Mededeling

Collapse
No announcement yet.

MSN virus...

Collapse
X
Collapse
  •  
  • Page of 1
  • Filter
  • Tijd
  • Show
Clear All
new posts
Vorige template Volgende
  • #1

    MSN virus...

    hallo,
    een vriendin van me heeft een virus binnengekregen via msn...
    ik had haar al uitgelachen want t is best dom
    maargoed, t is wel een serieus probleem geworden...
    ik had al die msnfix geprobeerd maar dat werkte niet

    hier is haar hijackthis logje:
    _________________________________________________________________


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:54:43, on 3-3-2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\ybcparbtou.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\devldr32.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Documents and Settings\Esmée\Bureaublad\HiJackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [stupid creative poll axis] C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\Cast That.exe
    O4 - HKLM\..\Run: [ybcparbtou] C:\WINDOWS\system32\ybcparbtou.exe
    O4 - HKLM\..\RunServices: [ybcparbtou] C:\WINDOWS\system32\ybcparbtou.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
    O4 - HKCU\..\Run: [Blah media] C:\DOCUME~1\ESME~1\APPLIC~1\FLAPMF~1\Math Base Up.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1196014435280
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197585927750
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Print Spooler Service (ea4m2pvzibik) - Unknown owner - C:\WINDOWS\system32\ybcparbtou.exe
    O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 7075 bytes
    _________________________________________________________________

    alvast bedankt voor de hulp
    Labels: Geen
    • Citaat
  • #2
    Installeer hijackthis.exe bijv. in C:\Program Files\Hijackthis
    Dit in verband met de backups die dit programma maakt.

    Start Hijackthis op en kies voor 'Do a system scan only'
    Selecteer alleen de items die hieronder zijn genoemd:

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [stupid creative poll axis] C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\Cast That.exe
    O4 - HKLM\..\Run: [ybcparbtou] C:\WINDOWS\system32\ybcparbtou.exe
    O4 - HKLM\..\RunServices: [ybcparbtou] C:\WINDOWS\system32\ybcparbtou.exe
    O4 - HKCU\..\Run: [Blah media] C:\DOCUME~1\ESME~1\APPLIC~1\FLAPMF~1\Math Base Up.exe
    O23 - Service: Print Spooler Service (ea4m2pvzibik) - Unknown owner - C:\WINDOWS\system32\ybcparbtou.exe

    Sluit alle vensters behalve Hijackthis
    Klik op 'Fix checked' om de items te verwijderen.

    Volg de instructies zoals beschreven op de volgende pagina: hoe-dient-combofix-gebruikt-te-worden

    Is er iets niet duidelijk, dan vraag je het.
    Als het tooltje klaar is, opent er een logfile (C:\combofix.txt).
    Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
    • Citaat

    Comment

    • #3
      Bedankt voor de snelle reactie
      combofix tutorial was makkelijk en super duidelijk, alleen is er geen recovery console geinstalleerd, hier is de logfile van combofix:


      _________________________________________________________________

      ComboFix 08-03-05.1 - Esmée 2008-03-04 22:59:17.1 - NTFSx86
      Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.487 [GMT 1:00]
      Gestart vanuit: C:\Documents and Settings\Esmée\Bureaublad\ComboFix.exe
      * Nieuw herstelpunt werd aangemaakt

      WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
      .

      (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\WINDOWS\system32\msssc.dll

      .
      (((((((((((((((((((( Bestanden Gemaakt van 2008-02-05 to 2008-03-05 ))))))))))))))))))))))))))))))
      .

      2008-03-03 17:11 . 2008-03-03 17:11 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\gtk-2.0
      2008-03-03 17:09 . 2008-03-03 21:59 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\.purple
      2008-03-03 17:08 . 2008-03-03 17:08 <DIR> d-------- C:\Program Files\Pidgin
      2008-03-03 17:07 . 2008-03-03 17:07 <DIR> d-------- C:\Program Files\Common Files\GTK
      2008-03-02 19:31 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\nnqjsyxs.exe
      2008-03-02 19:31 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\chugkk.exe
      2008-03-02 19:30 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\ybcparbtou.exe
      2008-03-01 20:57 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
      2008-02-23 21:46 . 2008-03-03 17:03 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\skypePM
      2008-02-23 21:46 . 2008-02-23 21:46 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
      2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Program Files\Skype
      2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Program Files\Common Files\Skype
      2008-02-23 21:42 . 2008-03-03 22:52 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\Skype
      2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
      2008-02-23 21:42 . 2004-08-04 01:03 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
      2008-02-23 21:42 . 2004-08-04 01:03 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
      2008-02-23 21:42 . 2004-08-03 23:10 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
      2008-02-23 21:42 . 2004-08-03 23:10 15,360 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
      2008-02-23 21:42 . 2004-08-03 23:10 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
      2008-02-23 21:42 . 2004-08-03 23:10 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
      2008-02-23 21:42 . 2004-08-03 23:10 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
      2008-02-23 21:42 . 2004-08-03 23:10 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
      2008-02-23 21:42 . 2004-08-03 22:58 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
      2008-02-23 21:42 . 2004-08-03 22:58 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
      2008-02-23 21:41 . 2004-08-03 23:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
      2008-02-23 21:41 . 2004-08-03 23:10 85,376 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys
      2008-02-23 21:41 . 2004-08-03 23:10 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
      2008-02-23 21:41 . 2004-08-03 23:10 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
      2008-02-23 21:41 . 2004-08-03 23:10 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
      2008-02-23 21:41 . 2004-08-03 23:10 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys
      2008-02-23 21:38 . 2008-02-23 21:38 <DIR> d-------- C:\Program Files\Common Files\logishrd
      2008-02-23 21:38 . 2004-08-04 01:03 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax
      2008-02-23 21:38 . 2004-08-04 01:03 91,136 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax
      2008-02-23 21:38 . 2004-08-04 01:03 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
      2008-02-23 21:38 . 2004-08-04 01:03 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax
      2008-02-23 21:38 . 2004-08-04 01:03 54,272 --a------ C:\WINDOWS\system32\vfwwdm32.dll
      2008-02-23 21:38 . 2004-08-04 01:03 54,272 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
      2008-02-23 21:38 . 2004-08-04 01:03 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
      2008-02-23 21:38 . 2004-08-04 01:03 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
      2008-02-21 16:32 . 2008-02-21 16:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
      2008-02-21 16:19 . 2008-02-21 16:19 45,056 --a------ C:\MsnHandWriting.dll
      2008-02-21 16:17 . 2008-02-21 16:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Memo save stupid creative
      2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\Messenger Plus! Live
      2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\FlapMfcdFour
      2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\Circle Developement
      2008-02-21 16:16 . 2008-02-21 16:17 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\FlapMfcdFour
      2008-02-19 07:46 . 2008-02-19 07:46 <DIR> d-------- C:\Program Files\MSXML 6.0
      2008-02-18 19:38 . 2001-08-17 20:19 3,712 --a------ C:\WINDOWS\system32\drivers\ctljystk.sys
      2008-02-18 19:38 . 2001-08-17 20:19 3,712 --a--c--- C:\WINDOWS\system32\dllcache\ctljystk.sys
      2008-02-18 14:27 . 2008-02-18 18:45 <DIR> d-------- C:\WINDOWS\nview
      2008-02-18 14:27 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
      2008-02-18 14:27 . 2008-03-04 22:43 88,566 --a------ C:\WINDOWS\system32\nvapps.xml
      2008-02-18 14:27 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
      2008-02-18 14:26 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
      2008-02-18 14:25 . 2008-02-18 14:25 <DIR> d-------- C:\NVIDIA
      2008-02-18 14:18 . 2008-02-18 14:18 <DIR> d-------- C:\Program Files\SystemRequirementsLab
      2008-02-18 13:55 . 2008-02-18 13:55 <DIR> d-------- C:\Program Files\XPC Tools
      2008-02-18 13:32 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
      2008-02-18 13:32 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
      2008-02-18 13:28 . 2008-02-18 13:28 268 --ah----- C:\sqmdata01.sqm
      2008-02-18 13:28 . 2008-02-18 13:28 244 --ah----- C:\sqmnoopt01.sqm
      2008-02-17 15:54 . 2008-02-07 14:47 10,795 --a------ C:\WINDOWS\system32\whitelist

      .
      ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-03-03 20:59 --------- d-----w C:\Documents and Settings\Esmée\Application Data\.purple
      2008-02-19 18:34 75,883 ----a-w C:\WINDOWS\system32\Fix.bat
      2008-02-19 06:49 --------- d-----w C:\Program Files\Safari
      2008-02-18 17:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-02-18 13:25 --------- d-----w C:\Program Files\Common Files\InstallShield
      2007-12-07 02:18 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
      .

      ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03 15360]
      "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
      "DriverUpdaterPro"="C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe" [ ]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
      "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
      "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
      "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
      "nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
      "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:03 15360]

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "C:\\Program Files\\iTunes\\iTunes.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
      "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

      R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 07:00]
      S2 ea4m2pvzibik;Print Spooler Service;C:\WINDOWS\system32\ybcparbtou.exe [2008-03-03 19:32]

      *Newly Created Service* - EA4M2PVZIBIK
      .
      Inhoud van de 'Gedeelde Taken' map
      "2008-03-05 22:00:10 C:\WINDOWS\Tasks\A8D8AAA5919B2045.job"
      - c:\docume~1\esme~1\applic~1\flapmf~1\Tool byte stupid.exe
      "2008-02-28 16:39:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
      - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
      .
      **************************************************************************

      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-03-05 23:01:57
      Windows 5.1.2600 Service Pack 2 NTFS

      scannen van verborgen processen ...

      scannen van verborgen autostart items ...

      scannen van verborgen bestanden ...

      Scan succesvol afgerond
      verborgen bestanden: 0

      **************************************************************************
      .
      Voltooingstijd: 2008-03-05 23:03:26
      ComboFix-quarantined-files.txt 2008-03-05 22:02:34
      .
      2008-02-19 22:24:42 --- E O F ---

      _________________________________________________________________












      en hier is ook een nieuw hijackthis logje:











      _________________________________________________________________

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 23:05:41, on 5-3-2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16608)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
      C:\WINDOWS\system32\devldr32.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Windows Live\Messenger\usnsvc.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\WINDOWS\system32\notepad.exe
      C:\WINDOWS\explorer.exe
      C:\Program Files\HiJackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1196014435280
      O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197585927750
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
      O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: Print Spooler Service (ea4m2pvzibik) - Unknown owner - C:\WINDOWS\system32\ybcparbtou.exe
      O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

      --
      End of file - 6435 bytes
      _________________________________________________________________


      groeten Milan
      • Citaat

      Comment

      • #4
        Open Kladblok, kopieer en plak het volgende (vetgedrukte, blauwe tekst) in een leeg venster:


        • File::
          C:\WINDOWS\system32\ybcparbtou.exe
          C:\WINDOWS\system32\chugkk.exe
          C:\WINDOWS\system32\nnqjsyxs.exe
          C:\WINDOWS\Tasks\A8D8AAA5919B2045.job

          Folder::
          c:\docume~1\esme~1\applic~1\flapmf~1
          C:\Documents and Settings\All Users\Application Data\Memo save stupid creative
          c:\program files\Memo save stupid creative
          c:\program files\flapmf~1

          driver::
          ea4m2pvzibik

        Sla dit op op je Bureaublad als CFScript.txt.

        Sleep CFScript.txt in ComboFix.exe zoals getoond in onderstaand voorbeeld :



        Dit zal ComboFix doen herstarten.

        Na het herstarten van je computer, (indien het vraagt om te herstarten), kopieer en plak de inhoud van Combofix.txt in je volgende antwoord.
        • Citaat

        Comment

        • #5
          dit is het logje van combofix:
          _________________________________________________________________

          ComboFix 08-03-05.1 - Esmée 2008-03-06 22:24:49.2 - NTFSx86
          Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.413 [GMT 1:00]
          Gestart vanuit: C:\Documents and Settings\Esmée\Bureaublad\ComboFix.exe
          Command switches used :: C:\Documents and Settings\EsmÚe\Bureaublad\CFScript.txt
          * Nieuw herstelpunt werd aangemaakt

          WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
          .

          (((((((((((((((((((( Bestanden Gemaakt van 2008-02-06 to 2008-03-06 ))))))))))))))))))))))))))))))
          .

          2008-03-03 17:11 . 2008-03-03 17:11 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\gtk-2.0
          2008-03-03 17:09 . 2008-03-03 21:59 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\.purple
          2008-03-03 17:08 . 2008-03-03 17:08 <DIR> d-------- C:\Program Files\Pidgin
          2008-03-03 17:07 . 2008-03-03 17:07 <DIR> d-------- C:\Program Files\Common Files\GTK
          2008-03-02 19:31 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\nnqjsyxs.exe
          2008-03-02 19:31 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\chugkk.exe
          2008-03-02 19:30 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\ybcparbtou.exe
          2008-03-01 20:57 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
          2008-02-23 21:46 . 2008-03-06 21:35 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\skypePM
          2008-02-23 21:46 . 2008-02-23 21:46 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
          2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Program Files\Skype
          2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Program Files\Common Files\Skype
          2008-02-23 21:42 . 2008-03-06 22:27 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\Skype
          2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
          2008-02-23 21:42 . 2004-08-04 01:03 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
          2008-02-23 21:42 . 2004-08-04 01:03 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
          2008-02-23 21:42 . 2004-08-03 23:10 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
          2008-02-23 21:42 . 2004-08-03 23:10 15,360 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
          2008-02-23 21:42 . 2004-08-03 23:10 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
          2008-02-23 21:42 . 2004-08-03 23:10 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
          2008-02-23 21:42 . 2004-08-03 23:10 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
          2008-02-23 21:42 . 2004-08-03 23:10 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
          2008-02-23 21:42 . 2004-08-03 22:58 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
          2008-02-23 21:42 . 2004-08-03 22:58 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
          2008-02-23 21:41 . 2004-08-03 23:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
          2008-02-23 21:41 . 2004-08-03 23:10 85,376 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys
          2008-02-23 21:41 . 2004-08-03 23:10 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
          2008-02-23 21:41 . 2004-08-03 23:10 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
          2008-02-23 21:41 . 2004-08-03 23:10 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
          2008-02-23 21:41 . 2004-08-03 23:10 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys
          2008-02-23 21:38 . 2008-02-23 21:38 <DIR> d-------- C:\Program Files\Common Files\logishrd
          2008-02-23 21:38 . 2004-08-04 01:03 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax
          2008-02-23 21:38 . 2004-08-04 01:03 91,136 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax
          2008-02-23 21:38 . 2004-08-04 01:03 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
          2008-02-23 21:38 . 2004-08-04 01:03 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax
          2008-02-23 21:38 . 2004-08-04 01:03 54,272 --a------ C:\WINDOWS\system32\vfwwdm32.dll
          2008-02-23 21:38 . 2004-08-04 01:03 54,272 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
          2008-02-23 21:38 . 2004-08-04 01:03 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
          2008-02-23 21:38 . 2004-08-04 01:03 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
          2008-02-21 16:32 . 2008-02-21 16:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
          2008-02-21 16:19 . 2008-02-21 16:19 45,056 --a------ C:\MsnHandWriting.dll
          2008-02-21 16:17 . 2008-02-21 16:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Memo save stupid creative
          2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\Messenger Plus! Live
          2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\FlapMfcdFour
          2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\Circle Developement
          2008-02-21 16:16 . 2008-02-21 16:17 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\FlapMfcdFour
          2008-02-19 07:46 . 2008-02-19 07:46 <DIR> d-------- C:\Program Files\MSXML 6.0
          2008-02-18 19:38 . 2001-08-17 20:19 3,712 --a------ C:\WINDOWS\system32\drivers\ctljystk.sys
          2008-02-18 19:38 . 2001-08-17 20:19 3,712 --a--c--- C:\WINDOWS\system32\dllcache\ctljystk.sys
          2008-02-18 14:27 . 2008-02-18 18:45 <DIR> d-------- C:\WINDOWS\nview
          2008-02-18 14:27 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
          2008-02-18 14:27 . 2008-03-06 20:32 88,566 --a------ C:\WINDOWS\system32\nvapps.xml
          2008-02-18 14:27 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
          2008-02-18 14:26 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
          2008-02-18 14:25 . 2008-02-18 14:25 <DIR> d-------- C:\NVIDIA
          2008-02-18 14:18 . 2008-02-18 14:18 <DIR> d-------- C:\Program Files\SystemRequirementsLab
          2008-02-18 13:55 . 2008-02-18 13:55 <DIR> d-------- C:\Program Files\XPC Tools
          2008-02-18 13:32 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
          2008-02-18 13:32 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
          2008-02-18 13:28 . 2008-02-18 13:28 268 --ah----- C:\sqmdata01.sqm
          2008-02-18 13:28 . 2008-02-18 13:28 244 --ah----- C:\sqmnoopt01.sqm
          2008-02-17 15:54 . 2008-02-07 14:47 10,795 --a------ C:\WINDOWS\system32\whitelist

          .
          ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-03-03 20:59 --------- d-----w C:\Documents and Settings\Esmée\Application Data\.purple
          2008-02-19 18:34 75,883 ----a-w C:\WINDOWS\system32\Fix.bat
          2008-02-19 06:49 --------- d-----w C:\Program Files\Safari
          2008-02-18 17:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
          2008-02-18 13:25 --------- d-----w C:\Program Files\Common Files\InstallShield
          2007-12-07 02:18 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
          .

          ((((((((((((((((((((((((((((( [email protected]_23.02.20.76 )))))))))))))))))))))))))))))))))))))))))
          .
          + 2008-03-06 19:32:14 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_578.dat
          .
          ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          REGEDIT4
          *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03 15360]
          "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
          "DriverUpdaterPro"="C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe" [ ]
          "Blah media"="C:\DOCUME~1\ESME~1\APPLIC~1\FLAPMF~1\Math Base Up.exe" [2008-02-21 16:16 453632]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
          "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
          "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048]
          "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
          "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
          "nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
          "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
          "ybcparbtou"="C:\WINDOWS\system32\ybcparbtou.exe" [2008-03-03 19:32 192512]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
          "ybcparbtou"="C:\WINDOWS\system32\ybcparbtou.exe" [2008-03-03 19:32 192512]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
          "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:03 15360]

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\system32\\sessmgr.exe"=
          "C:\\Program Files\\iTunes\\iTunes.exe"=
          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
          "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

          R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 07:00]
          S2 ea4m2pvzibik;Print Spooler Service;C:\WINDOWS\system32\ybcparbtou.exe [2008-03-03 19:32]

          .
          Inhoud van de 'Gedeelde Taken' map
          "2008-03-06 21:00:00 C:\WINDOWS\Tasks\A8D8AAA5919B2045.job"
          - c:\docume~1\esme~1\applic~1\flapmf~1\Tool byte stupid.exe
          "2008-02-28 16:39:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
          - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
          .
          **************************************************************************

          catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-03-06 22:27:00
          Windows 5.1.2600 Service Pack 2 NTFS

          scannen van verborgen processen ...

          scannen van verborgen autostart items ...

          scannen van verborgen bestanden ...

          Scan succesvol afgerond
          verborgen bestanden: 0

          **************************************************************************
          .
          Voltooingstijd: 2008-03-06 22:28:01
          ComboFix-quarantined-files.txt 2008-03-06 21:27:44
          ComboFix2.txt 2008-03-05 22:03:27
          .
          2008-02-19 22:24:42 --- E O F ---
          • Citaat

          Comment

          • #6
            Er is iets niet goed gegaan met het copieren van de code naar CFScript.

            Ik heb de code in CFScript.txt geplaatst.
            Download dit naar je bureaublad en sleep dit dan naar ComboFix.exe

            Post daarna het nieuwe log als Combofix klaar is.
            Bijgevoegde Bestanden
            • Citaat

            Comment

            • #7
              sorry dat t zo lang heeft geduurt, maar hier is het nieuwe logje van combofix:





              ComboFix 08-03-05.1 - Esmée 2008-03-07 20:08:53.3 - NTFSx86
              Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.376 [GMT 1:00]
              Gestart vanuit: C:\Documents and Settings\Esmée\Bureaublad\ComboFix.exe
              Command switches used :: C:\Documents and Settings\EsmÚe\Bureaublad\CFScript.txt
              * Nieuw herstelpunt werd aangemaakt

              WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
              .

              (((((((((((((((((((( Bestanden Gemaakt van 2008-02-07 to 2008-03-07 ))))))))))))))))))))))))))))))
              .

              2008-03-03 17:11 . 2008-03-03 17:11 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\gtk-2.0
              2008-03-03 17:09 . 2008-03-03 21:59 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\.purple
              2008-03-03 17:08 . 2008-03-03 17:08 <DIR> d-------- C:\Program Files\Pidgin
              2008-03-03 17:07 . 2008-03-03 17:07 <DIR> d-------- C:\Program Files\Common Files\GTK
              2008-03-02 19:31 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\nnqjsyxs.exe
              2008-03-02 19:31 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\chugkk.exe
              2008-03-02 19:30 . 2008-03-03 19:32 192,512 --a------ C:\WINDOWS\system32\ybcparbtou.exe
              2008-03-01 20:57 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
              2008-02-23 21:46 . 2008-03-06 21:35 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\skypePM
              2008-02-23 21:46 . 2008-02-23 21:46 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
              2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Program Files\Skype
              2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Program Files\Common Files\Skype
              2008-02-23 21:42 . 2008-03-07 00:52 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\Skype
              2008-02-23 21:42 . 2008-02-23 21:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype
              2008-02-23 21:42 . 2004-08-04 01:03 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
              2008-02-23 21:42 . 2004-08-04 01:03 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
              2008-02-23 21:42 . 2004-08-03 23:10 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
              2008-02-23 21:42 . 2004-08-03 23:10 15,360 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
              2008-02-23 21:42 . 2004-08-03 23:10 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
              2008-02-23 21:42 . 2004-08-03 23:10 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
              2008-02-23 21:42 . 2004-08-03 23:10 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
              2008-02-23 21:42 . 2004-08-03 23:10 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
              2008-02-23 21:42 . 2004-08-03 22:58 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
              2008-02-23 21:42 . 2004-08-03 22:58 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
              2008-02-23 21:41 . 2004-08-03 23:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
              2008-02-23 21:41 . 2004-08-03 23:10 85,376 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys
              2008-02-23 21:41 . 2004-08-03 23:10 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
              2008-02-23 21:41 . 2004-08-03 23:10 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
              2008-02-23 21:41 . 2004-08-03 23:10 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
              2008-02-23 21:41 . 2004-08-03 23:10 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys
              2008-02-23 21:38 . 2008-02-23 21:38 <DIR> d-------- C:\Program Files\Common Files\logishrd
              2008-02-23 21:38 . 2004-08-04 01:03 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax
              2008-02-23 21:38 . 2004-08-04 01:03 91,136 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax
              2008-02-23 21:38 . 2004-08-04 01:03 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
              2008-02-23 21:38 . 2004-08-04 01:03 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax
              2008-02-23 21:38 . 2004-08-04 01:03 54,272 --a------ C:\WINDOWS\system32\vfwwdm32.dll
              2008-02-23 21:38 . 2004-08-04 01:03 54,272 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
              2008-02-23 21:38 . 2004-08-04 01:03 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
              2008-02-23 21:38 . 2004-08-04 01:03 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
              2008-02-21 16:32 . 2008-02-21 16:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
              2008-02-21 16:19 . 2008-02-21 16:19 45,056 --a------ C:\MsnHandWriting.dll
              2008-02-21 16:17 . 2008-02-21 16:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Memo save stupid creative
              2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\Messenger Plus! Live
              2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\FlapMfcdFour
              2008-02-21 16:16 . 2008-02-21 16:16 <DIR> d-------- C:\Program Files\Circle Developement
              2008-02-21 16:16 . 2008-02-21 16:17 <DIR> d-------- C:\Documents and Settings\Esmée\Application Data\FlapMfcdFour
              2008-02-19 07:46 . 2008-02-19 07:46 <DIR> d-------- C:\Program Files\MSXML 6.0
              2008-02-18 19:38 . 2001-08-17 20:19 3,712 --a------ C:\WINDOWS\system32\drivers\ctljystk.sys
              2008-02-18 19:38 . 2001-08-17 20:19 3,712 --a--c--- C:\WINDOWS\system32\dllcache\ctljystk.sys
              2008-02-18 14:27 . 2008-02-18 18:45 <DIR> d-------- C:\WINDOWS\nview
              2008-02-18 14:27 . 2006-10-22 12:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
              2008-02-18 14:27 . 2008-03-07 17:35 88,566 --a------ C:\WINDOWS\system32\nvapps.xml
              2008-02-18 14:27 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu
              2008-02-18 14:26 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
              2008-02-18 14:25 . 2008-02-18 14:25 <DIR> d-------- C:\NVIDIA
              2008-02-18 14:18 . 2008-02-18 14:18 <DIR> d-------- C:\Program Files\SystemRequirementsLab
              2008-02-18 13:55 . 2008-02-18 13:55 <DIR> d-------- C:\Program Files\XPC Tools
              2008-02-18 13:32 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
              2008-02-18 13:32 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
              2008-02-18 13:28 . 2008-02-18 13:28 268 --ah----- C:\sqmdata01.sqm
              2008-02-18 13:28 . 2008-02-18 13:28 244 --ah----- C:\sqmnoopt01.sqm
              2008-02-17 15:54 . 2008-02-07 14:47 10,795 --a------ C:\WINDOWS\system32\whitelist

              .
              ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2008-03-03 20:59 --------- d-----w C:\Documents and Settings\Esmée\Application Data\.purple
              2008-02-19 18:34 75,883 ----a-w C:\WINDOWS\system32\Fix.bat
              2008-02-19 06:49 --------- d-----w C:\Program Files\Safari
              2008-02-18 17:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
              2008-02-18 13:25 --------- d-----w C:\Program Files\Common Files\InstallShield
              2007-12-07 02:18 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
              .

              ((((((((((((((((((((((((((((( [email protected]_23.02.20.76 )))))))))))))))))))))))))))))))))))))))))
              .
              + 2008-03-07 16:35:20 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_594.dat
              .
              ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              REGEDIT4
              *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03 15360]
              "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
              "DriverUpdaterPro"="C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe" [ ]
              "Blah media"="C:\DOCUME~1\ESME~1\APPLIC~1\FLAPMF~1\Math Base Up.exe" [2008-02-21 16:16 453632]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]
              "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
              "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048]
              "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
              "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
              "nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
              "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
              "ybcparbtou"="C:\WINDOWS\system32\ybcparbtou.exe" [2008-03-03 19:32 192512]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
              "ybcparbtou"="C:\WINDOWS\system32\ybcparbtou.exe" [2008-03-03 19:32 192512]

              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
              "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:03 15360]

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "%windir%\\system32\\sessmgr.exe"=
              "C:\\Program Files\\iTunes\\iTunes.exe"=
              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
              "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
              "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

              R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-12-20 07:00]
              S2 ea4m2pvzibik;Print Spooler Service;C:\WINDOWS\system32\ybcparbtou.exe [2008-03-03 19:32]

              .
              Inhoud van de 'Gedeelde Taken' map
              "2008-03-07 19:00:00 C:\WINDOWS\Tasks\A8D8AAA5919B2045.job"
              - c:\docume~1\esme~1\applic~1\flapmf~1\Tool byte stupid.exe
              "2008-02-28 16:39:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
              - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
              .
              **************************************************************************

              catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2008-03-07 20:11:10
              Windows 5.1.2600 Service Pack 2 NTFS

              scannen van verborgen processen ...

              scannen van verborgen autostart items ...

              scannen van verborgen bestanden ...

              Scan succesvol afgerond
              verborgen bestanden: 0

              **************************************************************************
              .
              Voltooingstijd: 2008-03-07 20:12:15
              ComboFix-quarantined-files.txt 2008-03-07 19:11:59
              ComboFix2.txt 2008-03-06 21:28:02
              ComboFix3.txt 2008-03-05 22:03:27
              .
              2008-02-19 22:24:42 --- E O F ---
              • Citaat

              Comment

              • #8
                Er is nog helemaal niets verwijderd door combofix.

                Download OTMoveIt.exe en plaats het op je bureaublad:
                • Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
                • Kopiëer (selecteren en druk Ctrl-C) de onderstaande, vetgedrukte tekst:

                  C:\WINDOWS\system32\ybcparbtou.exe
                  C:\WINDOWS\system32\chugkk.exe
                  C:\WINDOWS\system32\nnqjsyxs.exe
                  C:\WINDOWS\Tasks\A8D8AAA5919B2045.job
                  c:\docume~1\esme~1\applic~1\flapmf~1
                  C:\Documents and Settings\All Users\Application Data\Memo save stupid creative
                  c:\program files\Memo save stupid creative
                  c:\program files\flapmf~1

                • Plak de gekopiëerde tekst (druk Ctrl-V) in het "Paste List of Files/Folders to be moved" venster.
                • Klik daarna op de rode knop MoveIt onderaan.
                • Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
                • Post de inhoud daarvan in je volgende bericht.


                Post dan ook nog een nieuw log van Hijackthis.
                • Citaat

                Comment

                • #9
                  enorm sorry voor de veel te late reactie, maar ik heb wat probleempjes gehad in de familie...

                  de link voor MoveIt werkt niet, blijkbaar is er nu een MoveIt2, ik heb deze versie maar geporbeerd..

                  dit is de MoveIt log:

                  [Custom Input]
                  < C:\WINDOWS\system32\ybcparbtou.exe >
                  File/Folder C:\WINDOWS\system32\ybcparbtou.exe not found.
                  < C:\WINDOWS\system32\chugkk.exe >
                  C:\WINDOWS\system32\chugkk.exe moved successfully.
                  < C:\WINDOWS\system32\nnqjsyxs.exe >
                  C:\WINDOWS\system32\nnqjsyxs.exe moved successfully.
                  < C:\WINDOWS\Tasks\A8D8AAA5919B2045.job >
                  C:\WINDOWS\Tasks\A8D8AAA5919B2045.job moved successfully.
                  < c:\docume~1\esme~1\applic~1\flapmf~1 >
                  c:\docume~1\esme~1\applic~1\FlapMfcdFour moved successfully.
                  < C:\Documents and Settings\All Users\Application Data\Memo save stupid creative >
                  Folder move failed. C:\Documents and Settings\All Users\Application Data\Memo save stupid creative scheduled to be moved on reboot.
                  < c:\program files\Memo save stupid creative >
                  File/Folder c:\program files\Memo save stupid creative not found.
                  < c:\program files\flapmf~1 >
                  c:\program files\FlapMfcdFour moved successfully.

                  OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03192008_205242



                  en hier is de nieuwe Hijackthis log:




                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 21:10:04, on 19-3-2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16608)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                  C:\WINDOWS\system32\RUNDLL32.EXE
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                  C:\WINDOWS\system32\devldr32.exe
                  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  C:\Program Files\Bonjour\mDNSResponder.exe
                  C:\WINDOWS\system32\nvsvc32.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  C:\Program Files\iPod\bin\iPodService.exe
                  C:\Program Files\Windows Live\Messenger\usnsvc.exe
                  C:\WINDOWS\system32\wuauclt.exe
                  C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
                  C:\Documents and Settings\Esmée\Bureaublad\HiJackThis.exe
                  C:\Documents and Settings\Esmée\Bureaublad\HiJackThis.exe

                  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

                  --
                  End of file - 1707 bytes




                  groet Milan
                  • Citaat

                  Comment

                  • #10
                    De gewraakte bestanden zijn verplaatst, dat is goed.
                    Waar zijn al die andere regels van hijackthis? Is dit het complete log?
                    • Citaat

                    Comment

                    Vorige template Volgende
                    Sorry, you are not authorized to view this page
                    Working...
                    X