Mededeling

Collapse
No announcement yet.

Essa voce Precisa VER - Is het nu opgelost?

Collapse
X
  •  
  • Filter
  • Tijd
  • Show
Clear All
new posts

  • Essa voce Precisa VER - Is het nu opgelost?

    Mijn vader heeft een probleem met het bekende Essa Voce Precisa-trojanmailgeval.

    Ik heb RVAXO gedraaid:

    ----------------RVAXO.exe first run-------------

    Files found:

    C:\WINDOWS\lnk_dados_2.dll
    C:\Documents and Settings\Administrator\user.dat
    C:\Documents and Settings\Administrator\Emails.dat
    C:\WINDOWS\Media\LTaskup.exe
    C:\start.bat

    Uninstallers Rogue scanners:


    Folders Found:


    Hosts-file was reset, If you use a custom hosts file please replace it...

    --------------RVAXO.exe last run---------------

    Files found:

    Folders Found:

    --------------RVAXO.exe finished----------------
    HijackThis:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:04:08, on 21-12-2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\LogMeIn\x86\RaMaint.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\WINDOWS\system32\mspaint.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.nl/0SENLNL/SAOS01?FORM=TOOLBR
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAShCut.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SDMSSplash] "C:\Program Files\HP_SDMS\SDMSSplash\launcher.exe" "launchdir=C:\Program Files\HP_SDMS\SDMSSplash"
    O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
    O4 - HKUS\S-1-5-21-1031866424-1238936374-1962328121-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'LogMeInRemoteUser')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
    O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

    --
    End of file - 7709 bytes
    Ik heb Combofix ook al gebruikt, maar deze zorgt ervoor dat de computer bij het XP-inlogscherm komt. Iemand tips of suggesties?

  • #2
    Oorspronkelijk geplaatst door detulp050
    Ik heb Combofix ook al gebruikt, maar deze zorgt ervoor dat de computer bij het XP-inlogscherm komt. Iemand tips of suggesties?
    Wat bedoel je daar mee?

    Heb je wel het logje van Combofix? C:\Combofix.txt
    Zo ja, Post deze dan eens

    Comment


    • #3
      Ik help mijn vader via LogMeIn (op afstand), en als ik combofix start dan verbreekt de verbinding. Ik kan dus niet met zekerheid zeggen wat er dan gebeurt.

      Dit is de log van Combofix
      ComboFix 07-12-20.1 - Administrator 2007-12-21 16:49:03.3 - NTFSx86
      Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.514 [GMT 1:00]
      Gestart vanuit: C:\Documents and Settings\Administrator\Bureaublad\ComboFix.exe
      .

      (((((((((((((((((((( Bestanden Gemaakt van 2007-11-21 to 2007-12-21 ))))))))))))))))))))))))))))))
      .

      2007-12-21 16:42 . 2007-12-21 16:42 <DIR> d-------- C:\RVAXO
      2007-12-21 16:41 . 2007-12-21 12:51 555,344 --a------ C:\WINDOWS\system32\RVAXO.bat
      2007-12-21 16:41 . 2001-10-01 14:51 69,632 --a------ C:\WINDOWS\system32\remove.exe
      2007-12-20 16:58 . 2007-12-20 16:58 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft
      2007-12-20 16:52 . 2007-12-20 16:54 74,240 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
      2007-12-20 16:52 . 2007-12-20 16:54 56,832 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
      2007-12-20 16:52 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
      2007-12-20 16:52 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
      2007-12-20 16:51 . 2007-12-20 16:51 <DIR> d-------- C:\Program Files\Webroot
      2007-12-20 16:51 . 2007-12-20 19:19 <DIR> d-------- C:\Program Files\Spyware Doctor
      2007-12-20 16:51 . 2007-12-20 16:51 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
      2007-12-20 16:51 . 2007-12-20 16:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
      2007-12-20 16:51 . 2007-12-20 16:51 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools
      2007-12-20 16:51 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
      2007-12-20 16:51 . 2007-03-01 19:54 144,960 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
      2007-12-20 16:51 . 2007-03-01 19:54 22,080 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
      2007-12-20 16:51 . 2007-03-01 19:54 21,056 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
      2007-12-20 16:51 . 2007-03-01 19:54 20,544 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys
      2007-12-20 16:50 . 2007-12-20 16:50 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Webroot
      2007-12-20 16:50 . 2007-12-20 16:50 164 --a------ C:\install.dat
      2007-12-20 16:49 . 2007-12-20 17:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
      2007-12-20 16:48 . 2007-12-20 16:58 <DIR> d-------- C:\Program Files\SpywareBlaster
      2007-12-20 16:48 . 2007-12-20 16:48 <DIR> d-------- C:\Program Files\Lavasoft
      2007-12-20 16:33 . 2007-12-20 16:33 <DIR> d-------- C:\Temp\Tmp___6304
      2007-12-20 16:33 . 2007-12-20 16:47 <DIR> d-------- C:\Temp
      2007-12-20 16:33 . 2007-12-20 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx
      2007-12-20 16:16 . 2007-12-20 16:16 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
      2007-12-20 16:15 . 2007-12-20 18:46 <DIR> d-------- C:\Program Files\Hitman Pro
      2007-12-20 15:16 . 2007-12-20 15:16 <DIR> d-------- C:\Program Files\Trend Micro

      .
      ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2007-12-21 12:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
      2007-12-21 07:54 --------- d-----w C:\Program Files\LogMeIn
      2007-12-20 17:24 --------- d-----w C:\Program Files\wpcvtr
      2007-12-20 15:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
      2007-12-20 15:06 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AVG7
      2007-12-20 14:09 87,352 ----a-w C:\WINDOWS\system32\LMIinit.dll
      2007-12-20 14:09 83,288 ----a-w C:\WINDOWS\system32\LMIRfsClientNP.dll
      2007-12-20 14:09 23,736 ----a-w C:\WINDOWS\system32\lmimirr.dll
      2007-12-20 14:09 21,496 ----a-w C:\WINDOWS\system32\LMIport.dll
      2007-12-20 14:09 10,040 ----a-w C:\WINDOWS\system32\lmimirr2.dll
      2007-12-18 11:33 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Canon
      2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
      2007-11-12 07:20 --------- d-----w C:\Program Files\Google
      2007-11-07 07:13 --------- d-----w C:\Program Files\SMSalias
      2007-11-06 17:02 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Leadertech
      2007-11-03 14:14 --------- d-----w C:\Program Files\Common Files\Adobe
      2007-10-30 23:27 3,590,656 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
      2007-10-29 22:45 1,291,776 ----a-w C:\WINDOWS\system32\quartz.dll
      2007-10-29 22:45 1,291,776 ------w C:\WINDOWS\system32\dllcache\quartz.dll
      2007-10-25 16:44 8,507,392 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
      2007-10-25 11:36 --------- d-----w C:\Documents and Settings\Administrator\Application Data\U3
      2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
      2007-10-25 08:28 222,720 ------w C:\WINDOWS\system32\dllcache\wmasf.dll
      2007-10-23 06:58 17,408 ----a-w C:\psapi.dll
      2007-10-10 23:54 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll
      2007-10-10 23:53 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll
      2007-10-10 23:53 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
      2007-10-10 23:53 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
      2007-10-10 23:53 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
      2007-10-10 23:53 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
      2007-10-10 23:53 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
      2007-10-10 23:53 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
      2007-10-10 23:53 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
      2007-10-10 23:53 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
      2007-10-10 23:53 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
      2007-10-10 23:53 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
      2007-10-10 23:53 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
      2007-10-10 23:53 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
      2007-10-10 23:53 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
      2007-10-10 23:53 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll
      2007-10-10 23:53 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
      2007-10-10 23:53 132,608 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
      2007-10-10 23:53 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
      2007-10-10 23:53 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
      2007-10-10 23:53 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
      2007-10-10 23:53 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
      2007-10-10 11:02 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
      2007-10-10 11:02 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
      2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
      2007-10-10 05:46 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
      2007-06-10 12:02 844,877 -c--a-w C:\Program Files\microphotoed.exe
      .

      ((((((((((((((((((((((((((((( [email protected]_15.26.13.15 )))))))))))))))))))))))))))))))))))))))))
      .
      + 2007-11-21 00:04:14 218,496 ----a-r C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe
      + 2007-12-20 15:57:34 74,137 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
      - 2007-12-20 13:33:30 60,516 ----a-w C:\WINDOWS\system32\perfc009.dat
      + 2007-12-21 15:46:52 60,516 ----a-w C:\WINDOWS\system32\perfc009.dat
      - 2007-12-20 13:33:30 77,230 ----a-w C:\WINDOWS\system32\perfc013.dat
      + 2007-12-21 15:46:52 77,230 ----a-w C:\WINDOWS\system32\perfc013.dat
      - 2007-12-20 13:33:30 398,316 ----a-w C:\WINDOWS\system32\perfh009.dat
      + 2007-12-21 15:46:52 398,316 ----a-w C:\WINDOWS\system32\perfh009.dat
      - 2007-12-20 13:33:30 460,148 ----a-w C:\WINDOWS\system32\perfh013.dat
      + 2007-12-21 15:46:52 460,148 ----a-w C:\WINDOWS\system32\perfh013.dat
      + 2007-03-01 19:23:34 10,240 ----a-w C:\WINDOWS\system32\ssiefr.EXE
      + 2007-03-01 19:24:12 233,024 ----a-w C:\WINDOWS\system32\WRLogonNtf.dll
      + 2007-03-01 19:24:10 26,688 ----a-w C:\WINDOWS\system32\wrlzma.dll
      + 2007-12-21 15:42:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_424.dat
      + 2007-03-01 19:24:08 271,936 ----a-w C:\WINDOWS\WRUninstall.dll
      .
      ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 03:00]
      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-16 10:05]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2006-07-21 12:48]
      "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-07-21 12:50]
      "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2006-07-21 12:47]
      "Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAShCut.exe" [2005-01-07 17:07 C:\WINDOWS\system32\HdAShCut.exe]
      "RTHDCPL"="RTHDCPL.EXE" [2006-07-04 16:26 C:\WINDOWS\RTHDCPL.exe]
      "SDMSSplash"="C:\Program Files\HP_SDMS\SDMSSplash\launcher.exe" [2006-03-10 01:53]
      "SetRefresh"="C:\Program Files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 19:01]
      "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-23 09:02]
      "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20]
      "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
      "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 00:26]
      "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-10 12:51]
      "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
      "LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-04-17 13:03]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 03:00]
      "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-23 09:02]

      C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
      Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-11-12 08:17:46]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
      LMIinit.dll 2007-12-20 15:09 87352 C:\WINDOWS\system32\LMIinit.dll

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
      @=""

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
      @=""

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
      path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Snelle start.lnk
      backup=C:\WINDOWS\pss\Adobe Reader Snelle start.lnkCommon Startup

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
      2007-04-17 13:03 63048 --a--c--- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
      C:\Program Files\MSN Messenger\MsnMsgr.Exe /background

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
      C:\Program Files\QuickTime\qttask.exe -atboottime

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
      2007-07-16 10:05 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
      C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

      R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2007-04-17 13:00]
      R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-04-05 10:55]
      R3 lmimirr;lmimirr;C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2007-04-17 13:00]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
      \Shell\AutoRun\command - D:\LaunchU3.exe -a

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dca4b10f-fa19-11db-9179-806d6172696f}]
      \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

      .
      Inhoud van de 'Gedeelde Taken' map
      "2007-12-21 15:45:10 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
      - C:\Program Files\Windows Defender\MpCmdRun.exe
      .
      **************************************************************************

      catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2007-12-21 16:50:11
      Windows 5.1.2600 Service Pack 2 NTFS

      scannen van verborgen processen ...

      scannen van verborgen autostart items ...

      scannen van verborgen bestanden ...

      Scan succesvol afgerond
      verborgen bestanden: 0

      **************************************************************************
      .
      Voltooingstijd: 2007-12-21 16:50:31
      C:\ComboFix2.txt ... 2007-12-20 16:04
      C:\ComboFix3.txt ... 2007-12-20 15:26
      .
      2007-12-21 07:58:48 --- E O F ---
      Ik moet wel bekennen dat ik zo naar het theater ga, dus als ik niet reageer vanavond, dan weten jullie waar het aan ligt
      Last edited by detulp050; 21-12-07, 17:28. Reden: tijden

      Comment


      • #4
        Logje laat geen problemen zien, systeem lijkt me schoon

        Comment


        • #5
          Oorspronkelijk geplaatst door smeenk Bekijk Berichten
          Logje laat geen problemen zien, systeem lijkt me schoon
          Bedankt voor het kijken! Er komen ook amper tot geen mailtjes terug van mailservers (user-unknown etc.), dus het probleem lijkt bedwongen

          Comment


          • #6
            Graag gedaan hoor

            Doe dit nog:

            Open de map RVAXO op je bureaublad en dubbelklik Uninstall.cmd
            Dit zal alles van RVAXO doen verwijderen.

            Je Java software is verouderd. oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.
            Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:
            • Download Java Runtime Environment (JRE) 6.3 en bewaar het naar je Bureaublad.
            • Sluit alle programma's die eventueel open zijn - Zeker je web browser!
            • Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.
            • Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
            • Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
            • Herhaal dit tot alle oudere versies verdwenen zijn.
            • Na het verwijderen van alle oudere versies, herstart je pc.
            • Dubbelklik vervolgens op jre-6u3-windows-i586-p.exe op je Bureaublad om de nieuwste versie van Java te installeren.


            Download ATF cleaner (mirror)(gemaakt door Atribune)

            Belangrijk: Sluit al je browservensters(IE en/of Firefox en/of Opera) om de tool goed te kunnen laten werken.

            Dubbelklik op ATF cleaner om het programma te starten.
            Op het tabblad "Main", plaats je een vinkje bij Select All.
            Klik op de knop Empty Selected.

            Het volgende doen als je ook FireFox als browser hebt:
            Klik op tabblad "Firefox", plaats een vinkje bij Select All.
            Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
            (dit haalt het vinkje weer weg bij "Firefox saved passwords")
            Klik op de knop Empty Selected.

            Het volgende doen als je ook Opera als browser hebt:
            Klik op tabblad "Opera", plaats een vinkje bij Select All.
            Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
            Klik op de knop Empty Selected.
            Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

            Ga naar Start - Uitvoeren en geef hier het volgende in:
            Combofix /U
            Druk daarna op OK.
            Let op: Er moet een spatie tussen Combofix en /U zitten.

            Dit zal Combofix de&#239;nstalleren.

            Schakel Systeemherstel uit. Herstart de computer. Schakel Systeemherstel weer in.
            Kijk hier hoe je je systeemherstel moet uitschakelen.
            Hiermee verwijder je eventuele restanten van de infecties uit je systeemherstel.

            Dan denk ik dat alles weer OK is

            Comment

            Sorry, you are not authorized to view this page
            Working...
            X