(Geblokkeerde) inkomende verbindingen - virus blijft bezig

MBStein · **Geregistreerd:** zo feb 07, 2010 1:19 pm **Berichten:** 7

Hallo. Gisterenavond merkte ik aan hoe mijn PC bezig was dat er iets mis was, daarom ging ik vanochtend maar aan de slag met Malwarebytes waar ik goede dingen over gehoord had. Daar kwam ik een virus bij tegen (zie onderstaande log).

1e log) schreef:

Malwarebytes' Anti-Malware 1.44
Database versie: 3700
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

7-2-2010 9:24:41
mbam-log-2010-02-07 (09-24-41).txt

Scan type: Snelle Scan
Objecten gescand: 98266
Verstreken tijd: 4 minute(s), 7 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 1

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
C:\Windows\System32\Gn0dC3gY.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.

Echter, nadat Malwarebytes hem verwijderd had (ik gebruik altijd bij het opstarten CCleaner om mijn computer 'schoon' te houden), bleven de verbindingen binnenkomen vanaf 3 verschillende IPs (1 uit Duitsland en 2 onbekenden - afgaande op de namen en bedrijven erachter, 2 uit Rusland).
Nu zit ik dus ERGENS met een (restant van een) virus dat achtergebleven en niet gezien is. Malwarebytes blokkeert de schadelijke verbindingen gelukkig (of zo lijkt het in ieder geval), maar ik ben dat virus liever kwijt dan rijk.
Mijn OS is Windows Vista Home Premium, met Microsoft Security Essentials als anti-virus. Daarnaast als firewall Online Armor, met Malwarebytes en Spybot Search&Destroy (mét Teatimer) als anti-spyware/adware programmas. Kan iemand naar de logs kijken en helpen svp? Want het is zwaar irritant om om de 5 minuten 9-12 geblockte meldingen telkens te krijgen.

Laatste log schreef:

Malwarebytes' Anti-Malware 1.44
Database versie: 3700
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

7-2-2010 13:36:08
mbam-log-2010-02-07 (13-36-08).txt

Scan type: Snelle Scan
Objecten gescand: 97705
Verstreken tijd: 1 minute(s), 50 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Citaat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:31:01, on 7-2-2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMCWCU] "C:\Program Files\SMC\SMCWPCIT-G\SMCWCU.exe" -nogui
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P8 /q C:\Users\Michael\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\CQZPQG3E\ADS_1_~1.SH! C:\Users\Michael\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\RQFXN91P\SEARCH~1.SH! (User 'SYSTEEM')
O4 - HKUS\.DEFAULT\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P8 /q C:\Users\Michael\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\CQZPQG3E\ADS_1_~1.SH! C:\Users\Michael\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\RQFXN91P\SEARCH~1.SH! (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab ... detect.cab
O23 - Service: SMC Configuration Service (ACS) - Unknown owner - C:\Windows\system32\acs.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Dragon Age: Origins Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Steam\Steamapps\Common\Dragon Age Origins\bin_ship\daupdatersvc.service.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: PLFlash DeviceIoControl Service - Unknown owner - C:\Windows\system32\IoctlSvc.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe

--
End of file - 6797 bytes

kape · **Geplaatst:** zo feb 07, 2010 2:34 pm

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKUS\S-1-5-18\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P8 /q C:\Users\Michael\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\CQZPQG3E\AD S_1_~1.SH! C:\Users\Michael\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\RQFXN91P\SE ARCH~1.SH! (User 'SYSTEEM')
O4 - HKUS\.DEFAULT\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P8 /q C:\Users\Michael\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\CQZPQG3E\AD S_1_~1.SH! C:\Users\Michael\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\RQFXN91P\SE ARCH~1.SH! (User 'Default user')

Klik op 'Fix checked' om de items te verwijderen.

Laat dan Malwarebytes nog eens scannen.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

MBStein · **Geregistreerd:** zo feb 07, 2010 1:19 pm **Berichten:** 7

Gedaan. Wordt ff afwachten of dit helpt... ik zal het binnen zo en zo een halfuurtje weten.

Citaat:

Malwarebytes' Anti-Malware 1.44
Database versie: 3700
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

7-2-2010 14:44:51
mbam-log-2010-02-07 (14-44-51).txt

Scan type: Snelle Scan
Objecten gescand: 97759
Verstreken tijd: 2 minute(s), 24 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Citaat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:45:18, on 7-2-2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMCWCU] "C:\Program Files\SMC\SMCWPCIT-G\SMCWCU.exe" -nogui
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab ... detect.cab
O23 - Service: SMC Configuration Service (ACS) - Unknown owner - C:\Windows\system32\acs.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Dragon Age: Origins Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Steam\Steamapps\Common\Dragon Age Origins\bin_ship\daupdatersvc.service.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: PLFlash DeviceIoControl Service - Unknown owner - C:\Windows\system32\IoctlSvc.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe

--
End of file - 6066 bytes

MBStein · **Geregistreerd:** zo feb 07, 2010 1:19 pm **Berichten:** 7

mmm... Aanvallen blijven doorgaan

kape · **Geplaatst:** zo feb 07, 2010 6:26 pm

Download Combofix naar je Bureaublad.

Lees hier meer over correct gebruik van Combofix.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.
Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Combofix.exe

Ja

JA

OK

Ja

NIET

Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post dit logje in je volgende antwoord.

MBStein · **Geregistreerd:** zo feb 07, 2010 1:19 pm **Berichten:** 7

Citaat:

ComboFix 10-02-07.01 - Michael 07-02-2010 19:21:03.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.3326.2264 [GMT 1:00]
Gestart vanuit: c:\users\Michael\Downloads\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\SIntf16.dll

Besmet exemplaar van c:\windows\system32\drivers\atapi.sys werd aangetroffen en gedesinfecteerd
Hersteld exemplaar van - Kitty ate it :p
.
(((((((((((((((((((( Bestanden Gemaakt van 2010-01-07 to 2010-02-07 ))))))))))))))))))))))))))))))
.

2010-02-07 18:32 . 2010-02-07 18:33 -------- d-----w- c:\users\Michael\AppData\Local\temp
2010-02-07 18:32 . 2010-02-07 18:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-07 12:16 . 2010-02-07 12:16 -------- d-----w- c:\program files\Trend Micro
2010-02-07 10:38 . 2010-02-07 11:03 -------- d-----w- c:\programdata\OnlineArmor
2010-02-07 10:38 . 2010-02-07 10:38 -------- d-----w- c:\users\Michael\AppData\Roaming\OnlineArmor
2010-02-07 10:36 . 2009-12-05 06:28 24656 ----a-w- c:\windows\system32\drivers\OAmon.sys
2010-02-07 10:36 . 2009-12-05 06:28 30800 ----a-w- c:\windows\system32\drivers\OAnet.sys
2010-02-07 10:36 . 2009-12-05 06:27 223312 ----a-w- c:\windows\system32\drivers\OADriver.sys
2010-02-07 10:36 . 2010-02-07 10:36 -------- d-----w- c:\program files\Tall Emu
2010-02-07 08:15 . 2010-02-07 08:15 -------- d-----w- c:\users\Michael\AppData\Roaming\Malwarebytes
2010-02-07 08:15 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-07 08:15 . 2010-02-07 08:15 -------- d-----w- c:\programdata\Malwarebytes
2010-02-07 08:15 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-07 08:15 . 2010-02-07 08:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-06 20:36 . 2010-02-06 20:45 -------- d-----w- c:\users\Michael\AppData\Roaming\My Battle for Middle-earth(tm) II Files
2010-02-06 19:03 . 2010-02-06 19:20 -------- d-----w- c:\users\Michael\AppData\Roaming\My Battle for Middle-earth Files
2010-02-01 12:26 . 2010-02-01 12:26 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-30 17:43 . 2010-01-30 17:43 -------- d-----w- c:\programdata\EA Logs
2010-01-27 16:59 . 2010-01-27 16:59 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-01-27 15:39 . 2010-01-14 10:12 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-12 11:03 . 2010-01-12 11:03 68200 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-12 11:03 . 2010-01-12 11:03 4321384 ----a-w- c:\windows\system32\nvwgf2um.dll
2010-01-12 11:03 . 2010-01-12 11:03 4077672 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 11:03 . 2010-01-12 11:03 4061800 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-12 11:03 . 2010-01-12 11:03 2243176 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 11:03 . 2010-01-12 11:03 182888 ----a-w- c:\windows\system32\nvcod189.dll
2010-01-12 11:03 . 2010-01-12 11:03 182888 ----a-w- c:\windows\system32\nvcod.dll
2010-01-12 11:03 . 2010-01-12 11:03 14924392 ----a-w- c:\windows\system32\nvoglv32.dll
2010-01-12 11:03 . 2010-01-12 11:03 11639400 ----a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 11:03 . 2010-01-12 11:03 11586280 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2010-01-11 21:18 . 2010-01-11 21:18 962664 ----a-w- c:\windows\system32\nvsvc.dll
2010-01-11 21:18 . 2010-01-11 21:18 13679720 ----a-w- c:\windows\system32\nvcpl.dll
2010-01-11 21:18 . 2010-01-11 21:18 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-01-11 21:18 . 2010-01-11 21:18 110696 ----a-w- c:\windows\system32\nvmctray.dll

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-07 18:21 . 2008-01-21 06:47 736756 ----a-w- c:\windows\system32\perfh013.dat
2010-02-07 18:21 . 2008-01-21 06:47 153004 ----a-w- c:\windows\system32\perfc013.dat
2010-02-07 18:15 . 2009-06-26 10:57 35085 ----a-w- c:\programdata\nvModes.dat
2010-02-07 17:34 . 2009-06-24 08:20 -------- d-----w- c:\program files\Steam
2010-02-07 09:21 . 2009-01-24 16:43 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-06 18:51 . 2009-01-24 06:45 -------- d-----w- c:\program files\Electronic Arts
2010-02-05 06:15 . 2009-01-21 15:49 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-05 05:59 . 2009-01-21 15:12 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-01 12:26 . 2009-01-21 15:10 -------- d-----w- c:\programdata\NVIDIA
2010-02-01 12:19 . 2009-12-04 13:05 -------- d-----w- c:\programdata\BioWare
2010-02-01 10:12 . 2009-09-24 18:56 -------- d-----w- c:\program files\Common Files\BioWare
2010-02-01 10:11 . 2009-01-23 23:16 -------- d-----w- c:\programdata\Media Center Programs
2010-02-01 06:15 . 2009-01-25 16:04 -------- d-----w- c:\program files\Activision
2010-02-01 06:13 . 2009-03-22 08:45 -------- d-----w- c:\program files\Sega
2010-01-31 06:03 . 2009-02-01 18:25 1 ----a-w- c:\users\Michael\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-27 15:28 . 2009-01-21 14:49 -------- d-----w- c:\programdata\McAfee
2010-01-27 15:22 . 2009-04-08 12:23 -------- d-----w- c:\program files\Ubisoft
2010-01-27 07:49 . 2009-05-08 06:45 -------- d-----w- c:\programdata\Electronic Arts
2010-01-27 07:49 . 2009-12-04 12:57 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-27 07:49 . 2009-12-04 12:57 38784 ----a-w- c:\users\Michael\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-27 07:49 . 2009-12-04 12:57 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-25 13:01 . 2009-01-21 14:48 53464 ----a-w- c:\users\Michael\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-25 05:03 . 2006-11-02 12:37 -------- d-----w- c:\program files\Microsoft Games
2010-01-24 19:49 . 2009-04-28 11:47 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-24 19:44 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-12 11:03 . 2010-01-12 11:03 10920 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2010-01-12 11:03 . 2009-09-27 22:12 592488 ----a-w- c:\windows\system32\nvudisp.exe
2010-01-12 11:03 . 2009-01-21 14:53 592488 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-01-12 11:03 . 2008-07-26 04:48 9388648 ----a-w- c:\windows\system32\nvd3dum.dll
2010-01-12 11:03 . 2008-07-26 04:48 1280616 ----a-w- c:\windows\system32\nvapi.dll
2010-01-02 06:38 . 2010-01-24 19:41 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-24 19:41 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-24 19:41 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-24 19:41 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-20 15:20 . 2009-01-24 16:45 -------- d-----w- c:\programdata\Lavasoft
2009-12-20 09:53 . 2009-12-20 09:53 234016 ----a-w- c:\windows\system32\drivers\Rtlh86.sys
2009-12-14 07:33 . 2009-12-14 07:33 970504 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-03 08:27 . 2009-12-03 08:27 80416 ----a-w- c:\windows\system32\RtNicProp32.dll
2009-12-03 08:27 . 2009-11-12 06:24 100896 ----a-w- c:\windows\system32\RTNUninst32.dll
2009-11-30 17:02 . 2009-11-30 17:02 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 17:02 . 2009-11-30 17:02 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-11-12 07:42 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-10 11:35 . 2009-10-14 19:50 38 ----a-w- c:\users\Michael\jagex_runescape_preferences.dat
2009-11-10 11:30 . 2009-10-14 19:52 63 ----a-w- c:\users\Michael\jagex_runescape_preferences2.dat
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2010-01-26 1724728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SMCWCU"="c:\program files\SMC\SMCWPCIT-G\SMCWCU.exe" [2006-03-14 303104]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-10 67488]
"LiveMonitor"="c:\program files\MSI\Live Update 3\LMonitor.exe" [2009-02-24 498688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-01-07 429392]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2009-12-05 6622920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2009-12-05 923336]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-01-29 10:51 4911104 ----a-w- c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):59,54,f9,78,fc,62,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2713266562-1326134346-4058669467-1000]
"EnableNotificationsRef"=dword:00000003

R1 OADevice;OADriver;c:\windows\System32\drivers\OADriver.sys [7-2-2010 11:36 223312]
R1 OAmon;OAmon;c:\windows\System32\drivers\OAmon.sys [7-2-2010 11:36 24656]
R2 DAUpdaterSvc;Dragon Age: Origins Updater;c:\program files\Steam\steamapps\common\dragon age origins\bin_ship\daupdatersvc.service.exe [31-1-2010 9:55 25832]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [7-2-2010 9:15 236368]
R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [7-2-2010 11:36 1282248]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [24-1-2009 17:43 809296]
R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [7-2-2010 11:36 3291336]
R3 MBAMProtector;MBAMProtector;c:\windows\System32\drivers\mbam.sys [7-2-2010 9:15 19160]
R3 OAnet;OnlineArmor Service;c:\windows\System32\drivers\OAnet.sys [7-2-2010 11:36 30800]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [21-1-2008 3:23 21504]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\System32\drivers\MpNWMon.sys [18-6-2009 18:48 42480]
S3 RTL8187B;Wireless Network USB Adapter 54g WL-168v1.004;c:\windows\System32\drivers\RTL8187B.sys [21-1-2009 18:50 286208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhoud van de 'Gedeelde Taken' map

2010-02-07 c:\windows\Tasks\Malwarebytes' Scheduled Scan for Michael.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2010-02-07 15:07]

2010-02-07 c:\windows\Tasks\Malwarebytes' Scheduled Update for Michael.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2010-02-07 15:07]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.nl/
Trusted Zone: internet
Trusted Zone: mcafee.com
FF - ProfilePath - c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sdthlznz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.nl/
FF - component: c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\sdthlznz.default\extensions\{ca8b7b3d-b6e6-438f-b935-601b3de48d66}\platform\WINNT_x86-msvc\components\FFThrottle.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS VERWIJDERD - - - -

SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-mcmscsvc
SafeBoot-MCODS
SafeBoot-SRService

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 19:32
Windows 6.0.6002 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-2713266562-1326134346-4058669467-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:91,b2,66,14,c4,c0,b8,48,51,47,68,44,86,6e,0d,ee,e4,fe,2b,bb,75,5d,e3,
e8,7c,e1,09,eb,56,69,84,90,2f,21,1f,ec,a7,56,c7,06,6a,b0,43,3c,34,96,bb,8a,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-2713266562-1326134346-4058669467-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:f2,b7,a4,b2,31,e5,b9,5b,07,a0,14,76,7e,3d,67,48,6d,01,f7,a5,fb,
70,62,b3,70,b0,7a,66,01,f2,a0,c3,9b,3d,27,b2,03,0e,6c,75,9b,88,5e,fb,d9,5c,\
"rkeysecu"=hex:de,ca,3c,78,81,dd,51,8b,8c,2c,53,f4,3f,88,22,26

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Voltooingstijd: 2010-02-07 19:37:22
ComboFix-quarantined-files.txt 2010-02-07 18:37

Pre-Run: 628.991.590.400 bytes beschikbaar
Post-Run: 648.003.878.912 bytes beschikbaar

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 50A362BEC25619063E7DCA35BBAB332B

MBStein · **Geregistreerd:** zo feb 07, 2010 1:19 pm **Berichten:** 7

Toevoeging.... ik weet niet zeker, maar het lijkt in mijn Firewall-lijst alsof het programma SF.exe eruit is ontsnapt... en van wat ik lees, is dat een gedeelte van een virus?...

MBStein · **Geregistreerd:** zo feb 07, 2010 1:19 pm **Berichten:** 7

Als toevoeging nog 1x logs van Malwarebytes en HiJackThis... lijkt erop dat mijn PC nu schoon is... kunnen er nog 1x naar kijken en als jullie verder niks bijzonders zien, het verplaatsen naar afgesloten topics?
Bedankt voor alle hulp!
Gr. Michael

Citaat:

Malwarebytes' Anti-Malware 1.44
Database versie: 3700
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

7-2-2010 19:56:26
mbam-log-2010-02-07 (19-56-26).txt

Scan type: Snelle Scan
Objecten gescand: 99543
Verstreken tijd: 3 minute(s), 17 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Citaat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:00, on 7-2-2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\conime.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMCWCU] "C:\Program Files\SMC\SMCWPCIT-G\SMCWCU.exe" -nogui
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab ... detect.cab
O23 - Service: SMC Configuration Service (ACS) - Unknown owner - C:\Windows\system32\acs.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Dragon Age: Origins Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Steam\Steamapps\Common\Dragon Age Origins\bin_ship\daupdatersvc.service.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: PLFlash DeviceIoControl Service - Unknown owner - C:\Windows\system32\IoctlSvc.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe

--
End of file - 5311 bytes

kape · **Geplaatst:** zo feb 07, 2010 8:20 pm

Problemen van de baan, dan is het tijd voor de “grote schoonmaak” : verwijderen van gebruikte programma’s, een cleaning en het verwijderen van de besmette herstelpunten.

Verwijder Combofix: Start -> Uitvoeren en typ: ComboFix /Uninstall
Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Download CCleaner. Klik op deze pagina op één van de mirrorsites van MajorGeeks en dan start de download van CCleaner automatisch en gratis op.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

That's it !

MBStein · **Geregistreerd:** zo feb 07, 2010 1:19 pm **Berichten:** 7

Ik had al CCleaner, dus ik heb het gelijk gedraaid. Inderdaad wat fixes nodig, maar was na 1x al goed.
Bedankt!!

(Geblokkeerde) inkomende verbindingen - virus blijft bezig

Wie is er online