Archief - Ozdok Trojan.

Beste forumgangers,

Ik zit met een netelig probleem, namelijk dat ik met het overbekende Ozdok Trojan zit. Mijn anti-virus scanner Nod32 herkend de bedreiging maar kan blijkbaar niet verwijderd worden.

Na wat opzoekingswerk kwam ik http://www.spywareremove.com/removeTrojanOzdok.html dit tegen maar ook dat blijkt niet te werken. De tweede manier op de desbetreffende site is manueel uit te voeren maar dan moet men effectief weten waar men mee bezig is.

Ik heb eveneens een Hijackthis.log aangemaakt om te zien of er daar niets vreemd op te zien is dus bij deze alvast hartelijk bedankt om te zoeken naar een oplossing.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:58:52, on 29/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
C:\WINDOWS\java\javaifx4\services.exe
C:\WINDOWS\java\javaifx4\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Soulseek\slsk.exe
C:\Program Files\Foobar2000\foobar2000.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20www.9lives.be
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JavaIFX4 - Unknown owner - C:\WINDOWS\java\javaifx4\services.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 4522 bytes

Het is uiteraard niet de bedoeling dat ik nu heel wat applicaties ga downloaden om te zien waar het probleem zich situeert. Ik ben al een hele dag bezig en ben een beetje ten einde raad.

Greetz Cyaankali

Ik heb via Nod32 een in-depth analysis uitgevoerd en daar wordt het desbetreffende virus wel gevonden.

Bij deze heb ik het dan ook elke keer gedelete en na afloop dacht ik dat het probleem van de baan zou zijn.

De trojan in kwestie wordt blijkbaar opnieuw gevonden door Nod32 dus het probleem is zeker nog niet van de baan.

Greetz Cyaankali

• Download en installeer AVG Anti-Spyware.
• Na de installatie open je AVG Anti-Spyware.
• Onder 'Status' klik je naast 'Resident shield' op Change state. (deze moet op 'Inactive' komen te staan)
  Wil je het Resident shield gebruiken in de toekomst, dan laat je dit op "Active" staan.
• Onder 'Status' klik je bij Last Update op Update now.
  Lukt dit niet, dan ga je in het menu naar 'Update' en klik je bij 'Manual update' op de knop Start update.
  
• Onder 'Scanner' ga je naar de tab 'Settings' en zorg je voor de volgende instellingen:
  • onder 'How to act?', klik je op 'Recommended actions' en selecteer je Quarantine.
  • onder 'How to scan?', zorg je dat alle opties geselecteerd zijn.
  • onder 'Possibly unwanted software:', zorg je dat alle opties geselecteerd zijn.
  • onder 'Reports:', selecteer je Automatically generate report after every scan.
  • onder 'Reports:', verwijder je het vinkje bij Only if threats were found.
  • onder 'What to scan?', selecteer je Scan every file.
• Sluit AVG Anti-Spyware. Laat het nog niet scannen.
• Start de computer op in veilige modus. Hoe je dit doet kan je hier lezen.
• Start AVG Anti-Spyware.
• Klik in het menu op 'Scanner'
• Kies Complete system scan.
• AVG Anti-Spyware gaat nu je volledige computer scannen.
• Als de scan beëindigd is, klik je onderaan op de knop Apply all Actions.
• Wacht to je de melding krijgt 'All actions have been applied'.
• Ga in het menu naar 'Reports', en klik op de knop 'Save report as' en sla het rapport van de scan op op je bureaublad.
• Sluit AVG Anti-Spyware af.
• Herstart de computer in normale modus en post het rapport van AVG Anti-Spyware.

Indien je het rapport niet kan vinden start dan AVG Anti-Spyware opnieuw.
Kies het menu Reports.
In het linkse venster krijg je een overzicht van de gemaakte rapporten.
Selecteer de meest recente (opbouw is datum - uur), en in het rechtse venster zie je nu de inhoud van het scanrapport verschijnen.
Kopieer de inhoud van dit venster en plak het in je volgende post.

Hoi Jurgenv1,

Ik heb alles uitgevoerd zoals in jou post beschreven stond maar het enige dat ik niet kon doen was het opslagen van een rapport. Ik heb mijn computer opnieuw opgestart, AVG geopend en ook daar kon ik geen rapporten terugvinden.

Greetz Cyaankali

Ik neem aan Jurgenv1 dat het probleem van de baan is. Ik heb Nod32 even niet meer laten lopen dus ik heb geen zicht meer op het gebeuren.

Een rapport bij AVG heb ik nog steeds niet ter beschikking dus wat dat betreft kan ik je niet op de hoogte houden. Als er nog zaken zijn die je me eventueel kan meedelen dan zou dat fantastisch zijn.

Nogmaals bedankt voor alles en wie weet tot een volgend advies.

Greetz Cyaankali

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

Bij deze geef ik je de vooropgestelde logs.

ComboFix 08-04-01.2 - Administrator 2008-04-02 2:24:51.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2066 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
ADS - svchost.exe: deleted 24064 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\pskill.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ICF
-------\Service_ICF


((((((((((((((((((((((((( Files Created from 2008-03-02 to 2008-04-02 )))))))))))))))))))))))))))))))
.

2008-03-30 14:37 . 2008-03-30 14:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-30 14:37 . 2008-03-30 14:37 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-03-30 14:37 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-29 17:32 . 2008-03-29 17:32 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-03-29 17:32 . 2008-03-29 17:32 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab
2008-03-29 15:46 . 2008-03-29 17:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-29 03:47 . 2008-03-29 04:00 <DIR> d-------- C:\Program Files\ICQ6
2008-03-29 03:47 . 2008-03-29 04:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\ICQ
2008-03-25 14:17 . 2008-03-25 14:17 <DIR> d-------- C:\WINDOWS\system\KEEPER
2008-03-25 14:17 . 1996-01-09 04:38 283,648 --a------ C:\WINDOWS\uninst.exe
2008-03-25 13:53 . 2008-03-25 13:53 <DIR> d-------- C:\Documents and Settings\Administrator\Bullfrog
2008-03-25 13:52 . 1996-02-08 03:52 284,160 --a------ C:\WINDOWS\unin0413.exe
2008-03-20 00:26 . 2008-03-20 00:26 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-03-13 22:51 . 2007-10-12 16:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-03-13 22:51 . 2007-10-12 16:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2008-03-13 22:51 . 2007-10-02 10:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2008-03-13 22:51 . 2007-10-22 04:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
2008-03-12 23:13 . 2008-03-12 23:13 307,968 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-03-12 23:13 . 2008-02-27 14:15 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-02 00:26 --------- d-----w C:\Documents and Settings\Administrator\Application Data\foobar2000
2008-04-02 00:26 --------- d-----w C:\Documents and Settings\Administrator\Application Data\.purple
2008-04-02 00:11 --------- d-----w C:\Program Files\Soulseek
2008-04-02 00:10 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Skype
2008-04-01 20:55 --------- d-----w C:\Program Files\FlashFXP
2008-04-01 19:48 --------- d-----w C:\Program Files\mIRC
2008-04-01 17:32 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-03-30 15:22 --------- d-----w C:\Program Files\Eset
2008-03-29 01:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-26 02:02 --------- d-----w C:\Program Files\The GodFather
2008-03-19 14:59 --------- d-----w C:\Documents and Settings\Administrator\Application Data\gtk-2.0
2008-03-12 21:13 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-02-28 16:31 --------- d-----w C:\Program Files\Logitech
2008-02-28 16:31 --------- d-----w C:\Program Files\Common Files\Logitech
2008-02-23 22:35 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-02-23 22:35 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_xusb21_01005.Wdf
2008-02-20 02:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-02-20 02:45 --------- d-----w C:\Documents and Settings\Administrator\Application Data\TuneUp Software
2008-02-20 02:43 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-20 00:58 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Thinstall
2008-02-19 01:02 --------- d-----w C:\Documents and Settings\Administrator\Application Data\GetRightToGo
2008-02-16 01:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-02-16 01:24 --------- d-----w C:\Program Files\VDMSound
2008-02-15 22:51 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ViStart
2008-02-15 22:47 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Styler
2008-02-09 01:49 22,328 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-02 15:04 --------- d-----w C:\Documents and Settings\Administrator\Application Data\VMware
2007-10-15 10:35 22,328 -c--a-w C:\Documents and Settings\Administrator\Application Data\PnkBstrK.sys
2007-08-21 11:03 138,220 -c--a-w C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DeathAdder"="C:\Program Files\Razer\DeathAdder\razerhid.exe" [2007-09-07 15:54 159744]
"HybridTM_A"="C:\Program Files\HybridTM_IR(A)\RC620_A.exe" [2006-04-24 05:43 106496]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-21 17:53 949376]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
TMMonitor.lnk - C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe [2007-11-06 02:40:30 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Glass2k]
E:\Setupfiles\Glass2k.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmware-tray]
--a--c--- 2007-05-01 23:52 68400 C:\Program Files\VMware\VMware Workstation\vmware-tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"VMware hqtray"="C:\Program Files\VMware\VMware Workstation\hqtray.exe"
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"nForce Tray Options"=sstray.exe /r

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BitLord\\BitLord.exe"=
"C:\\Program Files\\Soulseek\\slsk.exe"=
"C:\\WINDOWS\\java\\javaifx4\\spoolsv.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\WINDOWS\\system32\\svchost.exe"=
"D:\\C & C Generals\\game.dat"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1024:TCP"= 1024:TCPpoolsv

R0 Si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\si3112r.sys [2006-01-12 13:56]
R2 JavaIFX4;JavaIFX4;C:\WINDOWS\java\javaifx4\services.exe [2006-10-17 14:04]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2007-11-16 17:04]
R3 DAdderFltr;DeathAdder Mouse;C:\WINDOWS\system32\drivers\dadder.sys [2007-08-02 17:32]
R3 TridDev;Freecom USB Hybrid TV Device;C:\WINDOWS\system32\DRIVERS\Triddev.sys [2005-04-26 23:01]
R3 TridVid;Freecom USB Hybrid TV Receiver;C:\WINDOWS\system32\DRIVERS\TridVid.sys [2006-04-04 23:15]
S2 RoxLiveShare10;LiveShare P2P Server 10;"C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe" []
S2 SessionLauncher;SessionLauncher;C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe []
S3 CyUsb;Cypress Generic USB Driver;C:\WINDOWS\system32\Drivers\CyUsb.sys [2005-03-03 19:47]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-03-12 23:13]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57b65e3d-be98-11db-9c8a-806d6172696f}]
\Shell\AutoRun\command - L:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79de14b4-dc33-11dc-9262-806d6172696f}]
\Shell\AutoRun\command - H:\Bin\asusqfe.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6778F1EE-80BB-4F27-BC69-F91B843782CD}]
C:\Documents and Settings\Administrator\Application Data\Microsoft\cfgmgr.vbs
.
Contents of the 'Scheduled Tasks' folder
"2008-04-02 00:28:57 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-02 02:29:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\java\javaifx4\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
.
**************************************************************************
.
Completion time: 2008-04-02 2:31:42 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2008-04-02 00:31:33
Pre-Run: 3,954,114,560 bytes free
Post-Run: 3,853,262,848 bytes free
.
2008-03-13 09:23:59 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:34:44, on 2/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\java\javaifx4\services.exe
C:\WINDOWS\java\javaifx4\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20www.9lives.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JavaIFX4 - Unknown owner - C:\WINDOWS\java\javaifx4\services.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 4867 bytes

Greetz Cyaankali

Ziet er goed uit, zijn er nog problemen?

Hoi Jurgenv1,

Bij mijn weten niet neen. Alvast bedankt voor de moeite en ik heb zowaar weer iets bijgeleerd.

Greetz Cyaankali

Jurgenv1 zei:

Ziet er goed uit, zijn er nog problemen?

Klik om te vergroten...

Graag gedaan.