avg8 traymain wnd virus help me please

hoi

avg heeft wat gevonden en verwijderd

mbam heeft ook wat gevonden en verwijderd

Malwarebytes' Anti-Malware 1.44

Database versie: 3724

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

11-2-2010 14:07:55

mbam-log-2010-02-11 (14-07-55).txt

Scan type: Volledige Scan (C:\|)

Objecten gescand: 266137

Verstreken tijd: 4 hour(s), 5 minute(s), 16 second(s)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 1

Registersleutels geïnfecteerd: 4

Registerwaarden geïnfecteerd: 0

Registerdata bestanden geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 1

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:

C:\Windows\System32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.

Registersleutels geïnfecteerd:

HKEY_CURRENT_USER\SOFTWARE\F5JMWNZTHI (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\ROUA3O12PW (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:

(Geen kwaadaardige items gevonden)

Registerdata bestanden geïnfecteerd:

(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:

(Geen kwaadaardige items gevonden)

spybot laten draaien en ad aware ook laten draaien

nu bezig met windows livecare scanner

hij geeft de trojan aan in c/windows/system32/sshnas21.dll

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:23:01, on 11-2-2010

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18385)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\CyberLink\Shared files\brs.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Windows\sttray.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Program Files\FTD Watchdog\FtdMonitor.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\System32\rundll32.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Windows\system32\ctfmon.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Java\jre6\bin\jucheck.exe

C:\Program Files\windows live safety center\wlschost.EXE

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe

O23 - Service: TomTomHOMEService - TomTom - l:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

–

End of file - 2199 bytes

ik plaats hierna de logfile van gebruiker 2

gr ricardo

bij deze het logje van combofix

omboFix 10-02-10.05 - Gebruiker 11-02-2010 16:18:32.1.4 - x86

Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.31.1043.18.2029.602

Gestart vanuit: L:\ComboFix.exe

SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

c:\$recycle.bin\S-1-5-21-2533741813-687272597-3095552779-1000

c:\$recycle.bin\S-1-5-21-51003140-4199384537-3980697693-500

c:\$recycle.bin\S-1-5-21-985307773-3525220177-1143434857-500

c:\windows\system32\stacsv.exe

(((((((((((((((((((( Bestanden Gemaakt van 2010-01-11 to 2010-02-11 ))))))))))))))))))))))))))))))

2010-02-11 15:25 . 2010-02-11 15:25 ——– d—–w- c:\users\Gebruiker\AppData\Local\temp

2010-02-10 18:13 . 2010-02-10 18:13 10686001 —-a-w- c:\users\Gebruiker\AppData\Roaming\Azureus\plugins\azump\mplayer.exe

2010-01-22 12:40 . 2010-01-22 12:40 ——– d—–w- c:\programdata\TomTom

2010-01-22 12:40 . 2010-01-22 12:40 ——– d—–w- c:\users\Gebruiker\AppData\Roaming\TomTom

2010-01-22 12:40 . 2010-01-22 12:40 ——– d—–w- c:\users\Gebruiker\AppData\Local\TomTom

2010-01-22 12:40 . 2010-01-22 12:40 ——– d—–w- c:\program files\TomTom International B.V

2010-01-22 12:39 . 2010-01-22 12:39 ——– d—–w- c:\program files\TomTom DesktopSuite

2010-01-13 10:30 . 2010-01-13 10:30 ——– d—–w- c:\users\luus\AppData\Roaming\GHISLER

2010-01-13 05:19 . 2009-10-19 14:27 156672 —-a-w- c:\windows\system32\t2embed.dll

2010-01-13 05:19 . 2009-10-19 14:24 72704 —-a-w- c:\windows\system32\fontsub.dll

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

2010-02-11 15:15 . 2008-02-29 01:05 12 —-a-w- c:\windows\bthservsdp.dat

2010-02-11 15:00 . 2008-04-24 20:02 ——– d—–w- c:\programdata\avg8

2010-02-11 14:55 . 2009-08-01 11:58 ——– d—–w- c:\program files\Common Files\NSV

2010-02-11 14:55 . 2008-04-15 17:08 ——– d—–w- c:\program files\Windows Live Safety Center

2010-02-11 13:43 . 2008-02-29 01:02 ——– d—–w- c:\program files\Common Files\Java

2010-02-11 13:41 . 2008-02-29 01:02 ——– d—–w- c:\program files\Java

2010-02-11 06:51 . 2008-04-27 12:00 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs

2010-02-10 21:14 . 2009-09-11 12:40 ——– d—–w- c:\users\Gebruiker\AppData\Roaming\Azureus

2010-02-10 16:19 . 2009-09-11 12:40 ——– d—–w- c:\program files\Vuze

2010-02-08 21:08 . 2008-05-01 19:04 ——– d—–w- c:\users\Gebruiker\AppData\Roaming\GrabIt

2010-02-07 20:17 . 2008-04-15 17:09 ——– d—–w- c:\users\Gebruiker\AppData\Roaming\Winamp

2010-02-06 22:57 . 2006-11-02 16:18 667114 —-a-w- c:\windows\system32\perfh013.dat

2010-02-06 22:57 . 2006-11-02 16:18 126648 —-a-w- c:\windows\system32\perfc013.dat

2010-01-26 19:36 . 2008-04-15 17:21 ——– d—–w- c:\programdata\Messenger Plus!

2010-01-26 19:32 . 2008-04-15 17:09 ——– d—–w- c:\program files\Messenger Plus! Live

2010-01-22 16:34 . 2008-10-30 16:43 ——– d—–w- c:\programdata\Electronic Arts

2010-01-22 16:28 . 2009-02-08 13:34 ——– d—–w- c:\program files\Common Files\Adobe AIR

2010-01-22 16:28 . 2009-08-08 09:02 38784 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-01-22 16:28 . 2009-02-08 13:34 38784 —-a-w- c:\users\Gebruiker\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-01-20 11:03 . 2008-02-29 00:48 ——– d—–w- c:\program files\Microsoft Silverlight

2010-01-19 08:22 . 2008-04-15 17:02 2032 —-a-w- c:\users\Gebruiker\AppData\Local\d3d9caps.dat

2010-01-14 10:12 . 2009-10-02 18:12 181120 ——w- c:\windows\system32\MpSigStub.exe

2010-01-10 22:23 . 2009-01-26 17:22 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware

2010-01-10 22:22 . 2009-04-10 16:39 5115824 —-a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-01-07 15:07 . 2009-01-26 17:22 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 15:07 . 2009-01-26 17:22 19160 —-a-w- c:\windows\system32\drivers\mbam.sys

2009-12-28 12:35 . 2010-02-10 15:15 11776 —-a-w- c:\windows\system32\tsbyuv.dll

2009-12-28 12:35 . 2010-02-10 15:15 1314816 —-a-w- c:\windows\system32\quartz.dll

2009-12-28 12:32 . 2010-02-10 15:15 22528 —-a-w- c:\windows\system32\msyuv.dll

2009-12-28 12:32 . 2010-02-10 15:15 31744 —-a-w- c:\windows\system32\msvidc32.dll

2009-12-28 12:32 . 2010-02-10 15:15 123904 —-a-w- c:\windows\system32\msvfw32.dll

2009-12-28 12:32 . 2010-02-10 15:15 13312 —-a-w- c:\windows\system32\msrle32.dll

2009-12-28 12:31 . 2010-02-10 15:15 82944 —-a-w- c:\windows\system32\mciavi32.dll

2009-12-28 12:31 . 2010-02-10 15:15 50176 —-a-w- c:\windows\system32\iyuv_32.dll

2009-12-28 12:28 . 2010-02-10 15:15 91136 —-a-w- c:\windows\system32\avifil32.dll

2009-12-28 12:28 . 2010-02-10 15:15 65024 —-a-w- c:\windows\system32\avicap32.dll

2009-12-24 00:22 . 2009-12-24 00:22 970504 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2009-12-18 13:05 . 2010-01-22 05:34 833024 —-a-w- c:\windows\system32\wininet.dll

2009-12-18 13:01 . 2010-01-22 05:34 78336 —-a-w- c:\windows\system32\ieencode.dll

2009-12-18 10:14 . 2010-01-22 05:34 26624 —-a-w- c:\windows\system32\ieUnatt.exe

2009-12-17 16:14 . 2009-04-10 17:18 411368 —-a-w- c:\windows\system32\deploytk.dll

2009-12-11 12:07 . 2010-02-10 15:15 301568 —-a-w- c:\windows\system32\drivers\srv.sys

2009-12-11 12:07 . 2010-02-10 15:15 98304 —-a-w- c:\windows\system32\drivers\srvnet.sys

2009-12-08 20:52 . 2010-02-10 15:15 897624 —-a-w- c:\windows\system32\drivers\tcpip.sys

2009-12-08 20:52 . 2010-02-10 15:15 3597912 —-a-w- c:\windows\system32\ntkrnlpa.exe

2009-12-08 20:52 . 2010-02-10 15:15 3546200 —-a-w- c:\windows\system32\ntoskrnl.exe

2009-12-04 16:12 . 2010-02-10 15:15 212992 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys

2009-12-04 16:12 . 2010-02-10 15:15 105472 —-a-w- c:\windows\system32\drivers\mrxsmb.sys

2009-11-25 16:06 . 2009-09-21 15:10 3695616 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AutoLaunch.exe

——- Sigcheck ——-

2008-01-18 . 3F8F251D78D6774FD6FC36255E967632 . 636416 . . . . c:\windows\System32\comctl32.dll

2008-01-08 . AA95F24946558AC70B89137BD11ABE06 . 70656 . . . . c:\windows\System32\ctfmon.exe

2008-01-27 . 2406E3A5FAE743DCE81168A8CDB8573F . 247296 . . . . c:\windows\System32\shsvcs.dll

c:\windows\System32\drivers\beep.sys … is niet aanwezig !!

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

“Sidebar”=“c:\program files\Windows Sidebar\sidebar.exe”

“MsnMsgr”=“c:\program files\Windows Live\Messenger\MsnMsgr.Exe”

“DAEMON Tools Pro Agent”=“c:\program files\DAEMON Tools Pro\DTProAgent.exe”

“IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe”

“Nokia.PCSync”=“c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe”

“PC Suite Tray”=“c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe”

“FTD Watchdog Monitor”=“c:\program files\FTD Watchdog\FtdMonitor.exe”

“IncrediMail”=“c:\program files\IncrediMail\bin\IncMail.exe”

“ehTray.exe”=“c:\windows\ehome\ehTray.exe”

“TomTomHOME.exe”=“l:\program files\TomTom HOME 2\TomTomHOMERunner.exe”

“Windows Defender”=“c:\program files\Windows Defender\MSASCui.exe”

“Windows Mobile Device Center”=“c:\windows\WindowsMobile\wmdc.exe”

“DAEMON Tools Pro Agent”=“c:\program files\DAEMON Tools Pro\DTProAgent.exe”

“RemoteControl”=“c:\program files\CyberLink\PowerDVD\PDVDServ.exe”

“LanguageShortcut”=“c:\program files\CyberLink\PowerDVD\Language\Language.exe”

“BDRegion”=“c:\program files\Cyberlink\Shared Files\brs.exe”

“IAAnotif”=“c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe”

“SigmatelSysTrayApp”=“sttray.exe”

“NBKeyScan”=“c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe”

“LogitechCommunicationsManager”=“c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe”

“LogitechQuickCamRibbon”=“c:\program files\Logitech\QuickCam\Quickcam.exe”

“Ad-Watch”=“c:\program files\Lavasoft\Ad-Aware\AAWTray.exe”

“AVG8_TRAY”=“c:\progra~1\AVG\AVG8\avgtray.exe”

“NvCplDaemon”=“c:\windows\system32\NvCpl.dll”

“NvMediaCenter”=“c:\windows\system32\NvMcTray.dll”

“SunJavaUpdateSched”=“c:\program files\Common Files\Java\Java Update\jusched.exe”

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE

“EnableInstallerDetection”= 0 (0x0)

“EnableLUA”= 0 (0x0)

“EnableSecureUIAPaths”= 0 (0x0)

“PromptOnSecureDesktop”= 0 (0x0)

“EnableUIADesktopToggle”= 0 (0x0)

“NoResolveTrack”= 1 (0x1)

“NoSimpleStartMenu”= 0 (0x0)

“NoResolveTrack”= 1 (0x1)

“NoSimpleStartMenu”= 1 (0x1)

“AppInit_DLLs”=c:\windows\System32\avgrsstx.dll

@=“Service”

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe

R2 TomTomHOMEService;TomTomHOMEService;l:\program files\TomTom HOME 2\TomTomHOMEService.exe

S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe

S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys

S3 fsssvc;De service Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe

S3 IAMT03;Stuurprogramma voor Intel(R) Active Management Technology - KCS;c:\windows\System32\drivers\IAMT03.sys

S3 IAMTV;Stuurprogramma voor Intel(R) Active Management Technology - KCS;c:\windows\System32\drivers\IAMTV.sys

S4 hcw99rc;Hauppauge Nova-DT IR Driver;c:\windows\System32\drivers\hcw99rc.sys

S4 IAMTXP;Stuurprogramma voor Intel(R) Active Management Technology - KCS;c:\windows\System32\drivers\IAMTXP.sys

S4 ioatdma;Intel(R) QuickData Technology Device;c:\windows\System32\drivers\ioatdma.sys

S4 iSSetup;Intel(R) PRO/1000 iSCSI Setup Driver;c:\windows\System32\drivers\iSSetup.sys

S4 m5287;m5287;c:\windows\System32\drivers\m5287.sys

S4 m5288;m5288;c:\windows\System32\drivers\m5288.sys

S4 m5289;m5289;c:\windows\System32\drivers\m5289.sys

S4 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\System32\drivers\SI3112r.sys

S4 SI3114;SiI-3114 SATALink Controller;c:\windows\System32\drivers\SI3114.sys

S4 SI3124;SiI-3124 SATALink Controller;c:\windows\System32\drivers\SI3124.sys

S4 Si3124r5;SiI-3124 SoftRaid 5 Controller;c:\windows\System32\drivers\Si3124r5.sys

S4 Si3531;SiI-3531 SATA Controller;c:\windows\System32\drivers\Si3531.sys

S4 ViBus;ViBus;c:\windows\System32\drivers\ViBus.sys

S4 ViPrt;VIA SATA IDE Device Driver;c:\windows\System32\drivers\ViPrt.sys

bthsvcs REG_MULTI_SZ BthServ

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

Inhoud van de ‘Gedeelde Taken’ map

2010-02-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe

——- Bijkomende Scan ——-

uStart Page = hxxp://www.zeelandnet.nl/

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

IE: {{8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO

- - - - ORPHANS VERWIJDERD - - - -

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

HKU-Default-Run-Nokia.PCSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-02-11 16:25

Windows 6.0.6001 Service Pack 1 NTFS

scannen van verborgen processen …

scannen van verborgen autostart items …

scannen van verborgen bestanden …

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

“ImagePath”=“\??\c:\program files\CyberLink\PowerDVD\000.fcl”

——————— VERGRENDELDE REGISTER SLEUTELS ———————

“??”=hex:19,9a,55,55,8d,81,e0,a2,84,15,e2,2d,23,64,ae,0f,64,e3,6e,3d,bc,b2,e7,

e5,7f,07,0e,b4,d0,53,5f,c1,b2,e6,c5,b7,bc,7f,a0,72,de,1e,31,d4,72,4b,78,b9,\

“??”=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

“datasecu”=hex:34,c0,77,95,f8,f5,77,b4,4e,8f,e6,12,9b,4a,26,5f,7d,e9,e4,df,c2,

60,66,98,89,86,b6,f0,48,61,73,64,0a,83,6f,d1,18,2c,e6,2e,9b,ae,34,29,42,9e,\

“rkeysecu”=hex:31,a9,51,5b,ac,1d,8a,35,cf,dd,0f,96,17,04,df,97

Voltooingstijd: 2010-02-11 16:27:32

ComboFix-quarantined-files.txt 2010-02-11 15:27

Pre-Run: 323.994.636.288 bytes beschikbaar

Post-Run: 322.919.305.216 bytes beschikbaar

- - End Of File - - 223D3219C5C2072EDAC3D88E64D68FB4

ricardo

ricardo

ricardo

Argus

Argus

ricardo

ricardo

ricardo

Argus

ricardo