Archief - Hardnekkige Trojan(s?)....

Sinds gisterenochtend heb ik plots last van een Trojan die ik vermoedelijk heel lang geleden ook gehad heb, maar deze lijkt wel een pak lastiger te zijn dan de vorige.
Ik merkte op dat m'n winlogon.exe plotseling 50+ comp usage innam en ik wist al direct hoe laat het was want ik had vroeger kennis gemaakt met dit virus. Alles goed en wel dacht ik, ik run m'n antivirus programs en spyware detectors etc etc, om het te deleten en ik ben er vanaf....NIET dus :\
Plots kreeg ik ook last van porno pop-ups en ook wanneer ik in google een site bezocht werd ik ipv naar die site gebracht te worden, onmiddellijk gelinkt naar porno links, steeds keer op keer opnieuw. Dus nu draait m'n pc niet alleen constant op 100% usage, maar heb ik ook massas pop-ups en backdoor links.

De PC zelf is een P4 3.0Ghz met 2GB RAM.

Even opnoemen welke antivirus programs ik al 1 of meerdere malen gedraait heb:

McAffee: 2x, vond zelf de trojan niet, noch andere virussen op m'n comp
Avast! Scan: 2x, eigenaardig genoeg had ik plots last van het winlogon.exe virus toen ik de 1e maal gedaan had met deze scan te draaien, het probleem ontstond dus kort hierna, geen idee of het er iets mee te maken heeft...ik vermoed van niet maar je weet nooit. Dit vond ook het virus niet, maar wel een aantal andere die (vermoedelijk??) verwijdert zijn.
Adaware 2007: 2x, bij beide malen dat ik begon te scannen, crashte m'n pc kort na het starten ervan. Ik kan het programma dus niet gebruiken voor 1 of andere reden.
Windows Defender Scanner: 1x, vond niks.
AntiVir Scanner: Dit vond dus verscheidene virussen waaronder een bepaald virus dat absoluut niet verwijdert kon worden, namelijk TR/Crypt.Morphine.Gen dat zich onder mijn C:\WINDOWs\system32\clbcatqg.dll bevond.
Nu, Antivir SPAMDE dus mij constant met het zeggen van dat deze trojan detected was en gaf me telkens weer de optie om te deleten, quarantaine....enz, ik probeerde te deleten maar daar had ik geen toegang voor (acces denied of program used by someone, blabla) dus gaf ik op en stopt ik het in quarantaine. Maar iedere maal dat ik het wegstopte, popte de waarschuwing opnieuw na enkele seconden terug, telkens met dezelfde maar ik vermoed nieuw aagemaakte trojan. Met als gevolg dat ik nu ongeveer 100+ van die dingen in quarantaine heb en het houdt maar niet op.
SpywareBlaster: Gebruik ik nu ook net, maar dat doet zo te zien geheel niks...

Tot zover dat avontuurtje wat me al serieus de keel uithangt...toen las ik hier wat en DLde ik ComboFix. Ik draai het, en het meldde me uiteindelijk dat het verschillende dingen gedelete heeft, maar het winlogon.exe virus draait nog steeds aan 50%+ usage, dus het probleem blijft....
Na deze background story hier de HJT log, kan zijn dat het serieus fucked up is, want ik ken er niks van eerlijk gezegd:
----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:54:06, on 11/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\Avast4\aswUpdSv.exe
C:\Avast4\ashServ.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\windows\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Avast4\ashWebSv.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\windows\system32\CTHELPER.EXE
C:\windows\LOGI_MWX.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Winamp\winampa.exe
C:\Avast4\ashDisp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\windows\system32\ctfmon.exe
C:\Spybot - Search & Destroy\TeaTimer.exe
D:\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\windows\system32\taskmgr.exe
C:\windows\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REGystem.ini: UserInit=userinit.exe
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe
O4 - HKLM\..\Run: [avast!] C:\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = D:\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\SPYBOT~1\SDHelper.dll
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1179491642015
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Avast4\ashWebSv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

--
End of file - 9032 bytes

Ik heb ook de log van de ComboFix, ik zal die hieronder posten om het wat minder onoverzichtelijk te maken. Ik ben echt ten einde raad wat hiermee aan te vangen.....alle hulp is enorm welkom en ik apprecieer het ten volste.

Hier dus de ComboFix Log:
---------------------------------------


ComboFix 07-11-08.1 - Lorean 2007-11-11 14:37:38.1 - NTFSx86 MINIMAL
.
Rootkit driver pe386 is present. ... attempting disinfection
pe386 ...... driver unloaded successfully.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\hidires
C:\Documents and Settings\Administrator\Application Data\install.dat
C:\Documents and Settings\Administrator\Desktop\internet.lnk
C:\Documents and Settings\Lorean\Desktop\internet.lnk
C:\windows\exefld
C:\WINDOWS\Fonts\acrsec.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\windows\httpconf.dat
C:\windows\system32\clbcatqg.dll
C:\windows\system32\clbcatqg.dll.bak
C:\windows\system32\cookie.dat
C:\windows\system32\d3dx9_26a.dll
C:\windows\system32\drv32dta
C:\windows\system32\drv32dta\klg.tmp
C:\windows\system32\drv32dta\pstore_070512_185025.txt
C:\windows\system32\drv32dta\pstore_070512_201717.txt
C:\windows\system32\drv32dta\pstore_070512_231906.txt
C:\windows\system32\drv32dta\pstore_070513_115054.txt
C:\windows\system32\drv32dta\pstore_070513_115953.txt
C:\windows\system32\drv32dta\pstore_070513_130615.txt
C:\windows\system32\drv32dta\pstore_070513_150052.txt
C:\windows\system32\drv32dta\pstore_070513_180847.txt
C:\windows\system32\drv32dta\pstore_070513_194024.txt
C:\windows\system32\drv32dta\pstore_070514_112945.txt
C:\windows\system32\drv32dta\pstore_070514_181359.txt
C:\windows\system32\drv32dta\pstore_070515_112546.txt
C:\windows\system32\drv32dta\pstore_070515_201648.txt
C:\windows\system32\drv32dta\pstore_070516_100447.txt
C:\windows\system32\drv32dta\pstore_070516_174522.txt
C:\windows\system32\drv32dta\pstore_070517_121809.txt
C:\windows\system32\drv32dta\pstore_070518_115921.txt
C:\windows\system32\drv32dta\pstore_070518_193527.txt
C:\windows\system32\drv32dta\pstore_070519_112315.txt
C:\windows\system32\drv32dta\pstore_070519_170001.txt
C:\windows\system32\drv32dta\pstore_070519_200839.txt
C:\windows\system32\drv32dta\pstore_070520_114512.txt
C:\windows\system32\drv32dta\pstore_070520_200354.txt
C:\windows\system32\drv32dta\pstore_070521_114321.txt
C:\windows\system32\drv32dta\pstore_070521_190301.txt
C:\windows\system32\drv32dta\pstore_070522_103721.txt
C:\windows\system32\drv32dta\pstore_070522_192146.txt
C:\windows\system32\drv32dta\pstore_070523_111316.txt
C:\windows\system32\drv32dta\pstore_070523_175429.txt
C:\windows\system32\drv32dta\pstore_070524_111329.txt
C:\windows\system32\drv32dta\pstore_070524_180125.txt
C:\windows\system32\drv32dta\pstore_070524_213229.txt
C:\windows\system32\drv32dta\pstore_070525_101332.txt
C:\windows\system32\drv32dta\pstore_070525_190430.txt
C:\windows\system32\drv32dta\pstore_070525_205233.txt
C:\windows\system32\drv32dta\pstore_070525_220506.txt
C:\windows\system32\drv32dta\pstore_070526_104910.txt
C:\windows\system32\drv32dta\pstore_070526_130509.txt
C:\windows\system32\drv32dta\pstore_070526_170804.txt
C:\windows\system32\drv32dta\pstore_070526_193558.txt
C:\windows\system32\drv32dta\pstore_070527_103128.txt
C:\windows\system32\drv32dta\pstore_070527_162136.txt
C:\windows\system32\drv32dta\pstore_070527_194137.txt
C:\windows\system32\drv32dta\pstore_070528_002606.txt
C:\windows\system32\drv32dta\pstore_070528_110358.txt
C:\windows\system32\drv32dta\pstore_070528_185254.txt
C:\windows\system32\drv32dta\pstore_070528_202419.txt
C:\windows\system32\drv32dta\pstore_070528_232233.txt
C:\windows\system32\drv32dta\pstore_070528_234105.txt
C:\windows\system32\drv32dta\pstore_070528_234518.txt
C:\windows\system32\drv32dta\pstore_070529_103034.txt
C:\windows\system32\drv32dta\pstore_070529_180921.txt
C:\windows\system32\drv32dta\pstore_070530_094550.txt
C:\windows\system32\drv32dta\pstore_070530_210535.txt
C:\windows\system32\drv32dta\pstore_070531_101211.txt
C:\windows\system32\drv32dta\pstore_070531_171625.txt
C:\windows\system32\drv32dta\pstore_070601_101517.txt
C:\windows\system32\drv32dta\pstore_070602_112242.txt
C:\windows\system32\drv32dta\pstore_070602_130438.txt
C:\windows\system32\drv32dta\pstore_070603_105033.txt
C:\windows\system32\drv32dta\pstore_070603_172431.txt
C:\windows\system32\drv32dta\pstore_070604_093729.txt
C:\windows\system32\drv32dta\pstore_070604_131135.txt
C:\windows\system32\drv32dta\pstore_070604_161256.txt
C:\windows\system32\drv32dta\pstore_070604_201806.txt
C:\windows\system32\drv32dta\pstore_070605_095321.txt
C:\windows\system32\drv32dta\pstore_070605_154556.txt
C:\windows\system32\drv32dta\pstore_070605_164321.txt
C:\windows\system32\drv32dta\pstore_070605_173530.txt
C:\windows\system32\drv32dta\pstore_070605_191029.txt
C:\windows\system32\drv32dta\pstore_070605_231257.txt
C:\windows\system32\drv32dta\pstore_070606_093813.txt
C:\windows\system32\drv32dta\pstore_070606_232444.txt
C:\windows\system32\drv32dta\pstore_070607_102731.txt
C:\windows\system32\drv32dta\pstore_070607_125839.txt
C:\windows\system32\drv32dta\pstore_070608_173503.txt
C:\windows\system32\drv32dta\pstore_070609_112216.txt
C:\windows\system32\drv32dta\pstore_070609_190153.txt
C:\windows\system32\drv32dta\pstore_070609_222020.txt
C:\windows\system32\drv32dta\pstore_070610_111416.txt
C:\windows\system32\drv32dta\pstore_070610_130228.txt
C:\windows\system32\drv32dta\pstore_070610_152246.txt
C:\windows\system32\drv32dta\pstore_070610_190842.txt
C:\windows\system32\drv32dta\pstore_070611_001713.txt
C:\windows\system32\drv32dta\pstore_070611_082541.txt
C:\windows\system32\drv32dta\pstore_070611_115850.txt
C:\windows\system32\drv32dta\pstore_070611_172226.txt
C:\windows\system32\drv32dta\pstore_070611_184622.txt
C:\windows\system32\drv32dta\pstore_070611_235451.txt
C:\windows\system32\drv32dta\pstore_070612_114013.txt
C:\windows\system32\drv32dta\pstore_070612_200328.txt
C:\windows\system32\drv32dta\pstore_070612_222612.txt
C:\windows\system32\drv32dta\pstore_070613_111748.txt
C:\windows\system32\drv32dta\pstore_070613_163113.txt
C:\windows\system32\drv32dta\pstore_070614_084827.txt
C:\windows\system32\drv32dta\pstore_070614_190913.txt
C:\windows\system32\drv32dta\pstore_070615_110753.txt
C:\windows\system32\drv32dta\pstore_070615_162132.txt
C:\windows\system32\drv32dta\pstore_070615_190740.txt
C:\windows\system32\drv32dta\pstore_070615_235800.txt
C:\windows\system32\drv32dta\pstore_070616_131809.txt
C:\windows\system32\drv32dta\pstore_070616_200902.txt
C:\windows\system32\drv32dta\pstore_070617_130459.txt
C:\windows\system32\drv32dta\pstore_070617_190920.txt
C:\windows\system32\drv32dta\pstore_070617_214621.txt
C:\windows\system32\drv32dta\pstore_070618_082858.txt
C:\windows\system32\drv32dta\pstore_070618_170224.txt
C:\windows\system32\drv32dta\pstore_070619_102959.txt
C:\windows\system32\drv32dta\pstore_070619_190210.txt
C:\windows\system32\drv32dta\pstore_070619_220537.txt
C:\windows\system32\drv32dta\pstore_070620_094009.txt
C:\windows\system32\drv32dta\pstore_070620_163407.txt
C:\windows\system32\drv32dta\pstore_070620_212610.txt
C:\windows\system32\drv32dta\pstore_070621_112406.txt
C:\windows\system32\drv32dta\pstore_070621_190609.txt
C:\windows\system32\drv32dta\pstore_070622_130721.txt
C:\windows\system32\drv32dta\pstore_070622_160745.txt
C:\windows\system32\drv32dta\pstore_070622_165534.txt
C:\windows\system32\drv32dta\pstore_070622_170405.txt
C:\windows\system32\drv32dta\pstore_070622_173742.txt
C:\windows\system32\drv32dta\pstore_070622_175554.txt
C:\windows\system32\drv32dta\pstore_070623_022012.txt
C:\windows\system32\drv32dta\pstore_070623_112605.txt
C:\windows\system32\drv32dta\pstore_070623_194414.txt
C:\windows\system32\lzx32.sys
C:\windows\system32\ps.dat
C:\windows\system32\rpcc.dll
C:\windows\system32\wsnpoem
C:\windows\system32\wsnpoem\video(10)(2).dll
C:\windows\system32\wsnpoem\video(11)(2).dll
C:\windows\system32\wsnpoem\video(12)(2).dll
C:\windows\system32\wsnpoem\video(13)(2).dll
C:\windows\system32\wsnpoem\video(14)(2).dll
C:\windows\system32\wsnpoem\video(2)(2).dll
C:\windows\system32\wsnpoem\video(2)(3).dll
C:\windows\system32\wsnpoem\video(2)(4).dll
C:\windows\system32\wsnpoem\video(24)(2).dll
C:\windows\system32\wsnpoem\video(25)(2).dll
C:\windows\system32\wsnpoem\video(26)(2).dll
C:\windows\system32\wsnpoem\video(3)(2).dll
C:\windows\system32\wsnpoem\video(3)(3).dll
C:\windows\system32\wsnpoem\video(3)(4).dll
C:\windows\system32\wsnpoem\video(4)(2).dll
C:\windows\system32\wsnpoem\video(4)(3).dll
C:\windows\system32\wsnpoem\video(4)(4).dll
C:\windows\system32\wsnpoem\video(5)(2).dll
C:\windows\system32\wsnpoem\video(5)(3).dll
C:\windows\system32\wsnpoem\video(9)(2).dll
C:\windows\system32\wsnpoem\video.dll
C:\windows\Tasks.\At1.job
C:\windows\system32\drivers\gxzqbjkl.dat . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NTDBAPEV
-------\LEGACY_NTIO256
-------\LEGACY_PRYGXUOB
-------\ntdbapev
-------\ntio256
-------\prygxuob


((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 )))))))))))))))))))))))))))))))
.

2007-11-11 14:34 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-11 12:49 <DIR> d-------- C:\Spybot - Search & Destroy
2007-11-11 12:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-11 12:35 <DIR> d-------- C:\SpywareBlaster
2007-11-11 12:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic
2007-11-10 18:40 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-10 18:40 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-11-10 18:40 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-10 18:40 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-10 18:40 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-10 18:40 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-10 18:40 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-10 18:15 <DIR> d-------- C:\Documents and Settings\Lorean\Application Data\WholeSecurity
2007-11-10 18:15 28,672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys
2007-11-09 21:20 <DIR> d-------- C:\Documents and Settings\Lorean\Application Data\vlc
2007-11-09 20:47 <DIR> d-------- C:\VideoLAN
2007-11-06 21:39 741,632 --a------ C:\WINDOWS\system32\cfintmro.dat
2007-11-06 21:39 246,545 --a------ C:\WINDOWS\system32\libssl32.dll
2007-11-06 21:39 120,064 --a------ C:\WINDOWS\system32\txllvkkk.dat
2007-11-06 21:39 41,728 --a------ C:\WINDOWS\system32\vfjppawh.dat
2007-11-06 21:39 36,096 --a------ C:\WINDOWS\system32\ktuljwaw.dat
2007-11-06 21:30 <DIR> d-------- C:\WINDOWS\system32\AppCert
2007-11-06 21:29 18,688 --a------ C:\WINDOWS\system32\drivers\gxzqbjkl.dat
2007-11-05 12:22 <DIR> d---s---- C:\Documents and Settings\Lorean\UserData
2007-10-29 18:25 <DIR> d-------- C:\World of Warcraft
2007-10-29 17:08 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-10-29 16:59 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-10-29 16:58 <DIR> d-------- C:\Program Files\ATI Technologies
2007-10-29 16:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Logitech
2007-10-13 14:16 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2007-10-13 14:15 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE
2007-10-12 13:06 664 --a------ C:\WINDOWS\system32\d3d9caps.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-08 10:09 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-11-01 21:38 --------- d-----w C:\Documents and Settings\Lorean\Application Data\LimeWire
2007-10-30 09:47 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2007-10-29 16:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-13 13:16 --------- d-----w C:\Program Files\DivX
2007-10-13 13:15 --------- d-----w C:\Program Files\MSN Messenger
2007-09-29 05:46 47,376 ----a-w C:\windows\system32\drivers\ativvpxx.vp
2007-09-29 03:05 2,456,064 ----a-w C:\windows\system32\drivers\ati2mtag.sys
2007-09-29 02:19 49,152 ----a-w C:\windows\system32\drivers\ati2erec.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2007-09-04 10:42]
"CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2007-09-04 10:42]
"CTHelper"="CTHELPER.EXE" [2002-12-19 07:59 C:\WINDOWS\system32\CTHELPER.EXE]
"AsioReg"="REGSVR32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\regsvr32.exe]
"SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 17:06]
"CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2002-09-13 00:04]
"Logitech Utility"="LOGI_MWX.EXE" [2003-12-11 10:50 C:\WINDOWS\LOGI_MWX.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 11:45 C:\WINDOWS\KHALMNPR.Exe]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-08-18 08:00]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]
"iTunesHelper"="C:\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-04 18:12]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24]
"WinampAgent"="D:\Winamp\winampa.exe" [2007-08-24 19:05]
"avast!"="C:\Avast4\ashDisp.exe" [2007-09-06 12:06]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-11 12:37]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-04 00:56]
"SpybotSD TeaTimer"="C:\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - D:\Logitech\SetPoint\SetPoint.exe [2007-09-03 11:12:09]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
@=

R1 NaiAvTdi1;NaiAvTdi1;C:\windows\system32\drivers\mvstdi5x.sys
R2 UxTuneUp;TuneUp Theme Extension;C:\windows\System32\svchost.exe -k netsvcs
R3 ctgame;Game Port;C:\windows\system32\DRIVERS\ctgame.sys
S2 MSWinLogonProcService;Windows Logon Process Service;"C:\windows\winlogon.exe" -service
S2 NMSSvc;Intel(R) NMS;C:\WINDOWS\System32\NMSSvc.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{43564368-4375-8601-4371-458454791235]
C:\windows\system32\tcpconn.exe /r
.
Contents of the 'Scheduled Tasks' folder
"2007-10-30 10:19:02 C:\windows\Tasks\AppleSoftwareUpdate.job"
"2007-11-09 16:15:00 C:\windows\Tasks\Easy Onderhoud.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-11-11 13:45:43 C:\windows\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-11 14:46:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run?2??wd??????w????????[#??????h?@?x??????wD??????sx??sfn??????y??w????@@@????|D@@?????>??w?????92?H??????|???|???????|L(?s?92??????/?s????????D???????????????????,????????????+?s@@@?D???`|?w??????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-11 14:48:43 - machine was rebooted
.
--- E O F ---

* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
• Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
• Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
• Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
• Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
• Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
• Klik daarna de groene pijl rechts om de scan te starten.
• Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
• Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
  
• Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
  
  
  
  Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
• Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
• Sluit daarna Dr.Web Cureit.
• Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
• Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.