
2006-11-12 16:08 -------- d-------- C:\Program Files\microsoft frontpage
2006-11-12 16:07 0 -rahs---- C:\MSDOS.SYS
2006-11-12 16:07 0 -rahs---- C:\IO.SYS
2006-11-12 16:07 0 --a------ C:\CONFIG.SYS
2006-11-12 16:07 0 --a------ C:\AUTOEXEC.BAT
2006-11-12 16:06 -------- d--h----- C:\Program Files\WindowsUpdate
2006-11-12 16:06 -------- d-------- C:\Program Files\Online Services
2006-11-12 16:05 -------- d-------- C:\Program Files\NetMeeting
2006-11-12 16:05 -------- d-------- C:\Program Files\Movie Maker
2006-11-12 16:05 -------- d-------- C:\Program Files\ComPlus Applications
2006-11-12 16:05 -------- d-------- C:\Program Files\Common Files\Services
2006-11-12 16:05 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-11-12 16:04 -------- d-------- C:\Program Files\Windows NT
2006-11-12 16:04 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-10-11 17:26 58880 --a------ C:\WINDOWS\system32\pnrpnsp.dll
2006-10-11 17:26 553984 --a------ C:\WINDOWS\system32\p2psvc.dll
2006-10-11 17:26 313344 --a------ C:\WINDOWS\system32\p2pgraph.dll
2006-10-11 17:26 153088 --a------ C:\WINDOWS\system32\p2p.dll
2006-10-11 17:26 116224 --a------ C:\WINDOWS\system32\p2pnetsh.dll
2006-10-11 17:26 104960 --a------ C:\WINDOWS\system32\p2pgasvc.dll
2006-09-28 16:05 2414360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2006-09-28 16:05 237848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2006-09-28 16:04 68888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2006-09-28 16:03 15128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Mcmt"="\"C:\\DOCUME~1\\Sophie\\APPLIC~1\\YSTEM~1\\rundll32.exe\" -vt yazb"
"Uibndses"="C:\\Documents and Settings\\Sophie\\Application Data\\?ecurity\\u?erinit.exe"
"Nord"="C:\\WINDOWS\\system32\\nordsys.exe"
"system spool"="C:\\WINDOWS\\system32\\syspools.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"
"{8A5849C4-93F3-429D-FF34-660A2068897C}"="OpenGL additional"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"zXnBBFlCM"="{E41FFCAA-4EB5-5600-E7D2-9774BBA60127}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\PROGRA~1\\MSNMES~1\\msnmsgr.exe\" /background"
"inimapping"="0"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rpcc

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService
Completion time: 06-12-14 21:54:51.51
C:\ComboFix.txt ... 06-12-14 21:54

Klik om te vergroten...

************************* Rustock.b-fix -- By ejvindh *************************
za 16/12/2006 11:38:04,65


******************* Pre-run Status of system *******************

Rootkit driver PE386 is found. Starting the unload-procedure....
Examine the Avenger-logfile in order to assess the success of the unload-procedure

Rustock.b-ADS attached to the System32-folder:
No streams found.


******************* Post-run Status of system *******************

Rustock.b-driver on the system: NONE!

Rustock.b-ADS attached to the System32-folder:
No streams found.


******************************* End of Logfile ********************************

Klik om te vergroten...

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\yuixbqcr

*******************

Script file located at: \??\C:\Documents and Settings\jxksfuyo.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver PE386 unloaded successfully.
Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.

Completed script processing.

*******************

Finished! Terminate.

Klik om te vergroten...

Logfile of HijackThis v1.99.1
Scan saved at 12:01:42, on 16/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {E3254844-A0D8-A10A-D14A-F94DF7FB24BC} - C:\WINDOWS\system32\ausmad.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: C:\WINDOWS\system32\zsPeCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zsPeCrypt.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mcmt] "C:\DOCUME~1\Sophie\APPLIC~1\YSTEM~1\rundll32.exe" -vt yazb
O4 - HKCU\..\Run: [Uibndses] C:\Documents and Settings\Sophie\Application Data\?ecurity\u?erinit.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\system32\nordsys.exe
O4 - HKCU\..\Run: [system spool] C:\WINDOWS\system32\syspools.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: zXnBBFlCM - {E41FFCAA-4EB5-5600-E7D2-9774BBA60127} - C:\WINDOWS\system32\pcu.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Klik om te vergroten...

• 
  Na de installatie, open AVG Anti-Spyware:
  * onder "Status", klik op Change state naast "Resident shield". (wijzig van active naar inactive!)
  * onder "Update", klik op de Start update knop.
  * onder "Scanner", tab "Settings":
  • - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine. (ZEER BELANGRIJK!)
    * onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
  Sluit AVG Anti-Spyware. Laat het nog niet scannen.

• * Klik op Scan en kies Complete System Scan.
  Na de scan; volg onderstaande instructies :
  BELANGRIJK : Klik niet op de "Save Scan Report" knop vooraleer je de "Apply all Actions" knop hebt aangeklikt !
  * Draag er zorg voor dat Set all elements to: op Quarantine staat (1),
  zoniet klik op de link en kies Quarantine in de popup menu. (2)
  (Dit geldt niet voor cookies, deze worden onveranderlijk gedelete !)
  * Onderaan het venster klik op de Apply all Actions knop. (3)
  
  
  
  * Wanneer je de melding krijgt 'All actions have been applied', klik je onderaan op de knop Save Report.

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 14:39:45 16/12/2006

+ Scan result:

C:\WINDOWS\system32\lzx32.sys -> Hijacker.Costrat.l : Cleaned.
C:\Documents and Settings\Sophie\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned.

::Report end

Klik om te vergroten...

Logfile of HijackThis v1.99.1
Scan saved at 14:44:46, on 16/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijack This\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {E3254844-A0D8-A10A-D14A-F94DF7FB24BC} - C:\WINDOWS\system32\ausmad.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: C:\WINDOWS\system32\zsPeCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zsPeCrypt.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mcmt] "C:\DOCUME~1\Sophie\APPLIC~1\YSTEM~1\rundll32.exe" -vt yazb
O4 - HKCU\..\Run: [Uibndses] C:\Documents and Settings\Sophie\Application Data\?ecurity\u?erinit.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\system32\nordsys.exe
O4 - HKCU\..\Run: [system spool] C:\WINDOWS\system32\syspools.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: zXnBBFlCM - {E41FFCAA-4EB5-5600-E7D2-9774BBA60127} - C:\WINDOWS\system32\pcu.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Klik om te vergroten...