Archief - Virtumonde... :(

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
-

-White-Wolf-

Legacy Member
Hallo, Iemand die mij kan helpen?

Ik heb een vervelend probleem... :sad:
Bij installeren van een programma heb ik waarschijnlijk een virus binnen gekregen. Eset NOD32 geeft aan dat het om Win32/adware.virtumonde application gaat. En zegt wel regelmatig "cleaned by deleting (after reboot)" maar de bewuste dll blijkt altijd terug te komen. Het gaat om vtUnopPI.dll die zich in de System32 folder van WINDOWS bevindt.. Manueel verwijderen gaat niet, wat had je gedacht.

Ondertussen is internet hier aan de trage kant en krijg ik inderdaad af en toe pop ups en meldt NOD32 aan de lopende band nieuwe aanvallen...

Ik heb op verschillende fora al gezocht oa ook hier (met die combofix van Jurgenv1) maar heb denk ik toch nog een beetje hulp nodig voor ik hier heel de boel omzeep help.

Hijack logje...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:59:12, on 3/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"
O4 - HKLM\..\Run: [64a07bfc] rundll32.exe "C:\WINDOWS\system32\ggfaiyla.dll",b
O4 - HKLM\..\Run: [BM67934860] Rundll32.exe "C:\WINDOWS\system32\mopfchae.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [mRouterConfig] "C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden via Bericht(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O8 - Extra context menu item: Verzenden via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O20 - AppInit_DLLs: dvamwh.dll
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7594 bytes

Ziet hier iemand iets verdachts in?? Die bewuste dll, vtUnopPI.dll, staat hier zelfs niet in wat mij al doet vermoeden dat dit niet eenvoudig op te lossen zal zijn.

Probleem is dat ik hier echt niets van ken... Heb wel al is een paar virussen moeten verwijderen vroeger maar daar was altijd een eenduidig stappenplan voor te vinden op internet. Ik heb de indruk dat deze toch iets meer trial and error en ervaring vraagt.

Daarom, HULP GEVRAAGD!!! (Ik kijk stiekem een beetje in de richting van Jurgenv1, hij heeft al eens iemand van dit probleem afgeholpen... maar uiteraard, alle hulp is meer dan welkom!!!)

Alvast bedankt iedereen.

Een wanhopige ziel ;)
-

-White-Wolf-

Legacy Member
ComboFix Gedownload en laten lopen, dit is het log...

ComboFix 08-10-03.04 - Administrator 2008-10-04 0:27:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.513 [GMT 2:00]
Gestart vanuit: C:\Documents and Settings\Administrator\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
* Resident AV is active


WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp2.tmp
C:\Documents and Settings\Administrator\Application Data\inst.exe
C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
C:\WINDOWS\BM67934860.txt
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AayFNXbc.ini
C:\WINDOWS\system32\AayFNXbc.ini2
C:\WINDOWS\system32\alyiafgg.ini
C:\WINDOWS\system32\cbXNFyaA.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-09-03 to 2008-10-03 ))))))))))))))))))))))))))))))
.

2008-10-04 00:31 . 2008-10-04 00:32 1,007,671 ---hs---- C:\WINDOWS\system32\alyiafgg.ini
2008-10-03 23:31 . 2008-10-03 23:31 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-03 23:16 . 2008-10-03 23:16 268 --ah----- C:\sqmdata03.sqm
2008-10-03 23:16 . 2008-10-03 23:16 244 --ah----- C:\sqmnoopt03.sqm
2008-10-03 22:22 . 2008-10-03 22:22 71,168 --a------ C:\WINDOWS\system32\ggfaiyla.dll
2008-10-03 22:21 . 2008-10-03 22:21 <DIR> d-------- C:\ALEXANDER
2008-10-03 22:20 . 2008-10-03 22:20 123,904 --a------ C:\WINDOWS\system32\pnjbxjex.dll
2008-10-03 22:20 . 2008-10-03 22:20 123,904 --a------ C:\WINDOWS\system32\dvamwh.dll
2008-10-03 22:20 . 2008-10-04 00:31 113,053 --a------ C:\WINDOWS\BM67934860.xml
2008-10-03 22:20 . 2008-10-03 22:20 101,888 --a------ C:\WINDOWS\system32\mopfchae.dll
2008-10-03 22:12 . 2008-10-03 22:12 268 --ah----- C:\sqmdata02.sqm
2008-10-03 22:12 . 2008-10-03 22:12 244 --ah----- C:\sqmnoopt02.sqm
2008-10-03 22:11 . 2008-10-03 22:11 <DIR> d-------- C:\Program Files\DVDFab Platinum 4
2008-10-03 22:11 . 2008-10-03 22:16 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Vso
2008-10-03 22:11 . 2008-10-03 22:11 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-10-03 22:11 . 2008-10-03 22:11 47,360 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2008-10-03 22:11 . 2008-10-03 22:11 35,840 --------- C:\WINDOWS\system32\vtUnopPI.dll
2008-10-03 21:37 . 2008-10-03 21:37 <DIR> d-------- C:\CHICKEN RUN
2008-10-03 20:59 . 2008-10-03 20:59 <DIR> d-------- C:\LIONS FOR LAMBS
2008-10-03 16:11 . 2008-10-03 16:11 268 --ah----- C:\sqmdata01.sqm
2008-10-03 16:11 . 2008-10-03 16:11 244 --ah----- C:\sqmnoopt01.sqm
2008-10-03 14:26 . 2008-10-03 14:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\U3
2008-09-30 23:52 . 2008-09-30 23:52 268 --ah----- C:\sqmdata00.sqm
2008-09-30 23:52 . 2008-09-30 23:52 244 --ah----- C:\sqmnoopt00.sqm
2008-09-24 21:19 . 2008-09-24 21:19 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-22 15:45 . 2008-09-22 15:45 2,914 --a------ C:\WINDOWS\system32\SHORTCUT.INI
2008-09-22 15:44 . 2008-09-22 15:46 128 --a------ C:\WINDOWS\system32\REMOTEDEVICE.INI
2008-09-22 14:09 . 2004-08-04 01:03 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-09-22 14:09 . 2004-08-04 01:03 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-09-22 14:09 . 2001-09-06 19:04 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-09-22 14:09 . 2001-09-06 19:04 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-09-22 14:09 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-09-22 14:09 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-09-21 19:34 . 2008-09-21 19:34 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-09-21 19:34 . 2008-09-21 19:34 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-09-21 19:33 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2008-09-21 19:33 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-21 19:33 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-21 19:31 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-09-21 19:31 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-09-21 19:31 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-09-21 19:31 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-09-21 19:31 . 2006-03-03 21:03 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-09-21 19:31 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-09-21 19:31 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-09-21 19:30 . 2008-09-21 19:31 <DIR> d-------- C:\Program Files\HP
2008-09-21 19:30 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-21 19:30 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-21 19:29 . 2008-09-21 19:41 112,943 --a------ C:\WINDOWS\hpoins11.dat
2008-09-21 19:29 . 2006-04-13 02:04 49,664 --a------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-09-21 19:29 . 2006-04-13 02:04 21,568 --a------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-09-21 19:29 . 2006-04-13 02:04 16,496 --a------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-09-21 19:28 . 2006-04-13 02:02 827,392 --a------ C:\WINDOWS\system32\hpotiop2.dll
2008-09-21 19:28 . 2006-04-13 02:02 659,456 --a------ C:\WINDOWS\system32\hpowiax2.dll
2008-09-21 19:28 . 2006-04-13 02:04 282,624 --a------ C:\WINDOWS\system32\HPZc3212.dll
2008-09-21 19:28 . 2006-04-13 02:02 254,026 --a------ C:\WINDOWS\system32\hpovst09.dll
2008-09-21 19:28 . 2005-07-19 03:38 98,304 --a------ C:\WINDOWS\system32\hpzjsn01.dll
2008-09-21 19:28 . 2006-01-04 10:12 77,824 --a------ C:\WINDOWS\system32\HPZIDS01.dll
2008-09-21 19:28 . 2006-05-06 08:26 6,947 --a------ C:\WINDOWS\hpomdl11.dat
2008-09-21 18:44 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-21 18:44 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-09-19 13:15 . 2008-10-04 00:32 4,756 --a------ C:\WINDOWS\system32\LOCALSERVICE.INI
2008-09-19 13:15 . 2008-10-04 00:32 106 --a------ C:\WINDOWS\system32\LOCALDEVICE.INI
2008-09-19 13:12 . 2008-09-19 13:12 0 --a------ C:\WINDOWS\system32\BSPRINT.INI
2008-09-19 13:11 . 2008-09-19 13:11 <DIR> d-------- C:\Program Files\IVT Corporation
2008-09-19 13:11 . 2008-09-19 13:13 32 --a------ C:\WINDOWS\0
2008-09-19 13:11 . 2008-09-19 13:11 0 --a------ C:\WINDOWS\system32\0
2008-09-19 13:09 . 2008-09-19 13:10 <DIR> d-------- C:\Program Files\Telemeter 3.0
2008-09-16 12:08 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
2008-09-16 12:08 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
2008-09-16 12:08 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-09-16 11:40 . 2008-09-16 11:40 <DIR> d-------- C:\BEHIND ENEMY LINES
2008-09-16 10:50 . 2008-09-16 10:50 <DIR> d-------- C:\GARFIELD
2008-09-16 10:09 . 2008-09-16 10:09 <DIR> d-------- C:\AUGUST RUSH
2008-09-16 09:41 . 2008-09-16 09:42 <DIR> d-------- C:\CHARLIE WILSONS WAR
2008-09-15 20:43 . 2008-09-16 09:31 <DIR> d-------- C:\Documents and Settings\Administrator\Contacts
2008-09-15 20:26 . 2008-09-15 20:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-15 20:16 . 2008-09-16 09:40 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-15 20:15 . 2008-06-14 20:00 272,640 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-15 20:10 . 2008-09-15 20:42 <DIR> d-------- C:\Program Files\Windows Live
2008-09-15 20:10 . 2008-09-15 20:42 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-09-15 20:10 . 2008-09-15 20:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-15 20:10 . 2006-03-21 05:23 23,040 --------- C:\WINDOWS\kb913800.exe
2008-09-15 20:06 . 2008-06-23 18:43 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-15 20:06 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-15 20:06 . 2007-03-08 07:11 1,032,192 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-15 20:06 . 2008-06-23 18:43 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-15 20:06 . 2008-06-23 18:43 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-15 20:06 . 2008-06-23 18:43 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-15 20:06 . 2008-06-23 18:43 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-15 20:06 . 2008-06-23 18:43 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-15 20:06 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-15 19:17 . 2008-09-15 19:27 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\MyPhoneExplorer
2008-09-15 19:16 . 2008-09-15 19:17 <DIR> d-------- C:\Program Files\MyPhoneExplorer
2008-09-15 19:16 . 2008-09-15 20:02 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-15 14:49 . 2008-09-15 14:49 <DIR> d-------- C:\Program Files\QuickTime
2008-09-15 14:49 . 2008-09-15 14:49 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-09-15 14:49 . 2008-09-15 14:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-15 14:48 . 2008-09-15 14:48 <DIR> d-------- C:\Program Files\Apple Software Update
2008-09-15 14:48 . 2008-09-15 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-15 14:47 . 2008-09-15 14:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-09-15 14:17 . 2008-09-15 14:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-15 14:17 . 2008-09-15 14:17 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-15 14:13 . 2008-09-15 14:13 109,568 --a------ C:\WINDOWS\system32\drivers\zebrmdmc.sys
2008-09-15 14:13 . 2008-09-15 14:13 109,568 --a------ C:\WINDOWS\system32\drivers\zebrmdm.sys
2008-09-15 14:13 . 2008-09-15 14:13 91,264 --a------ C:\WINDOWS\system32\drivers\zebrsce.sys
2008-09-15 14:13 . 2008-09-15 14:13 83,200 --a------ C:\WINDOWS\system32\drivers\zebrbus.sys
2008-09-15 14:13 . 2008-09-15 14:13 25,214 --a------ C:\WINDOWS\system32\memorystick.ico
2008-09-15 14:13 . 2008-09-15 14:13 14,848 --a------ C:\WINDOWS\system32\drivers\zebrmdfl.sys
2008-09-15 14:13 . 2008-09-15 14:13 12,160 --a------ C:\WINDOWS\system32\drivers\zebrcmnt.sys
2008-09-15 14:13 . 2008-09-15 14:13 12,160 --a------ C:\WINDOWS\system32\drivers\zebrcm.sys
2008-09-15 14:06 . 2008-09-15 14:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony
2008-09-15 14:06 . 2008-09-15 14:06 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sony
2008-09-15 14:05 . 2008-09-15 14:05 <DIR> d-------- C:\Program Files\Sony
2008-09-15 13:57 . 2008-09-15 18:27 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Teleca
2008-09-15 13:55 . 2008-01-15 10:44 63,360 -ra------ C:\WINDOWS\system32\drivers\zebrceb.sys
2008-09-15 13:55 . 2008-01-15 10:44 12,160 -ra------ C:\WINDOWS\system32\drivers\zebrwhnt.sys
2008-09-15 13:55 . 2008-01-15 10:44 12,160 -ra------ C:\WINDOWS\system32\drivers\zebrwh.sys
2008-09-15 13:54 . 2008-09-15 13:54 <DIR> d-------- C:\Program Files\Symbian
2008-09-15 13:54 . 2008-09-15 14:12 <DIR> d-------- C:\Program Files\Sony Ericsson
2008-09-15 13:54 . 2008-09-15 13:54 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-09-15 13:54 . 2008-09-15 13:54 <DIR> d-------- C:\Program Files\Intuwave
2008-09-15 13:54 . 2008-09-15 13:54 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2008-09-15 13:54 . 2008-09-15 13:54 <DIR> d-------- C:\Program Files\Common Files\Sony Ericsson Shared
2008-09-15 13:54 . 2008-09-15 13:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Teleca

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-15 11:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-14 11:59 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-13 18:38 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ESET
2008-09-13 18:37 --------- d-----w C:\Program Files\ESET
2008-09-13 18:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-09-13 18:31 --------- d-----w C:\Program Files\Synaptics
2008-09-13 18:24 20,152 ----a-w C:\WINDOWS\system32\drivers\INFCACHE.1
2008-09-13 18:20 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-13 17:55 9,388 ----a-w C:\WINDOWS\system32\drivers\iaStor.PNF
2008-09-13 17:55 7,280 ----a-w C:\WINDOWS\system32\drivers\viamraid.PNF
2008-09-13 17:55 63,240 ----a-w C:\WINDOWS\system32\drivers\Si3112r.PNF
2008-09-13 17:55 6,984 ----a-w C:\WINDOWS\system32\drivers\SiSRaid.PNF
2008-09-13 17:55 12,432 ----a-w C:\WINDOWS\system32\drivers\adpu320.PNF
2008-09-13 17:55 12,204 ----a-w C:\WINDOWS\system32\drivers\nvraid.PNF
2008-09-13 17:55 10,828 ----a-w C:\WINDOWS\system32\drivers\iaAHCI.PNF
2008-09-13 16:56 --------- d-----w C:\Program Files\Realtek
2008-09-13 16:52 --------- d-----w C:\Program Files\Intel
2008-09-13 16:38 --------- d-----w C:\Program Files\microsoft frontpage
2008-09-13 16:37 --------- d-----w C:\Program Files\Java
2008-09-13 16:37 --------- d-----w C:\Program Files\Common Files\Java
2008-09-13 16:30 --------- d-----w C:\Program Files\Windows Plus
2008-08-04 15:36 405,589 ----a-w C:\WINDOWS\system32\BsUI.dll
2008-08-04 15:33 143,450 ----a-w C:\WINDOWS\system32\BsCommon.dll
2008-08-01 13:59 9,728 ----a-w C:\WINDOWS\system32\BsMonUI.dll
2008-08-01 13:59 18,432 ----a-w C:\WINDOWS\system32\BsMonSvr.dll
2008-08-01 13:58 622,693 ----a-w C:\WINDOWS\system32\BSShell.dll
2008-08-01 13:58 57,430 ----a-w C:\WINDOWS\system32\btfunc.dll
2008-08-01 13:58 540,758 ----a-w C:\WINDOWS\system32\Bscdlg.dll
2008-08-01 13:58 53,248 ----a-w C:\WINDOWS\system32\HtmPrintHelper.dll
2008-08-01 13:58 278,647 ----a-w C:\WINDOWS\system32\outlookAddin.dll
2008-08-01 13:58 114,774 ----a-w C:\WINDOWS\system32\versit.dll
2008-08-01 13:57 94,314 ----a-w C:\WINDOWS\system32\BsHelpCSps.dll
2008-08-01 13:57 520,307 ----a-w C:\WINDOWS\system32\BlueSoleilCSps.dll
2008-08-01 13:57 114,788 ----a-w C:\WINDOWS\system32\BsProfileFunc.dll
2008-08-01 13:56 28,766 ----a-w C:\WINDOWS\system32\PlayerCtrl.dll
2008-08-01 13:56 225,364 ----a-w C:\WINDOWS\system32\BsSDK.dll
2008-08-01 13:55 28,760 ----a-w C:\WINDOWS\system32\BsTrace.dll
2008-08-01 13:55 28,672 ----a-w C:\WINDOWS\system32\BsMobileCSps.dll
2008-08-01 13:55 118,880 ----a-w C:\WINDOWS\system32\BsMobileSDK.dll
2008-08-01 13:53 106,595 ----a-w C:\WINDOWS\system32\Bs2Res.dll
2008-08-01 13:46 65,536 ----a-w C:\WINDOWS\system32\BsVistaCommon.dll
2008-08-01 13:46 41,049 ----a-w C:\WINDOWS\system32\skypeagent.dll
2008-08-01 13:46 17,907,824 ----a-w C:\WINDOWS\system32\BsLangInDepRes.dll
2008-08-01 13:46 1,717,848 ----a-w C:\WINDOWS\system32\skype4com.dll
2008-07-29 14:05 1,296,896 ----a-w C:\WINDOWS\system32\SPort.dll
2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2fd45464-181f-4fcd-8b27-9363eae714ca}]
2008-10-03 22:20 123904 --a------ C:\WINDOWS\system32\dvamwh.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77D3A5B4-CFD1-4046-8909-7CD99A68311F}]
2008-10-03 22:11 35840 --------- C:\WINDOWS\system32\vtUnopPI.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F2EC8F2A-EE15-4A19-B5DD-1367D6678F88}]
2008-10-04 00:36 313344 --a------ C:\WINDOWS\system32\yayxyWMG.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-02 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"mRouterConfig"="C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe" [2006-03-02 290816]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-17 64512]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-02-02 7933952]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-02-02 81920]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-08-25 737369]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"HybridTM_A"="C:\Program Files\HybridTM_IR(A)\RC620_A.exe" [2005-12-09 118784]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"PC Suite for Smartphones"="C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" [2007-12-25 548864]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"Telemeter 3.0"="C:\Program Files\Telemeter 3.0\telemeter3.exe" [2007-04-16 1441792]
"BtTray"="C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-08-04 226816]
"64a07bfc"="C:\WINDOWS\system32\ggfaiyla.dll" [2008-10-03 71168]
"BM67934860"="C:\WINDOWS\system32\mopfchae.dll" [2008-10-03 101888]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-02 C:\WINDOWS\system32\bthprops.cpl]
"Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAShCut.exe" [2005-01-07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-02-27 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-02-02 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{77D3A5B4-CFD1-4046-8909-7CD99A68311F}"= "C:\WINDOWS\system32\vtUnopPI.dll" [2008-10-03 35840]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtUnopPI]
2008-10-03 22:11 35840 C:\WINDOWS\system32\vtUnopPI.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=dvamwh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\yayxyWMG

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

R0 BtHidBus;Bluetooth HID Bus Service;C:\WINDOWS\system32\Drivers\BtHidBus.sys [2008-07-31 20616]
R2 BlueSoleilCS;BlueSoleilCS;C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [2008-08-04 772096]
R2 BsMobileCS;BsMobileCS;C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2008-08-01 143467]
R3 BsHelpCS;BsHelpCS;C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe [2008-08-01 69735]
R3 IvtBtBUs;IVT Bluetooth Bus Service;C:\WINDOWS\system32\Drivers\IvtBtBus.sys [2008-07-02 26248]
R3 zebrceb;Sony Ericsson Cable Emulation Bus (WDM);C:\WINDOWS\system32\DRIVERS\zebrceb.sys [2008-01-15 63360]
S3 TridDev;USB Hybrid TV Device (TM6000);C:\WINDOWS\system32\DRIVERS\Triddev.sys [2005-04-26 3584]
S3 TridVid;USB Hybrid TV Receiver (TM6000);C:\WINDOWS\system32\DRIVERS\TridVid.sys [2006-01-02 137856]
S3 zebrbus;Sony Ericsson Composite Device driver;C:\WINDOWS\system32\DRIVERS\zebrbus.sys [2008-09-15 83200]
S3 zebrmdfl;Sony Ericsson Modem Filter;C:\WINDOWS\system32\DRIVERS\zebrmdfl.sys [2008-09-15 14848]
S3 zebrmdm;Sony Ericsson Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdm.sys [2008-09-15 109568]
S3 zebrmdmc;Sony Ericsson mRouter Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdmc.sys [2008-09-15 109568]
S3 zebrsce;Sony Ericsson PC-Connect Port;C:\WINDOWS\system32\DRIVERS\zebrsce.sys [2008-09-15 91264]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ed5ae7e-9146-11dd-bc12-001060d11f4b}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe1f11de-81b2-11dd-bbe9-001060d11f4b}]
\Shell\AutoRun\command - G:\wd_windows_tools\setup.exe
.
Inhoud van de 'Gedeelde Taken' map
.
- - - - ORPHANS VERWIJDERD - - - -

BHO-{E68EA3E4-2ADF-49A3-9127-C2650F76995A} - C:\WINDOWS\system32\cbXNFyaA.dll


.
------- Bijkomende Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.be/
O8 -: E&xporteren naar Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 -: Verzenden via Bericht(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O8 -: Verzenden via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-04 00:31:53
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...


C:\WINDOWS\TEMP\NSF5.tmp
C:\WINDOWS\BM67934860.txt 55 bytes
C:\WINDOWS\system32\alyiafgg.ini 121 bytes
C:\WINDOWS\system32\alyiafgg.tmp 1007616 bytes
C:\WINDOWS\system32\yayxyWMG.dll 313344 bytes executable

Scan succesvol afgerond
verborgen bestanden: 5

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

PROCES: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\vtUnopPI.dll

PROCES: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\ggfaiyla.dll
-> C:\WINDOWS\system32\mopfchae.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\WINDOWS\system32\rundll32.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Voltooingstijd: 2008-10-04 0:37:43 - machine werd herstart
ComboFix-quarantined-files.txt 2008-10-03 22:37:38

Pre-Run: 65.354.498.048 bytes beschikbaar
Post-Run: 66,537,066,496 bytes beschikbaar

352 --- E O F --- 2008-09-18 18:05:02
-

-White-Wolf-

Legacy Member
Probleem is alleen maar erger geworden,

nu krijg ik ook nog meldingen van h8vr.dll ook Virtumonde..

helphelphelp...
-

-White-Wolf-

Legacy Member
Nieuw logje.. na de ComboFix.

Ondertussen nog geen verandering. :(

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:46:44, on 4/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"
O4 - HKLM\..\Run: [BM67934860] Rundll32.exe "C:\WINDOWS\system32\hvaajvxc.dll",s
O4 - HKLM\..\Run: [64a07bfc] rundll32.exe "C:\WINDOWS\system32\bifbdtuv.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [mRouterConfig] "C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden via Bericht(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O8 - Extra context menu item: Verzenden via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O20 - AppInit_DLLs: runifo.dll
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7588 bytes
J

Juisterr

Legacy Member
Start HJT opnieuw en doe een systemscan only, vink onderstaande regels aan sluit alle vensters behalve HJT en klik op fix checked en ok

O4 - HKLM\..\Run: [BM67934860] Rundll32.exe "C:\WINDOWS\system32\hvaajvxc.dll",s
O4 - HKLM\..\Run: [64a07bfc] rundll32.exe "C:\WINDOWS\system32\bifbdtuv.dll",b
O20 - AppInit_DLLs: runifo.dll



Sluit HJT weer af.

Open Kladblok, kopieer en plak het volgende (vetgedrukte, blauwe tekst) in een leeg venster:

File::
C:\WINDOWS\BM67934860.xml
C:\WINDOWS\system32\dvamwh.dll
C:\WINDOWS\system32\pnjbxjex.dll
C:\WINDOWS\system32\ggfaiyla.dll
C:\WINDOWS\system32\mopfchae.dll
C:\WINDOWS\system32\vtUnopPI.dll
C:\WINDOWS\system32\yayxyWMG.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2fd45464-181f-4fcd-8b27-9363eae714ca}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77D3A5B4-CFD1-4046-8909-7CD99A68311F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F2EC8F2A-EE15-4A19-B5DD-1367D6678F88}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"BM67934860"=-
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{77D3A5B4-CFD1-4046-8909-7CD99A68311F}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtUnopPI]




Sla dit op op je Bureaublad als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe zoals getoond in onderstaand voorbeeld :

CFScript.gif


Dit zal ComboFix doen herstarten.

Na het herstarten van je computer, (indien het vraagt om te herstarten), kopieer en plak de inhoud van Combofix.txt in je volgende antwoord.
Samen met een nieuw HJT logje aub.
-

-White-Wolf-

Legacy Member
Looking good :) Eset heeft nog geen aanvallen gemeld..

ComboFix 08-10-03.04 - Administrator 2008-10-04 14:31:43.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.527 [GMT 2:00]
Gestart vanuit: C:\Documents and Settings\Administrator\Bureaublad\ComboFix.exe
gebruikte Opdracht switches :: C:\Documents and Settings\Administrator\Bureaublad\CFScript.txt
* Nieuw herstelpunt werd aangemaakt
* Resident AV is active


WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

FILE ::
C:\WINDOWS\BM67934860.xml
C:\WINDOWS\system32\dvamwh.dll
C:\WINDOWS\system32\ggfaiyla.dll
C:\WINDOWS\system32\mopfchae.dll
C:\WINDOWS\system32\pnjbxjex.dll
C:\WINDOWS\system32\vtUnopPI.dll
C:\WINDOWS\system32\yayxyWMG.dll
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM67934860.txt
C:\WINDOWS\BM67934860.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\alyiafgg.ini
C:\WINDOWS\system32\dvamwh.dll
C:\WINDOWS\system32\GMWyxyay.ini
C:\WINDOWS\system32\mopfchae.dll
C:\WINDOWS\system32\pnjbxjex.dll
C:\WINDOWS\system32\rqhbhibe.ini
C:\WINDOWS\system32\vtUnopPI.dll
C:\WINDOWS\system32\vutdbfib.ini
C:\WINDOWS\system32\yayxyWMG.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-09-04 to 2008-10-04 ))))))))))))))))))))))))))))))
.

2008-10-04 14:35 . 2008-10-04 14:35 22 --a------ C:\WINDOWS\pskt.ini
2008-10-04 14:35 . 2008-10-04 14:36 0 --a------ C:\WINDOWS\BM67934860.xml
2008-10-04 10:13 . 2008-10-04 10:13 268 --ah----- C:\sqmdata05.sqm
2008-10-04 10:13 . 2008-10-04 10:13 244 --ah----- C:\sqmnoopt05.sqm
2008-10-04 09:34 . 2008-10-04 09:34 67,072 --a------ C:\WINDOWS\system32\bifbdtuv.dll
2008-10-04 09:32 . 2008-10-04 09:32 123,904 --a------ C:\WINDOWS\system32\txctrbuu.dll
2008-10-04 09:32 . 2008-10-04 09:32 123,904 --a------ C:\WINDOWS\system32\runifo.dll
2008-10-04 09:32 . 2008-10-04 09:32 101,888 --a------ C:\WINDOWS\system32\hvaajvxc.dll
2008-10-04 00:50 . 2008-10-04 00:50 268 --ah----- C:\sqmdata04.sqm
2008-10-04 00:50 . 2008-10-04 00:50 244 --ah----- C:\sqmnoopt04.sqm
2008-10-04 00:43 . 2008-10-04 00:43 123,904 --a------ C:\WINDOWS\system32\yrvmyo.dll
2008-10-04 00:43 . 2008-10-04 00:43 123,904 --a------ C:\WINDOWS\system32\cvupbrwi.dll
2008-10-04 00:40 . 2008-10-04 00:40 101,888 --a------ C:\WINDOWS\system32\cujeoqqj.dll
2008-10-04 00:36 . 2008-10-04 14:30 384,539 --ahs---- C:\WINDOWS\system32\GMWyxyay.ini2
2008-10-03 23:31 . 2008-10-03 23:31 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-03 23:16 . 2008-10-03 23:16 268 --ah----- C:\sqmdata03.sqm
2008-10-03 23:16 . 2008-10-03 23:16 244 --ah----- C:\sqmnoopt03.sqm
2008-10-03 22:21 . 2008-10-03 22:21 <DIR> d-------- C:\ALEXANDER
2008-10-03 22:12 . 2008-10-03 22:12 268 --ah----- C:\sqmdata02.sqm
2008-10-03 22:12 . 2008-10-03 22:12 244 --ah----- C:\sqmnoopt02.sqm
2008-10-03 22:11 . 2008-10-03 22:11 <DIR> d-------- C:\Program Files\DVDFab Platinum 4
2008-10-03 22:11 . 2008-10-04 00:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Vso
2008-10-03 22:11 . 2008-10-03 22:11 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-10-03 22:11 . 2008-10-03 22:11 47,360 --a------ C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2008-10-03 21:37 . 2008-10-03 21:37 <DIR> d-------- C:\CHICKEN RUN
2008-10-03 20:59 . 2008-10-03 20:59 <DIR> d-------- C:\LIONS FOR LAMBS
2008-10-03 16:11 . 2008-10-03 16:11 268 --ah----- C:\sqmdata01.sqm
2008-10-03 16:11 . 2008-10-03 16:11 244 --ah----- C:\sqmnoopt01.sqm
2008-10-03 14:26 . 2008-10-03 14:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\U3
2008-09-30 23:52 . 2008-09-30 23:52 268 --ah----- C:\sqmdata00.sqm
2008-09-30 23:52 . 2008-09-30 23:52 244 --ah----- C:\sqmnoopt00.sqm
2008-09-24 21:19 . 2008-09-24 21:19 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-22 15:45 . 2008-09-22 15:45 2,914 --a------ C:\WINDOWS\system32\SHORTCUT.INI
2008-09-22 15:44 . 2008-09-22 15:46 128 --a------ C:\WINDOWS\system32\REMOTEDEVICE.INI
2008-09-22 14:09 . 2004-08-04 01:03 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-09-22 14:09 . 2004-08-04 01:03 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-09-22 14:09 . 2001-09-06 19:04 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-09-22 14:09 . 2001-09-06 19:04 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-09-22 14:09 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-09-22 14:09 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-09-21 19:34 . 2008-09-21 19:34 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-09-21 19:34 . 2008-09-21 19:34 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-09-21 19:33 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2008-09-21 19:33 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-09-21 19:33 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-09-21 19:31 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-09-21 19:31 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-09-21 19:31 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-09-21 19:31 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-09-21 19:31 . 2006-03-03 21:03 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-09-21 19:31 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-09-21 19:31 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-09-21 19:30 . 2008-09-21 19:31 <DIR> d-------- C:\Program Files\HP
2008-09-21 19:30 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-21 19:30 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-21 19:29 . 2008-09-21 19:41 112,943 --a------ C:\WINDOWS\hpoins11.dat
2008-09-21 19:29 . 2006-04-13 02:04 49,664 --a------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-09-21 19:29 . 2006-04-13 02:04 21,568 --a------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-09-21 19:29 . 2006-04-13 02:04 16,496 --a------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-09-21 19:28 . 2006-04-13 02:02 827,392 --a------ C:\WINDOWS\system32\hpotiop2.dll
2008-09-21 19:28 . 2006-04-13 02:02 659,456 --a------ C:\WINDOWS\system32\hpowiax2.dll
2008-09-21 19:28 . 2006-04-13 02:04 282,624 --a------ C:\WINDOWS\system32\HPZc3212.dll
2008-09-21 19:28 . 2006-04-13 02:02 254,026 --a------ C:\WINDOWS\system32\hpovst09.dll
2008-09-21 19:28 . 2005-07-19 03:38 98,304 --a------ C:\WINDOWS\system32\hpzjsn01.dll
2008-09-21 19:28 . 2006-01-04 10:12 77,824 --a------ C:\WINDOWS\system32\HPZIDS01.dll
2008-09-21 19:28 . 2006-05-06 08:26 6,947 --a------ C:\WINDOWS\hpomdl11.dat
2008-09-21 18:44 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-21 18:44 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-09-19 13:15 . 2008-10-04 14:36 4,756 --a------ C:\WINDOWS\system32\LOCALSERVICE.INI
2008-09-19 13:15 . 2008-10-04 14:36 106 --a------ C:\WINDOWS\system32\LOCALDEVICE.INI
2008-09-19 13:12 . 2008-09-19 13:12 0 --a------ C:\WINDOWS\system32\BSPRINT.INI
2008-09-19 13:11 . 2008-09-19 13:11 <DIR> d-------- C:\Program Files\IVT Corporation
2008-09-19 13:11 . 2008-09-19 13:13 32 --a------ C:\WINDOWS\0
2008-09-19 13:11 . 2008-09-19 13:11 0 --a------ C:\WINDOWS\system32\0
2008-09-19 13:09 . 2008-09-19 13:10 <DIR> d-------- C:\Program Files\Telemeter 3.0
2008-09-16 12:08 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
2008-09-16 12:08 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
2008-09-16 12:08 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-09-16 11:40 . 2008-09-16 11:40 <DIR> d-------- C:\BEHIND ENEMY LINES
2008-09-16 10:50 . 2008-09-16 10:50 <DIR> d-------- C:\GARFIELD
2008-09-16 10:09 . 2008-09-16 10:09 <DIR> d-------- C:\AUGUST RUSH
2008-09-16 09:41 . 2008-09-16 09:42 <DIR> d-------- C:\CHARLIE WILSONS WAR
2008-09-15 20:43 . 2008-09-16 09:31 <DIR> d-------- C:\Documents and Settings\Administrator\Contacts
2008-09-15 20:26 . 2008-09-15 20:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-15 20:16 . 2008-09-16 09:40 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-09-15 20:15 . 2008-06-14 20:00 272,640 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-15 20:10 . 2008-09-15 20:42 <DIR> d-------- C:\Program Files\Windows Live
2008-09-15 20:10 . 2008-09-15 20:42 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-09-15 20:10 . 2008-09-15 20:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-15 20:10 . 2006-03-21 05:23 23,040 --------- C:\WINDOWS\kb913800.exe
2008-09-15 20:06 . 2008-06-23 18:43 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-15 20:06 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-15 20:06 . 2007-03-08 07:11 1,032,192 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-15 20:06 . 2008-06-23 18:43 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-15 20:06 . 2008-06-23 18:43 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-15 20:06 . 2008-06-23 18:43 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-15 20:06 . 2008-06-23 18:43 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-15 20:06 . 2008-06-23 18:43 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-15 20:06 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-15 19:17 . 2008-09-15 19:27 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\MyPhoneExplorer
2008-09-15 19:16 . 2008-09-15 19:17 <DIR> d-------- C:\Program Files\MyPhoneExplorer
2008-09-15 19:16 . 2008-09-15 20:02 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-15 14:49 . 2008-09-15 14:49 <DIR> d-------- C:\Program Files\QuickTime
2008-09-15 14:49 . 2008-09-15 14:49 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-09-15 14:49 . 2008-09-15 14:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-15 14:48 . 2008-09-15 14:48 <DIR> d-------- C:\Program Files\Apple Software Update
2008-09-15 14:48 . 2008-09-15 14:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-15 14:47 . 2008-09-15 14:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-09-15 14:17 . 2008-09-15 14:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-15 14:17 . 2008-09-15 14:17 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-15 14:13 . 2008-09-15 14:13 109,568 --a------ C:\WINDOWS\system32\drivers\zebrmdmc.sys
2008-09-15 14:13 . 2008-09-15 14:13 109,568 --a------ C:\WINDOWS\system32\drivers\zebrmdm.sys
2008-09-15 14:13 . 2008-09-15 14:13 91,264 --a------ C:\WINDOWS\system32\drivers\zebrsce.sys
2008-09-15 14:13 . 2008-09-15 14:13 83,200 --a------ C:\WINDOWS\system32\drivers\zebrbus.sys
2008-09-15 14:13 . 2008-09-15 14:13 25,214 --a------ C:\WINDOWS\system32\memorystick.ico
2008-09-15 14:13 . 2008-09-15 14:13 14,848 --a------ C:\WINDOWS\system32\drivers\zebrmdfl.sys
2008-09-15 14:13 . 2008-09-15 14:13 12,160 --a------ C:\WINDOWS\system32\drivers\zebrcmnt.sys
2008-09-15 14:13 . 2008-09-15 14:13 12,160 --a------ C:\WINDOWS\system32\drivers\zebrcm.sys
2008-09-15 14:06 . 2008-09-15 14:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony
2008-09-15 14:06 . 2008-09-15 14:06 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sony
2008-09-15 14:05 . 2008-09-15 14:05 <DIR> d-------- C:\Program Files\Sony
2008-09-15 13:57 . 2008-09-15 18:27 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Teleca
2008-09-15 13:55 . 2008-01-15 10:44 63,360 -ra------ C:\WINDOWS\system32\drivers\zebrceb.sys
2008-09-15 13:55 . 2008-01-15 10:44 12,160 -ra------ C:\WINDOWS\system32\drivers\zebrwhnt.sys
2008-09-15 13:55 . 2008-01-15 10:44 12,160 -ra------ C:\WINDOWS\system32\drivers\zebrwh.sys

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-15 11:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-14 11:59 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-13 18:38 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ESET
2008-09-13 18:37 --------- d-----w C:\Program Files\ESET
2008-09-13 18:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-09-13 18:31 --------- d-----w C:\Program Files\Synaptics
2008-09-13 18:24 20,152 ----a-w C:\WINDOWS\system32\drivers\INFCACHE.1
2008-09-13 18:20 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-13 17:55 9,388 ----a-w C:\WINDOWS\system32\drivers\iaStor.PNF
2008-09-13 17:55 7,280 ----a-w C:\WINDOWS\system32\drivers\viamraid.PNF
2008-09-13 17:55 63,240 ----a-w C:\WINDOWS\system32\drivers\Si3112r.PNF
2008-09-13 17:55 6,984 ----a-w C:\WINDOWS\system32\drivers\SiSRaid.PNF
2008-09-13 17:55 12,432 ----a-w C:\WINDOWS\system32\drivers\adpu320.PNF
2008-09-13 17:55 12,204 ----a-w C:\WINDOWS\system32\drivers\nvraid.PNF
2008-09-13 17:55 10,828 ----a-w C:\WINDOWS\system32\drivers\iaAHCI.PNF
2008-09-13 16:56 --------- d-----w C:\Program Files\Realtek
2008-09-13 16:52 --------- d-----w C:\Program Files\Intel
2008-09-13 16:38 --------- d-----w C:\Program Files\microsoft frontpage
2008-09-13 16:37 --------- d-----w C:\Program Files\Java
2008-09-13 16:37 --------- d-----w C:\Program Files\Common Files\Java
2008-09-13 16:30 --------- d-----w C:\Program Files\Windows Plus
.

((((((((((((((((((((((((((((( snapshot@2008-10-04_ 0.37.22.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-03 21:22:53 63,522 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-10-04 12:26:00 63,522 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-10-03 21:22:53 82,624 ----a-w C:\WINDOWS\system32\perfc013.dat
+ 2008-10-04 12:26:00 82,624 ----a-w C:\WINDOWS\system32\perfc013.dat
- 2008-10-03 21:22:53 404,302 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-04 12:26:00 404,302 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-10-03 21:22:53 469,120 ----a-w C:\WINDOWS\system32\perfh013.dat
+ 2008-10-04 12:26:00 469,120 ----a-w C:\WINDOWS\system32\perfh013.dat
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31e9aa43-cea7-41e5-ba35-aa2d8781e3ec}]
2008-10-04 09:32 123904 --a------ C:\WINDOWS\system32\runifo.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-02 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"mRouterConfig"="C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe" [2006-03-02 290816]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-17 64512]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-02-02 7933952]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-02-02 81920]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-08-25 737369]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"HybridTM_A"="C:\Program Files\HybridTM_IR(A)\RC620_A.exe" [2005-12-09 118784]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"PC Suite for Smartphones"="C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" [2007-12-25 548864]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"Telemeter 3.0"="C:\Program Files\Telemeter 3.0\telemeter3.exe" [2007-04-16 1441792]
"BtTray"="C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-08-04 226816]
"BM67934860"="C:\WINDOWS\system32\hvaajvxc.dll" [2008-10-04 101888]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-02 C:\WINDOWS\system32\bthprops.cpl]
"Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAShCut.exe" [2005-01-07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-02-27 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-02-02 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

R0 BtHidBus;Bluetooth HID Bus Service;C:\WINDOWS\system32\Drivers\BtHidBus.sys [2008-07-31 20616]
R2 BlueSoleilCS;BlueSoleilCS;C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [2008-08-04 772096]
R2 BsMobileCS;BsMobileCS;C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2008-08-01 143467]
R3 BsHelpCS;BsHelpCS;C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe [2008-08-01 69735]
R3 IvtBtBUs;IVT Bluetooth Bus Service;C:\WINDOWS\system32\Drivers\IvtBtBus.sys [2008-07-02 26248]
R3 zebrceb;Sony Ericsson Cable Emulation Bus (WDM);C:\WINDOWS\system32\DRIVERS\zebrceb.sys [2008-01-15 63360]
S3 TridDev;USB Hybrid TV Device (TM6000);C:\WINDOWS\system32\DRIVERS\Triddev.sys [2005-04-26 3584]
S3 TridVid;USB Hybrid TV Receiver (TM6000);C:\WINDOWS\system32\DRIVERS\TridVid.sys [2006-01-02 137856]
S3 zebrbus;Sony Ericsson Composite Device driver;C:\WINDOWS\system32\DRIVERS\zebrbus.sys [2008-09-15 83200]
S3 zebrmdfl;Sony Ericsson Modem Filter;C:\WINDOWS\system32\DRIVERS\zebrmdfl.sys [2008-09-15 14848]
S3 zebrmdm;Sony Ericsson Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdm.sys [2008-09-15 109568]
S3 zebrmdmc;Sony Ericsson mRouter Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdmc.sys [2008-09-15 109568]
S3 zebrsce;Sony Ericsson PC-Connect Port;C:\WINDOWS\system32\DRIVERS\zebrsce.sys [2008-09-15 91264]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ed5ae7e-9146-11dd-bc12-001060d11f4b}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe1f11de-81b2-11dd-bbe9-001060d11f4b}]
\Shell\AutoRun\command - G:\wd_windows_tools\setup.exe
.
Inhoud van de 'Gedeelde Taken' map
.
- - - - ORPHANS VERWIJDERD - - - -

BHO-{BDAA307F-DED1-4CA8-ABD9-1F747532C8A9} - C:\WINDOWS\system32\yayxyWMG.dll



**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-04 14:35:06
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...


C:\WINDOWS\pskt.ini 22 bytes
C:\WINDOWS\BM67934860.txt 134 bytes
C:\WINDOWS\BM67934860.xml 0 bytes

Scan succesvol afgerond
verborgen bestanden: 3

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

PROCES: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\hvaajvxc.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Voltooingstijd: 2008-10-04 14:40:34 - machine werd herstart
ComboFix-quarantined-files.txt 2008-10-04 12:40:30
ComboFix2.txt 2008-10-03 22:37:44

Pre-Run: 68.188.884.992 bytes beschikbaar
Post-Run: 68,175,921,152 bytes beschikbaar

312 --- E O F --- 2008-09-18 18:05:02


HiJackThis logje volgt direct...
-

-White-Wolf-

Legacy Member
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:44:03, on 4/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: {ce3e1878-d2aa-53ab-5e14-7aec34aa9e13} - {31e9aa43-cea7-41e5-ba35-aa2d8781e3ec} - C:\WINDOWS\system32\runifo.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"
O4 - HKLM\..\Run: [BM67934860] Rundll32.exe "C:\WINDOWS\system32\hvaajvxc.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [mRouterConfig] "C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden via Bericht(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O8 - Extra context menu item: Verzenden via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7814 bytes

Heb wel net weer zo'n popup gekregen. :( Toch nog iets niet helemaal in orde?
-

-White-Wolf-

Legacy Member
O4 - HKLM\..\Run: [BM67934860] Rundll32.exe "C:\WINDOWS\system32\hvaajvxc.dll",s
Deze is nog niet weg...

en wat met deze: O2 - BHO: {ce3e1878-d2aa-53ab-5e14-7aec34aa9e13} - {31e9aa43-cea7-41e5-ba35-aa2d8781e3ec} - C:\WINDOWS\system32\runifo.dll


?
J

Juisterr

Legacy Member
Ja ww goed gezien, nog niet weg.

Start Hijackthis op en kies voor 'Do a system scan only'
Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: {ce3e1878-d2aa-53ab-5e14-7aec34aa9e13} - {31e9aa43-cea7-41e5-ba35-aa2d8781e3ec} - C:\WINDOWS\system32\runifo.dll
O4 - HKLM\..\Run: [BM67934860] Rundll32.exe "C:\WINDOWS\system32\hvaajvxc.dll",s



Sluit alle vensters behalve Hijackthis
Klik op 'Fix checked' om de items te verwijderen.



Download MalwareBytes' Anti-Malware en sla het op je bureaublad op.
Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg dat er na de installatie een vinkje is geplaatst bij:
  • Update MalwareBytes' Anti-Malware
  • Start MalwareBytes' Anti-Malware
Klik daarna op "Voltooien".
Indien een update gevonden wordt, zal die gedownload en geïnstalleerd worden.
  • Zodra het programma gestart is, ga dan naar het tabblad "Instellingen".
  • Vink hier aan: "Sluit Internet Explorer tijdens verwijdering van malware".
  • Ga daarna naar het tabblad "Scanner", kies hier voor "Snelle Scan".
  • Druk vervolgens op "Scannen" om de scan te starten.
  • Het scannen kan een tijdje duren, dus wees geduldig.
  • Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.
  • Zorg ervoor dat daar alles aangevinkt is, daarna klik op: "Verwijder geselecteerde".
  • Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten.
Het log wordt automatisch bewaard door MalwareBytes' Anti-Malware en kan je terugvinden door op de "Logs" tab te klikken in het programma.

Plaats dit logje samen met een nieuw logje van HijackThis.
-

-White-Wolf-

Legacy Member
Ok, eerst en vooral, alvast enorm merci voor de moeite Juisterr... :)

MalwareBytes heeft 14 schadelijke bestanden gevonden waaronder die hardnekkige hvaajvxc.dll die hij ook niet kon verwijderen. Het programma stelde voor de dll te verwijderen bij volgende opstart, heb ik ook 'ja' op geantwoord..

Bij de reboot kreeg ik de melding dat windows hvaajvxc.dll niet kon vinden, en das positief, dat wil dus zeggen dat hij weg is.. Maar dat wil ook zeggen dat er nog iets naar verwijst toch? Enfin... Tussenstand, het gaat de goede richting uit. :)

HijackThis logje...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:30:01, on 4/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [mRouterConfig] "C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden via Bericht(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O8 - Extra context menu item: Verzenden via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7470 bytes

En logje van MalwareBytes'

Malwarebytes' Anti-Malware 1.28
Database versie: 1227
Windows 5.1.2600 Service Pack 2

4/10/2008 16:27:38
mbam-log-2008-10-04 (16-27-38).txt

Scan type: Snelle Scan
Objecten gescand: 47982
Verstreken tijd: 4 minute(s), 42 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 4
Registerwaarden geïnfecteerd: 1
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 8

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm67934860 (Trojan.Agent) -> Quarantined and deleted successfully.

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
C:\WINDOWS\system32\txctrbuu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cvupbrwi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yrvmyo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bifbdtuv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hvaajvxc.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM67934860.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM67934860.txt (Trojan.Vundo) -> Quarantined and deleted successfully.


Wat zegt dat volgens jou? En nogmaals bedankt he!! :)
-

-White-Wolf-

Legacy Member
Nogmaals een scan met MalwareBytes'

12 infected items...

Bestanden geïnfecteerd:
C:\Program Files\Trend Micro\HijackThis\backups\backup-20081004-161834-874.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\cbXNFyaA.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\dvamwh.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\pnjbxjex.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\yayxyWMG.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E6A8794D-5AE4-425D-8F91-26F232785556}\RP54\A0006376.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E6A8794D-5AE4-425D-8F91-26F232785556}\RP56\A0006522.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E6A8794D-5AE4-425D-8F91-26F232785556}\RP56\A0006542.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E6A8794D-5AE4-425D-8F91-26F232785556}\RP57\A0006569.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E6A8794D-5AE4-425D-8F91-26F232785556}\RP57\A0006571.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E6A8794D-5AE4-425D-8F91-26F232785556}\RP57\A0006573.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E6A8794D-5AE4-425D-8F91-26F232785556}\RP57\A0006663.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Zo te zien allemaal reservekopies die in Quarantine geplaatst zijn door andere tools (bv Combofix (QooBox))

Die laatste zien er mij wel vreemd uit: Die "A000****.dll" files, zijn kwa grote identiek aan die vtUnopPI.dll
Die lijkt dus niet goed opgesloten te zitten.
Ondertussen ook nog 2 attacks door eset gemeld door gequarentainede dll's.. Grr!! :angry:

Direct nog eens een HijackThis logje...
-

-White-Wolf-

Legacy Member
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:36:07, on 4/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [BtTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [mRouterConfig] "C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden via Bericht(&M)... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm
O8 - Extra context menu item: Verzenden via Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll
O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe
O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7541 bytes
J

Juisterr

Legacy Member
- Ga naar Start/Alle programma's/Bureau-accessoires/Systeemwerkset/Systeemherstel.
- Klik in de linkerhelft van het venster op "Instellingen van systeemherstel".
- Zet een vinkje voor "Systeemherstel uitschakelen".
- Klik "Toepassen".
- Windows vraagt of je dat zeker weet.
- Klik "Ja".
- Klik "OK".
- Start de pc opnieuw op.
- Ga weer naar Start/Alle programma's/Bureau-accessoires/Systeemwerkset/Systeemherstel.
- Je krijgt de melding: "Systeemherstel is uitgeschakeld. Wilt u systeemherstel nu inschakelen?"
- Klik "Ja".
- Verwijder het vinkje voor "Systeemherstel uitschakelen".
- Klik "Toepassen".
- Klik "OK".
- Start de pc opnieuw op
- Er is nu een nieuw schoon herstel punt aangemaakt


Update de mbam scanner en scan nogmaals, verwijder alles wat hij vind en start opnieuw op, blijf dit doen tot hij niks meer vind, als hij wat vind verwijder het en belangrijk start opnieuw op.

vertel dan eens hoe het gaat.
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan