Archief - virtumonde probleem

Hey allemaal,

Ik heb men pc pas geformatteerd maar heb nu de virtumonde trojan binnen. Ik heb spybot en malware laten scannen en ze vinden hem maar kunnen 1 bestand wel verwijderen maar het komt dus natuurlijk elke keer terug.
Als gevolg van deze trojan krijg je telkens meer trojans binnen en jullie kennen het liedje dus wel Ook scannen in veilige modus helpt niet.
Hier dan maar een hijackThis log waarmee ik hoop dat iemand van jullie er iets in ziet. Dank bij voorbaat.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:32:05, on 23/12/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\e3ae9c47fe2d587c4f8623a201f595da\update\update.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
c:\windows\$hf_mig$\KB917422\update\update.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {524312f8-c566-43c7-836a-6d77b06bab75} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [weruyahaze] Rundll32.exe "C:\WINDOWS\System32\rogumike.dll",s
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O20 - AppInit_DLLs: c:\windows\system32\dasakebe.dll ,
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe

--
End of file - 3182 bytes

Download VundoFix.exe naar je bureaublad.

• Dubbelklik VundoFix.exe om het te starten.
• Klik de Scan for Vundo knop.
• Eenmaal gedaan met scannen, klik de Remove Vundo knop.
• Je zal een melding krijgen of je de bestanden wilt laten verwijderen, klik YES
• Nadat je Yes hebt geklikt, zullen de icoontjes op je bureaublad verdwijnen tijdens het verwijderen van Vundo.
• Wanneer voltooid zal je de melding krijgen dat het je PC zal afsluiten, klik OK.
• Start je pc terug opnieuw op.
• Post de inhoud van C:\vundofix.txt en een nieuwe hijackthislog in je volgende post.

Note: Het is mogelijk dat vundofix een bestand gevonden heeft dat niet kon verwijderd worden.
In dit geval zal VundoFix na het heropstarten van je pc nog eens opstarten. Dan moet je de instructies van hierboven nog eens uitvoeren vanaf: "Click the Scan for Vundo."

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

ok hier zijn beide logfiles:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:41:16, on 24/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {524312f8-c566-43c7-836a-6d77b06bab75} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [weruyahaze] Rundll32.exe "C:\WINDOWS\System32\rogumike.dll",s
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O20 - AppInit_DLLs: c:\windows\system32\dasakebe.dll ,
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe

--
End of file - 3692 bytes



ComboFix 08-12-23.01 - wout 2008-12-24 15:38:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.1535.1082 [GMT 1:00]
Gestart vanuit: c:\documents and settings\wout\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\esameris.ini

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-11-24 to 2008-12-24 ))))))))))))))))))))))))))))))
.

2008-12-24 12:39 . 2008-12-24 12:44 <DIR> d-------- c:\documents and settings\wout\Application Data\My Battle for Middle-earth(tm) II Files
2008-12-24 11:25 . 2008-12-24 11:25 <DIR> d-------- c:\windows\LastGood
2008-12-24 11:25 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-12-24 11:25 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
2008-12-24 11:25 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-12-23 21:29 . 2008-12-23 21:29 268 --ah----- C:\sqmdata00.sqm
2008-12-23 21:29 . 2008-12-23 21:29 244 --ah----- C:\sqmnoopt00.sqm
2008-12-23 19:03 . 2008-12-23 19:03 <DIR> d----c--- c:\windows\system32\DRVSTORE
2008-12-23 19:03 . 2008-12-23 19:03 <DIR> d-------- c:\documents and settings\wout\Contacts
2008-12-23 19:00 . 2008-12-23 19:03 <DIR> d-------- c:\program files\Windows Live
2008-12-23 19:00 . 2008-12-23 19:02 <DIR> d--hsc--- c:\program files\Common Files\WindowsLiveInstaller
2008-12-23 19:00 . 2008-12-23 19:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-23 18:54 . 2008-12-23 21:16 <DIR> d-a------ c:\documents and settings\All Users\Application Data\Sports Interactive
2008-12-23 17:36 . 2008-12-23 17:36 <DIR> d-------- c:\program files\Windows Media Connect 2
2008-12-23 17:36 . 2008-09-17 23:55 201,050 --a------ c:\windows\system32\nvapps.nvb
2008-12-23 17:35 . 2008-12-23 17:35 <DIR> d-------- c:\windows\system32\drivers\UMDF
2008-12-23 17:33 . 2008-12-23 17:40 <DIR> d-------- c:\documents and settings\wout\Application Data\My The Lord of the Rings, The Rise of the Witch-king Files
2008-12-23 17:31 . 2008-12-23 17:31 <DIR> d-------- c:\windows\system32\URTTemp
2008-12-23 16:45 . 2008-12-23 21:15 <DIR> d-------- c:\documents and settings\wout\Application Data\Sports Interactive
2008-12-23 16:26 . 2008-12-23 16:34 <DIR> d-------- c:\program files\Matroska Pack
2008-12-23 16:25 . 2008-12-23 16:25 <DIR> d-------- c:\program files\K-Lite Codec Pack
2008-12-23 16:25 . 2007-09-04 17:56 164,352 --a------ c:\windows\system32\unrar.dll
2008-12-23 16:25 . 2008-07-30 20:09 38 --a------ c:\windows\avisplitter.ini
2008-12-23 16:12 . 2008-12-13 07:39 3,593,216 -----c--- c:\windows\system32\dllcache\mshtml.dll
2008-12-23 16:12 . 2008-08-14 14:27 2,193,536 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-23 16:12 . 2008-08-14 14:27 2,149,888 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-23 16:12 . 2008-08-14 14:27 2,070,400 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-23 16:12 . 2008-08-14 14:27 2,028,544 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-23 16:12 . 2008-09-15 16:28 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-12-23 16:12 . 2008-10-16 02:02 1,499,136 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2008-12-23 16:12 . 2008-10-16 21:33 1,160,192 -----c--- c:\windows\system32\dllcache\urlmon.dll
2008-12-23 16:12 . 2008-10-16 21:33 826,368 -----c--- c:\windows\system32\dllcache\wininet.dll
2008-12-23 16:12 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-12-23 16:12 . 2008-06-14 18:36 272,640 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-12-23 16:12 . 2008-08-14 11:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys
2008-12-23 16:11 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-12-23 16:11 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-12-23 16:11 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-23 16:11 . 2008-10-15 17:37 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-12-23 16:11 . 2008-05-01 15:37 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2008-12-23 16:11 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2008-12-23 16:06 . 2008-12-23 16:18 <DIR> d-------- c:\windows\system32\nl-nl
2008-12-23 16:06 . 2008-12-23 16:06 <DIR> d-------- c:\windows\system32\nl
2008-12-23 16:06 . 2008-12-23 16:06 <DIR> d-------- c:\windows\l2schemas
2008-12-23 15:38 . 2008-12-23 15:38 <DIR> d-------- c:\documents and settings\LocalService\Menu Start
2008-12-23 15:38 . 2008-12-23 17:35 316,640 --a------ c:\windows\WMSysPr9.prx
2008-12-23 15:25 . 2008-12-23 15:25 <DIR> d-------- c:\windows\provisioning
2008-12-23 15:25 . 2008-12-23 16:06 <DIR> d-------- c:\windows\peernet
2008-12-23 15:24 . 2008-12-23 15:24 <DIR> d-------- c:\windows\ServicePackFiles
2008-12-23 15:22 . 2008-12-23 16:06 <DIR> d-------- c:\windows\EHome
2008-12-22 16:21 . 2001-08-17 21:56 7,552 --a------ c:\windows\system32\drivers\SONYPVU1.SYS
2008-12-22 16:21 . 2001-08-17 21:56 7,552 --a--c--- c:\windows\system32\dllcache\sonypvu1.sys
2008-12-22 13:52 . 2008-12-22 13:52 <DIR> d-------- C:\fsaua.data
2008-12-22 13:33 . 2008-12-22 13:33 <DIR> d-------- c:\documents and settings\wout\Application Data\Malwarebytes
2008-12-22 13:29 . 2008-12-22 13:29 <DIR> d-------- c:\program files\Trend Micro
2008-12-22 12:29 . 2008-12-22 12:29 <DIR> d-------- C:\VundoFix Backups
2008-12-22 12:18 . 2008-12-22 12:18 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-22 12:18 . 2008-12-22 12:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-22 12:18 . 2008-12-22 12:18 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes
2008-12-22 12:18 . 2008-12-03 19:53 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-22 12:18 . 2008-12-03 19:53 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-22 12:07 . 2008-12-22 13:41 <DIR> d-------- c:\program files\XoftSpySE
2008-12-22 11:09 . 2008-12-21 15:56 <DIR> d--h----- c:\documents and settings\Administrator\Sjablonen
2008-12-22 11:09 . 2008-12-21 16:44 <DIR> d--h----- c:\documents and settings\Administrator\Onlangs geopend
2008-12-22 11:09 . 2008-12-21 16:44 <DIR> d--h----- c:\documents and settings\Administrator\Netwerkprinteromgeving
2008-12-22 11:09 . 2008-12-21 16:44 <DIR> d-------- c:\documents and settings\Administrator\Mijn documenten
2008-12-22 11:09 . 2008-12-21 16:44 <DIR> dr------- c:\documents and settings\Administrator\Menu Start
2008-12-22 11:09 . 2008-12-22 11:09 <DIR> d-------- c:\documents and settings\Administrator\Favorieten
2008-12-22 11:09 . 2008-12-22 13:29 <DIR> d-------- c:\documents and settings\Administrator\Bureaublad
2008-12-22 11:09 . 2008-12-22 11:09 <DIR> d-------- c:\documents and settings\Administrator
2008-12-21 19:31 . 2002-04-15 21:11 67,866 --------- c:\windows\system32\drivers\netwlan5.img
2008-12-21 19:31 . 2008-04-14 22:33 11,264 --------- c:\windows\system32\spnpinst.exe
2008-12-21 19:31 . 2004-08-02 14:20 7,208 --------- c:\windows\system32\secupd.sig
2008-12-21 19:31 . 2004-08-02 14:20 4,569 --------- c:\windows\system32\secupd.dat
2008-12-21 18:46 . 2008-12-23 17:35 <DIR> d-------- c:\windows\system32\LogFiles
2008-12-21 18:46 . 2008-12-23 16:56 201,440 --a------ c:\windows\system32\PnkBstrB.exe
2008-12-21 18:46 . 2008-12-23 16:56 138,512 --a------ c:\windows\system32\drivers\PnkBstrK.sys
2008-12-21 18:46 . 2008-12-21 18:46 66,872 --a------ c:\windows\system32\PnkBstrA.exe
2008-12-21 18:16 . 2008-12-21 18:16 153 --a------ c:\windows\wininit.ini
2008-12-21 17:38 . 2008-12-21 17:38 <DIR> d--h----- c:\windows\PIF
2008-12-21 17:30 . 2008-12-21 17:30 0 --a------ c:\windows\nsreg.dat
2008-12-21 17:26 . 2008-04-14 18:02 1,092,096 --a------ c:\windows\system32\esent.dll
2008-12-21 17:17 . 2008-12-23 16:06 <DIR> d-------- c:\windows\system32\bits
2008-12-21 17:17 . 2008-12-23 16:43 <DIR> d--h----- c:\windows\$hf_mig$
2008-12-21 17:17 . 2008-12-21 17:17 <DIR> d--hs---- c:\documents and settings\wout\UserData
2008-12-21 17:17 . 2007-08-10 20:52 26,488 --a------ c:\windows\system32\spupdsvc.exe

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 15:17 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2008-12-21 15:16 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-21 15:15 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-21 15:12 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-21 15:11 --------- d-----w c:\program files\Lavasoft
2008-12-21 15:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-21 15:04 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-21 15:04 --------- d-----w c:\program files\Realtek AC97
2008-12-21 15:03 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-21 14:58 558,142 ----a-w c:\windows\java\Packages\M5ZRD7P3.ZIP
2008-12-21 14:58 155,995 ----a-w c:\windows\java\Packages\QLRJ1JZZ.ZIP
2008-12-21 14:58 --------- d-----w c:\program files\microsoft frontpage
2008-10-27 09:04 70,992 ----a-w c:\windows\system32\XAPOFX1_2.dll
2008-10-27 09:04 514,384 ----a-w c:\windows\system32\XAudio2_3.dll
2008-10-27 09:04 235,856 ----a-w c:\windows\system32\xactengine3_3.dll
2008-10-27 09:04 23,376 ----a-w c:\windows\system32\X3DAudio1_5.dll
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:43 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-10 03:52 452,440 ----a-w c:\windows\system32\d3dx10_40.dll
2008-10-10 03:52 4,379,984 ----a-w c:\windows\system32\D3DX9_40.dll
2008-10-10 03:52 2,036,576 ----a-w c:\windows\system32\D3DCompiler_40.dll
2008-10-03 10:05 247,326 ----a-w c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-12-17 2107224]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"SoundMan"="SOUNDMAN.EXE" [2005-07-22 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= c:\windows\system32\dasakebe.dll ,

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Wolfenstein - Enemy Territory\\ET.exe"=
"e:\\bfme 2\\game.dat"=
"e:\\bfme 2\\BFME 2 WITCH\\game.dat"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=


*Newly Created Service* - PROCEXP90
.
Inhoud van de 'Gedeelde Taken' map

2008-12-24 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe [2008-12-17 18:43]

2008-12-22 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe [2008-12-17 18:43]
.
- - - - ORPHANS VERWIJDERD - - - -

BHO-{524312f8-c566-43c7-836a-6d77b06bab75} - (no file)
HKLM-Run-weruyahaze - c:\windows\System32\rogumike.dll


.
------- Bijkomende Scan -------
.

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\wout\Application Data\Mozilla\Firefox\Profiles\6ga2ypji.default\
FF - prefs.js: browser.startup.homepage - hxxp://speed.travian.ba/dorf1.php|http://speed.travian.no/dorf1.php|h...php|http://sporza.be/cm/sporza.be/hoofdpunten
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-24 15:39:22
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2008-12-24 15:40:01
ComboFix-quarantined-files.txt 2008-12-24 14:39:48

Pre-Run: 20.804.816.896 bytes beschikbaar
Post-Run: 20,893,536,256 bytes beschikbaar

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

201 --- E O F --- 2008-12-23 17:51:53

Download VirtumundoBegone, sla dit op op je bureaublad.
Dubbelklik op VirtumundoBeGone.exe en volg de aanwijzingen.
Krijg je een blauw scherm met een foutmelding, dan is dit normaal.
Als de fix klaar is, start je de pc opnieuw op.
Plaats de inhoud van het logbestand VBG.TXT, dat nu op je bureaublad staat, in je volgende bericht.

Ook hij vind blijkbaar helemaal niets

[12/24/2008, 15:46:24] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\wout\Bureaublad\VirtumundoBeGone.exe" )
[12/24/2008, 15:46:28] - Detected System Information:
[12/24/2008, 15:46:28] - Windows Version: 5.1.2600, Service Pack 3
[12/24/2008, 15:46:28] - Current Username: wout (Admin)
[12/24/2008, 15:46:28] - Windows is in NORMAL mode.
[12/24/2008, 15:46:28] - Searching for Browser Helper Objects:
[12/24/2008, 15:46:28] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/24/2008, 15:46:28] - BHO 2: {524312f8-c566-43c7-836a-6d77b06bab75} ()
[12/24/2008, 15:46:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/24/2008, 15:46:28] - No filename found. Continuing.
[12/24/2008, 15:46:28] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[12/24/2008, 15:46:28] - BHO 4: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[12/24/2008, 15:46:28] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/24/2008, 15:46:28] - No filename found. Continuing.
[12/24/2008, 15:46:28] - Finished Searching Browser Helper Objects
[12/24/2008, 15:46:28] - Finishing up...
[12/24/2008, 15:46:28] - Nothing found! Exiting...

* Download en unzip Killbox naar je bureaublad.
Klik op killbox.exe.
Selecteer de optie "Delete on reboot".
In het veld "Full Path of File to Delete" kopieer en plak je het volgende:

C:\WINDOWS\System32\rogumike.dll

Klik op de knop: single file (!Belangrijk!)

Daarna, Klik op de rode cirkel met het wit kruisje erin.
Killbox zal zeggen dat deze file zal verwijderd worden on reboot.. vraagt om nu te rebooten. Klik YES.

Je pc moet nu rebooten. Post dan een nieuw logje hier.

hey,

hij geeft dat hij het bestand niet vind maar als ik nu opstart krijg ik dadelijk een fout dat het bestand dat weg moet, dat hij dat niet meer kan vinden.

Fix de volgende regel in hijackthis:

O4 - HKLM\..\Run: [weruyahaze] Rundll32.exe "C:\WINDOWS\System32\rogumike.dll",s

Dit zou het probleem moeten oplossen.