BleepingComputer.com: Strange behaviour with svchost.exe

Hello,

For a couple of days my AVG keeps noting me about malware in svchost.exe. After letting AVG remove it, AVG wants me te restart the computer. After reboot, AVG says its removed, but with 7 or 8 hours, the same procedure starts again. Specially after a "normal" reboot of my desktop. So I expect "something" is on my computer causing this, but I cannot find it.

AVG reports:
Malware - virusname unknown
1 process ended : SVCHOST.EXE
2 Files removed: tvel32.dll , SVCHOST.EXE
2 registry keys removed:
hkey_local_machine\system\currentcontrolset\services\winsock2\parameters\namespace_catalog5
hkey_local_machine\system\currentcontrolset\services\winsock2\parameters\protocol_catalog9

I tried a complete AVG scan after the remove of the malware. I also had a complet Spybot search and destroy scan, both came up clean.
I hope some one here can help me find out what is going wrong.

Thanx in advance.
Regards
Jan


DDS
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_26
Run by Jan Brinkers at 12:10:21 on 2011-10-08
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.2046.961 [GMT 2:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\QNAP\NetBak\NetBak.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.nl/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Help bij koppelingen: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Aanmelden - Help: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Google Update] "c:\documents and settings\jan brinkers\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [gemstrmw] c:\windows\system32\gemstrmw.exe /r
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [HPPQVideo] "c:\program files\hp\scheduledlaunch\hp color laserjet cm2320 mfp series\bin\hppschlnch.exe" -r software\hewlett-packard\scheduledlaunch\CLJ_CM2320_MFP_Series -f PQOptimizerVideo.xml -o remindLater
mRun: [ToolBoxFX] "c:\program files\hp\toolboxfx\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [QNAP_NASNetBak] c:\program files\qnap\netbak\NetBak.exe /min
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\janbri~1\menust~1\progra~1\opstar~1\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\menust~1\progra~1\opstar~1\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\menust~1\progra~1\opstar~1\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=58813
DPF: {25365FF3-2746-4230-9DA7-163CCA318309} - hxxp://inst.c-wss.com/n035p/EN/install/gtdownlr.cab
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab
DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} - hxxp://www.linkedin.com/cab/LinkedInContactFinderControl.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1195309895390
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} - hxxp://www.cyclomedia.nl/download/components/CycloScopeLite.cab
TCP: DhcpNameServer = 212.54.35.25 192.168.1.1
TCP: Interfaces\{F7992D3D-43EC-4009-9472-6F893DD727F4} : DhcpNameServer = 212.54.35.25 192.168.1.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\backup\pftpns.dll
AppInit_DLLs: c:\progra~1\google\google~3\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 46.182.104.78 vanbakelpodotherapie.nl
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\jan brinkers\application data\mozilla\firefox\profiles\4qc7meu5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - www.google.nl
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4ce23c4d&v=7.005.030.004&i=23&tp=ab&iy=&ychte=nl&lng=en-US&q=
FF - plugin: c:\documents and settings\jan brinkers\application data\mozilla\firefox\profiles\4qc7meu5.default\extensions\vmwarevmrc@vmware.com\plugins\np-vmware-vmrc-3.0.0-252576.dll
FF - plugin: c:\documents and settings\jan brinkers\local settings\application data\google\update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\google updater\2.4.2432.1652\npCIDetect14.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 32592]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [2007-8-22 189056]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 297168]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-8-18 7390560]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-15 34064]
R2 NProtectService;Norton Unerase Protection;c:\progra~1\norton~1\norton~2\NPROTECT.EXE [2003-9-15 86016]
R2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w --> C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 [?]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 27216]
R3 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [2011-8-3 4096]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [2008-11-1 20504]
R3 IntelDH;IntelDH Driver;c:\windows\system32\drivers\IntelDH.sys [2007-8-27 5504]
S0 mbfhpp;mbfhpp; [x]
S2 gupdate;Google Updateservice (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-5 135664]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-5-13 1025352]
S3 GTwinUSB;GTwinUSB;c:\windows\system32\drivers\GTwinUSB.sys [2007-10-25 61776]
S3 gupdatem;Google Update-service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-5 135664]
S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\firebird\firebird_2_0\bin\fbguard.exe -s --> c:\program files\firebird\firebird_2_0\bin\fbguard.exe -s [?]
S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_2_0\bin\fbserver.exe -s --> c:\program files\firebird\firebird_2_0\bin\fbserver.exe -s [?]
.
=============== Created Last 30 ================
.
2011-09-29 11:55:12 85504 ----a-w- c:\windows\system32\tve32.dll
.
==================== Find3M ====================
.
2011-09-23 06:32:27 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-09 09:12:05 602624 ----a-w- c:\windows\system32\crypt32.dll
2011-08-03 17:41:44 4608 ----a-w- c:\windows\system32\bbchlp.dll
2011-08-03 17:41:44 4096 ----a-w- c:\windows\system32\drivers\bbcap.sys
2011-08-03 17:41:44 30720 ----a-w- c:\windows\system32\bbcap.dll
2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.
============= FINISH: 12:11:10,43 ===============


GMER
see attachment ark.tx.
I had to stop this gmer, cause its running for over 3 hours now and I have to leave within 15 minutes
Hopefully it gives enough information.

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.
===

Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
  
• Some Rookit infection may damage your boot sector. The Windows Recovery Console may be needed to restore it. Do not bypass this installation. You may regret it.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Note: If you have difficulty properly disabling your protection programs, refer to this link --> http://www.bleepingcomputer.com/forums/topic114351.html

Do not mouse click ComboFix's window while it's running. That may cause it to stall
===

Third party programs if not up to date can be the cause infiltration of an infection.

Please run this security check for my review.

Download Security Check by screen317 from here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

===

Please post the logs and let me know if the problem persists.

Hello,

Thank you for stepping in trying to help me.

First of all I need to tell you that I did install Malwarebytes antimalware as well last week. I didn't post that yet.

Th log of Malware scan:
========================================
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Databaseversie: 7907

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

9-10-2011 10:01:19
mbam-log-2011-10-09 (10-01-18).txt

Scantype: Snelle scan
Objecten gescand: 195280
Verstreken tijd: 8 minuut/minuten, 37 seconde(n)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 3

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerdata geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:
c:\documents and settings\jan xxxxx\mijn documenten\downloads\titanpsetup_e6b024.exe (PUP.Casino) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\fjhdyfhsn.bat (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\tve32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

========================================

After this scan, the problem with the svchost.exe was gone.

But still there is a problem. When using Firefox, malwarebytes shield pops up on almost every site I visit, always saying the same, with the same IP:
successfully blocked access to a potentially malicious website : 77.79.4.140
type : outgoing connection
(I had to translate it from Dutch, so in English the exact message could be a little different)

Chrome and IE don't give that respons of Malwarebytes

Now the scans.

Combofix:
================================
ComboFix 11-10-14.02 - Jan xxxx 14-10-2011 8:40.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.2046.1253 [GMT 2:00]
Gestart vanuit: c:\documents and settings\Jan xxxx\Bureaublad\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Jan xxxx\Mijn documenten\~WRL0002.tmp
c:\program files\WinPCap
c:\program files\WinPCap\rpcapd.exe
c:\windows\ehome\medctrro.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-09-14 to 2011-10-14 ))))))))))))))))))))))))))))))
.
.
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-26 09:41 . 2008-07-29 17:59 614912 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-09-07 12:00 23040 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-09-07 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-23 06:32 . 2011-05-19 07:31 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-09 09:12 . 2004-08-03 23:03 602624 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 14:09 . 2004-08-03 22:56 1859072 ----a-w- c:\windows\system32\win32k.sys
2011-08-31 15:00 . 2009-12-28 00:15 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-17 21:25 . 2004-08-03 23:03 832512 ----a-w- c:\windows\system32\wininet.dll
2011-08-17 21:25 . 2004-08-03 23:03 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-08-17 21:25 . 2004-08-03 23:03 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-08-17 21:25 . 2004-08-03 23:03 17408 ----a-w- c:\windows\system32\corpol.dll
2011-08-17 13:49 . 2004-08-03 21:14 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-08-17 12:22 . 2004-08-03 22:55 389120 ----a-w- c:\windows\system32\html.iec
2011-08-12 11:51 . 2007-08-24 19:33 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2011-08-03 17:41 . 2011-08-03 17:41 4608 ----a-w- c:\windows\system32\bbchlp.dll
2011-08-03 17:41 . 2011-08-03 17:41 4096 ----a-w- c:\windows\system32\drivers\bbcap.sys
2011-08-03 17:41 . 2011-08-03 17:41 30720 ----a-w- c:\windows\system32\bbcap.dll
2009-03-17 15:34 . 2009-03-17 15:34 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-03-17 15:34 . 2009-03-17 15:34 126360 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2011-10-01 06:41 . 2011-05-17 09:14 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-09-01 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-09-01 07:16 2532680 ----a-w- c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-09-01 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-09-01 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-27 68856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 16384000]
"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2002-12-10 24576]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2008-08-01 53248]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-09-10 2338656]
"QNAP_NASNetBak"="c:\program files\QNAP\NetBak\NetBak.exe" [2010-09-30 720896]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Jan xxxx\Menu Start\Programma's\Opstarten\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LightScribeService"=2 (0x2)
"gusvc"=2 (0x2)
"gupdate"=2 (0x2)
"FirebirdServerDefaultInstance"=3 (0x3)
"FirebirdGuardianDefaultInstance"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\OfficeNet Extra\\eblink.exe"=
"c:\\Program Files\\Active WebCam\\WebCam.exe"=
"c:\\Program Files\\CoreFTP\\coreftp.exe"=
"c:\\Program Files\\gnucash\\bin\\gnucash-bin.exe"=
"c:\\Program Files\\gnucash\\bin\\gconfd-2.exe"=
"c:\\Program Files\\BankingTools\\C@shflow v3\\C@shflowApp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\FTP Commander\\ftpcomm.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\HP\\HP Color LaserJet CM2320 MFP Series\\hppfsu_cm2320.exe"=
"c:\\Program Files\\HP\\HP Color LaserJet CM2320 MFP Series\\hppfaxnc3.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\QNAP\\Finder\\Finder.exe"=
"c:\\Program Files\\QNAP\\NetBak\\NetBak.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\FileZilla Client\\filezilla.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5432:TCP"= 5432:TCP:postgres
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13-9-2010 17:27 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7-9-2010 4:48 32592]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [22-8-2007 18:21 189056]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7-9-2010 4:48 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7-9-2010 4:49 297168]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [18-8-2011 1:33 7390560]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [8-2-2011 5:33 269520]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [28-12-2009 2:15 366152]
R2 NProtectService;Norton Unerase Protection;c:\progra~1\NORTON~1\NORTON~2\NPROTECT.EXE [15-9-2003 18:18 86016]
R2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w --> C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 [?]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19-8-2010 22:42 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19-8-2010 22:42 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19-8-2010 22:42 27216]
R3 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [3-8-2011 19:41 4096]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [1-11-2008 21:22 20504]
R3 IntelDH;IntelDH Driver;c:\windows\system32\drivers\IntelDH.sys [27-8-2007 14:44 5504]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28-12-2009 2:15 22216]
S0 mbfhpp;mbfhpp; [x]
S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5-2-2010 1:27 135664]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [13-5-2011 8:16 1025352]
S3 GTwinUSB;GTwinUSB;c:\windows\system32\drivers\GTwinUSB.sys [25-10-2007 11:14 61776]
S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [5-2-2010 1:27 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s [?]
S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhoud van de 'Gedeelde Taken' map
.
2011-10-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 11:34]
.
2011-10-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-27 08:37]
.
2011-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 23:27]
.
2011-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 23:27]
.
2011-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1957994488-839522115-1003Core.job
- c:\documents and settings\Jan xxxx\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-24 07:45]
.
2011-10-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1957994488-839522115-1003UA.job
- c:\documents and settings\Jan xxxx\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-24 07:45]
.
2011-10-07 c:\windows\Tasks\One Button Checkup van Norton SystemWorks.job
- c:\program files\Norton SystemWorks\OBC.exe [2003-09-24 09:01]
.
2011-10-12 c:\windows\Tasks\Symantec Drmc.job
- c:\program files\Common Files\Symantec Shared\SymDrmc.exe [2003-09-10 02:48]
.
2011-10-14 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2007-08-27 12:35]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.nl/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 212.54.35.25 192.168.1.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} - hxxp://www.cyclomedia.nl/download/components/CycloScopeLite.cab
FF - ProfilePath - c:\documents and settings\Jan xxxx\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - www.google.nl
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4ce23c4d&v=7.005.030.004&i=23&tp=ab&iy=&ychte=nl&lng=en-US&q=
.
- - - - ORPHANS VERWIJDERD - - - -
.
HKLM-Run-HPPQVideo - c:\program files\HP\ScheduledLaunch\HP Color LaserJet CM2320 MFP Series\bin\hppschlnch.exe -r SOFTWARE\Hewlett-Packard\ScheduledLaunch\CLJ_CM2320_MFP_Series -f PQOptimizerVideo.xml
Notify-LBTWlgn - (no file)
AddRemove-Active WebCam - c:\program files\Active WebCam\PY_UNINSTAL.EXE SOFTWARE\PySoft\Act_WebCam
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-14 08:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
.
c:\windows\TEMP\avg-0850360e-93df-460a-954a-c16e39f09842.tmp 40048 bytes
.
Scan succesvol afgerond
verborgen bestanden: 1
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\postgresql-8.4]
"ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\postgresql-8.4]
"ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
.
- - - - - - - > 'explorer.exe'(2688)
c:\windows\system32\WPDShServiceObj.dll
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\progra~1\AVG\AVG10\avgchsvx.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\PostgreSQL\8.4\bin\pg_ctl.exe
c:\program files\AVG\AVG10\avgnsx.exe
c:\program files\PostgreSQL\8.4\bin\postgres.exe
c:\program files\PostgreSQL\8.4\bin\postgres.exe
c:\program files\PostgreSQL\8.4\bin\postgres.exe
c:\program files\PostgreSQL\8.4\bin\postgres.exe
c:\program files\PostgreSQL\8.4\bin\postgres.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
c:\progra~1\AVG\AVG10\avgrsx.exe
c:\program files\AVG\AVG10\avgcsrvx.exe
.
**************************************************************************
.
Voltooingstijd: 2011-10-14 08:54:43 - machine werd herstart
ComboFix-quarantined-files.txt 2011-10-14 06:54
.
Pre-Run: 7.116.357.632 bytes beschikbaar
Post-Run: 8.061.399.040 bytes beschikbaar
.
- - End Of File - - 10FFFECA36D0DCCE1E6B0F27DF465313
================================

checkup.txt
===============================
Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 3 x86
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
AVG 2011
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 26
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Out of date Java installed!
Adobe Flash Player ( 10.3.183.10) Flash Player Out of Date!
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
``````````End of Log````````````
============================================


After all this, the same problem exists. The problem is that Malware bytes keep telling me:
successfully blocked access to a potentially malicious website : 77.79.4.140
type : outgoing connection

Only when using firefox.

I hope you can help me some more, thanx in advance.
Jan

Open notepad and copy/paste the text in the quote box below into it:

ClearJavaCache::
Quit::

Save this as CFScript on your desktop.



Referring to the picture above, drag CFScript into ComboFix.exe
No log will be generated.
===

Secure your system by updating 3rd party programs.

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

• Download the latest version of Java SE Runtime Environment 6 Update 27.
  
• In the box labeled "Java Platform, Standard Edition", click the "Download JRE" button to the right.
  
• In the Window that opens, select Windows (or Windows x64), and check the "agree" box and click "Continue".
  
• Click on the link to download Windows Offline Installation and save to your Desktop.
  
  
• Then from your Desktop double-click on jre-6u27-windows-i586.exe that you have downloaded to install the newest version.
  
  For the x64 bit version download this on jre-6u27-windows-x64.exe). Make sure you download the corrent version.
  
  - Note: If you are running Vista or Windows 7, you may need to right-click on the installation file and select Run as Administrator.

If present remove the old version(s) of Java using the Add/Remove Programs applet.



Java™ 6 Update 26
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7

===

Critical vulnerabilities have been identified in Adobe Flash Player 10.3.183.10 and earlier versions... being exploited in the wild in active targeted attacks... update to Adobe Adobe Flash Player 11.0.1.152

Flash Player 11.0.1.152

On the top of the page you will be given an opportunity to download the version for your operating system.
Make sure you select appropriate version.

You will also have an option to install the Free! McAfee Security Scan Plus Un-check the box if you are NOT using McAfee's virus protection software.
===

Please let me know if the problem persists.

I would also like to know if this computer is connected to a wireless router.

Hi,

I did all you asked me.

The CFScript to the combofix went withouth a problem.
Javascript update done, removed the Java 6 update parts

Flashplayer also updated. That didn't go smoothly. After running the update it sais the newest version was installed. But to be sure I ran Security Check again, and that prgramm still mentionned I had an outdated Flash player. I removed Flasplayer from Configuration -> software -> remove programs
After that, the newest version was installed, and now also Security Check no longer has an problem with the flash player, so flash player is up to date now.

The problem isn't solved yet though. Malwarebyte's keeps giving the same message, I copied a part of the malware log:
17:18:23 Jan xxxx MESSAGE IP Protection started successfully
17:21:34 Jan xxxx IP-BLOCK 77.79.4.140 (Type: outgoing)
17:21:34 Jan xxxx IP-BLOCK 77.79.4.140 (Type: outgoing)
17:21:37 Jan xxxx IP-BLOCK 77.79.4.140 (Type: outgoing)
17:21:37 Jan xxxx IP-BLOCK 77.79.4.140 (Type: outgoing)
17:21:43 Jan xxxx IP-BLOCK 77.79.4.140 (Type: outgoing)
17:21:43 Jan xxxx IP-BLOCK 77.79.4.140 (Type: outgoing)
17:21:55 Jan xxxx IP-BLOCK 77.79.4.140 (Type: outgoing)
17:21:58 Jan xxxx IP-BLOCK 77.79.4.140 (Type: outgoing)
As you can see, it's a lot of those messages.

It starts when opening Firefox. But after firefox has been opened, the messages also come when using outlook or one of the other browsers.
If I don't start Firefox, the messages don't pop up when using Outlook and or other browsers.

I do have a wireless router, but the computer having this problem is connected to it with a wire. It's the only computer in house that doesn't use the wireless function, never used it. So connected with a wire to a wireless router.

I hope you have another tip for me.
Thanx in advance
Jan

Go start > run box and type cmd and hit OK
type
ipconfig /flushdns <-- (The space between g and / is needed)

repeat with
ipconfig /renew

Then hit Enter, type Exit, hit Enter
*/*

Keep me posted.

Not sure why that should help.
But I did flush the dns as you mentionned and got a new lease, but the problem is still there, also same IP that is mentionned by malwarebytes

I almost think of removing firefox and reinstalling it, to see what happens then.
But I will wait for your reply.

Let check for a rootkit.

Please Download
TDSSKiller.zip

>>> Double-click on TDSSKiller.exe to run the application.

• Click on the Start Scan button and wait for the scan and disinfection process to be over.
  
• If an infected file is detected, the default action will be Cure, click on Continue
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue
  
  
• If you are asked to reboot the computer to complete the process, click on the Reboot Now button. A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt). Please copy and paste the contents of that file here.
  
• If no reboot is required, click on Report. A log file will appear. Please copy and paste the contents of that file in your next reply.

Hello,

Nothing found, see log below.
Hope you have another idea

Regards
Jan

20:02:08.0421 0468 TDSS rootkit removing tool 2.6.9.0 Oct 14 2011 11:33:24
20:02:08.0609 0468 ============================================================
20:02:08.0609 0468 Current date / time: 2011/10/15 20:02:08.0609
20:02:08.0609 0468 SystemInfo:
20:02:08.0609 0468
20:02:08.0609 0468 OS Version: 5.1.2600 ServicePack: 3.0
20:02:08.0609 0468 Product type: Workstation
20:02:08.0609 0468 ComputerName: JANWERK
20:02:08.0609 0468 UserName: Jan xxxx
20:02:08.0609 0468 Windows directory: C:\WINDOWS
20:02:08.0609 0468 System windows directory: C:\WINDOWS
20:02:08.0609 0468 Processor architecture: Intel x86
20:02:08.0609 0468 Number of processors: 4
20:02:08.0609 0468 Page size: 0x1000
20:02:08.0609 0468 Boot type: Normal boot
20:02:08.0609 0468 ============================================================
20:02:09.0328 0468 Initialize success
20:02:16.0046 2508 ============================================================
20:02:16.0046 2508 Scan started
20:02:16.0046 2508 Mode: Manual;
20:02:16.0046 2508 ============================================================
20:02:18.0234 2508 Abiosdsk - ok
20:02:18.0250 2508 abp480n5 - ok
20:02:18.0281 2508 ACPI (02273a448ba21a7d447daeb47810d40c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:02:18.0296 2508 ACPI - ok
20:02:18.0328 2508 ACPIEC (63f517b1a87dabf3f5acb8a7952fc1d1) C:\WINDOWS\system32\drivers\ACPIEC.sys
20:02:18.0343 2508 ACPIEC - ok
20:02:18.0343 2508 adpu160m - ok
20:02:18.0375 2508 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:02:18.0390 2508 aec - ok
20:02:18.0421 2508 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:02:18.0421 2508 AFD - ok
20:02:18.0421 2508 Aha154x - ok
20:02:18.0437 2508 aic78u2 - ok
20:02:18.0437 2508 aic78xx - ok
20:02:18.0453 2508 AliIde - ok
20:02:18.0468 2508 amsint - ok
20:02:18.0484 2508 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
20:02:18.0500 2508 Arp1394 - ok
20:02:18.0500 2508 asc - ok
20:02:18.0515 2508 asc3350p - ok
20:02:18.0515 2508 asc3550 - ok
20:02:18.0546 2508 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:02:18.0546 2508 AsyncMac - ok
20:02:18.0578 2508 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:02:18.0578 2508 atapi - ok
20:02:18.0593 2508 Atdisk - ok
20:02:18.0625 2508 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:02:18.0625 2508 Atmarpc - ok
20:02:18.0656 2508 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:02:18.0656 2508 audstub - ok
20:02:18.0687 2508 AVGIDSDriver (2d18221aab3db2d408d6c55c0f23090a) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
20:02:18.0687 2508 AVGIDSDriver - ok
20:02:18.0703 2508 AVGIDSEH (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
20:02:18.0703 2508 AVGIDSEH - ok
20:02:18.0718 2508 AVGIDSFilter (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
20:02:18.0718 2508 AVGIDSFilter - ok
20:02:18.0750 2508 AVGIDSShim (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
20:02:18.0750 2508 AVGIDSShim - ok
20:02:18.0781 2508 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
20:02:18.0781 2508 Avgldx86 - ok
20:02:18.0796 2508 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
20:02:18.0796 2508 Avgmfx86 - ok
20:02:18.0796 2508 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
20:02:18.0796 2508 Avgrkx86 - ok
20:02:18.0812 2508 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
20:02:18.0812 2508 Avgtdix - ok
20:02:18.0843 2508 bbcap (709fbe6eced1c3259d2b50bb0520b765) C:\WINDOWS\system32\DRIVERS\bbcap.sys
20:02:18.0875 2508 bbcap - ok
20:02:18.0906 2508 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:02:18.0906 2508 Beep - ok
20:02:18.0906 2508 catchme - ok
20:02:18.0921 2508 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:02:18.0937 2508 cbidf2k - ok
20:02:18.0937 2508 cd20xrnt - ok
20:02:18.0953 2508 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:02:18.0953 2508 Cdaudio - ok
20:02:18.0968 2508 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:02:18.0984 2508 Cdfs - ok
20:02:19.0015 2508 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:02:19.0015 2508 Cdrom - ok
20:02:19.0015 2508 Changer - ok
20:02:19.0031 2508 CmdIde - ok
20:02:19.0031 2508 Cpqarray - ok
20:02:19.0046 2508 dac2w2k - ok
20:02:19.0046 2508 dac960nt - ok
20:02:19.0078 2508 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:02:19.0078 2508 Disk - ok
20:02:19.0109 2508 dmboot (dec123e0c75971d0cc7a6c6a75e28429) C:\WINDOWS\system32\drivers\dmboot.sys
20:02:19.0125 2508 dmboot - ok
20:02:19.0156 2508 dmio (7268e66259722f6228c730685b201092) C:\WINDOWS\system32\drivers\dmio.sys
20:02:19.0156 2508 dmio - ok
20:02:19.0187 2508 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:02:19.0187 2508 dmload - ok
20:02:19.0203 2508 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:02:19.0203 2508 DMusic - ok
20:02:19.0218 2508 dpti2o - ok
20:02:19.0234 2508 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:02:19.0234 2508 drmkaud - ok
20:02:19.0265 2508 e1express (34aaa3b298a852b3663e6e0d94d12945) C:\WINDOWS\system32\DRIVERS\e1e5132.sys
20:02:19.0265 2508 e1express - ok
20:02:19.0296 2508 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:02:19.0296 2508 Fastfat - ok
20:02:19.0312 2508 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:02:19.0312 2508 Fdc - ok
20:02:19.0328 2508 Fips (8bfffb5ac954e19dfdb96d56512aa518) C:\WINDOWS\system32\drivers\Fips.sys
20:02:19.0328 2508 Fips - ok
20:02:19.0359 2508 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:02:19.0359 2508 Flpydisk - ok
20:02:19.0390 2508 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
20:02:19.0390 2508 FltMgr - ok
20:02:19.0421 2508 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:02:19.0421 2508 Fs_Rec - ok
20:02:19.0437 2508 Ftdisk (fa8ca22e70245c81ff29c36af56292fc) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:02:19.0437 2508 Ftdisk - ok
20:02:19.0468 2508 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:02:19.0468 2508 Gpc - ok
20:02:19.0484 2508 GTwinUSB (c807de3b18b7f638dca7c235b00900ac) C:\WINDOWS\system32\Drivers\GTwinUSB.sys
20:02:19.0500 2508 GTwinUSB - ok
20:02:19.0531 2508 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:02:19.0531 2508 HDAudBus - ok
20:02:19.0578 2508 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:02:19.0578 2508 hidusb - ok
20:02:19.0609 2508 HPFXBULK (299683d4c8aaa3f6f5d5d226a1782a6e) C:\WINDOWS\system32\drivers\hpfxbulk.sys
20:02:19.0609 2508 HPFXBULK - ok
20:02:19.0640 2508 HPFXFAX (f728db73a87231e27b6ba34d71ce2edb) C:\WINDOWS\system32\drivers\hpfxfax.sys
20:02:19.0640 2508 HPFXFAX - ok
20:02:19.0656 2508 hpn - ok
20:02:19.0687 2508 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:02:19.0687 2508 HTTP - ok
20:02:19.0687 2508 i2omgmt - ok
20:02:19.0703 2508 i2omp - ok
20:02:19.0734 2508 i8042prt (c43372d0682f8e32e4ec21117e089ec0) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:02:19.0734 2508 i8042prt - ok
20:02:19.0765 2508 iaStor (997e8f5939f2d12cd9f2e6b395724c16) C:\WINDOWS\system32\DRIVERS\iaStor.sys
20:02:19.0765 2508 iaStor - ok
20:02:19.0796 2508 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:02:19.0796 2508 Imapi - ok
20:02:19.0828 2508 ini910u - ok
20:02:19.0921 2508 IntcAzAudAddService (8f924588c272fdaa28cf31a9bbc21a72) C:\WINDOWS\system32\drivers\RtkHDAud.sys
20:02:20.0015 2508 IntcAzAudAddService - ok
20:02:20.0031 2508 IntelDH (b7a420e4b137176234272d5ca9d51a49) C:\WINDOWS\system32\Drivers\IntelDH.sys
20:02:20.0046 2508 IntelDH - ok
20:02:20.0046 2508 IntelIde - ok
20:02:20.0078 2508 intelppm (2d2254fac267e6b1c7865e8ebef60c6d) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:02:20.0078 2508 intelppm - ok
20:02:20.0093 2508 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
20:02:20.0093 2508 Ip6Fw - ok
20:02:20.0125 2508 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:02:20.0125 2508 IpFilterDriver - ok
20:02:20.0140 2508 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:02:20.0140 2508 IpInIp - ok
20:02:20.0187 2508 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:02:20.0187 2508 IpNat - ok
20:02:20.0203 2508 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:02:20.0203 2508 IPSec - ok
20:02:20.0203 2508 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:02:20.0234 2508 IRENUM - ok
20:02:20.0250 2508 isapnp (0b78e1a31340e1fb1e389d5633f7c3a0) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:02:20.0250 2508 isapnp - ok
20:02:20.0281 2508 Kbdclass (380397621e94b32c744e7b2cc1330390) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:02:20.0281 2508 Kbdclass - ok
20:02:20.0296 2508 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:02:20.0296 2508 kmixer - ok
20:02:20.0312 2508 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:02:20.0312 2508 KSecDD - ok
20:02:20.0343 2508 L8042Kbd (0c6e346cde730cf1356dd69ad6e9bc42) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
20:02:20.0343 2508 L8042Kbd - ok
20:02:20.0359 2508 lbrtfdc - ok
20:02:20.0375 2508 LHidFilt (7f9c7b28cf1c859e1c42619eea946dc8) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
20:02:20.0375 2508 LHidFilt - ok
20:02:20.0390 2508 LHidKe (dd40c03d85649205ec086722474c8a63) C:\WINDOWS\system32\DRIVERS\LHidKE.Sys
20:02:20.0421 2508 LHidKe - ok
20:02:20.0437 2508 LMouFilt (ab33792a87285344f43b5ce23421bab0) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
20:02:20.0453 2508 LMouFilt - ok
20:02:20.0468 2508 LMouKE (2ebd4c02d259944869630a912ec86bce) C:\WINDOWS\system32\DRIVERS\LMouKE.Sys
20:02:20.0468 2508 LMouKE - ok
20:02:20.0515 2508 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\WINDOWS\system32\drivers\mbam.sys
20:02:20.0515 2508 MBAMProtector - ok
20:02:20.0515 2508 MBAMSwissArmy - ok
20:02:20.0531 2508 mbfhpp - ok
20:02:20.0562 2508 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:02:20.0562 2508 mnmdd - ok
20:02:20.0593 2508 Modem (8114eeac353f549331ab73e9af4219ed) C:\WINDOWS\system32\drivers\Modem.sys
20:02:20.0593 2508 Modem - ok
20:02:20.0593 2508 Mouclass (1a4e2214dd63e4a876463d3427ee8261) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:02:20.0593 2508 Mouclass - ok
20:02:20.0625 2508 mouhid (18017899254e01371e1a39754d6bf98c) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:02:20.0625 2508 mouhid - ok
20:02:20.0656 2508 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:02:20.0656 2508 MountMgr - ok
20:02:20.0656 2508 mraid35x - ok
20:02:20.0703 2508 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:02:20.0703 2508 MRxDAV - ok
20:02:20.0718 2508 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:02:20.0750 2508 MRxSmb - ok
20:02:20.0765 2508 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:02:20.0765 2508 Msfs - ok
20:02:20.0781 2508 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:02:20.0781 2508 MSKSSRV - ok
20:02:20.0796 2508 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:02:20.0796 2508 MSPCLOCK - ok
20:02:20.0812 2508 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:02:20.0812 2508 MSPQM - ok
20:02:20.0843 2508 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:02:20.0843 2508 mssmbios - ok
20:02:20.0875 2508 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:02:20.0890 2508 Mup - ok
20:02:20.0921 2508 mv61xx (445ff67984038e03c4c87df403ff73c9) C:\WINDOWS\system32\DRIVERS\mv61xx.sys
20:02:20.0921 2508 mv61xx - ok
20:02:20.0953 2508 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:02:20.0953 2508 NDIS - ok
20:02:20.0984 2508 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:02:20.0984 2508 NdisTapi - ok
20:02:21.0015 2508 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:02:21.0015 2508 Ndisuio - ok
20:02:21.0031 2508 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:02:21.0031 2508 NdisWan - ok
20:02:21.0046 2508 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:02:21.0062 2508 NDProxy - ok
20:02:21.0078 2508 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:02:21.0078 2508 NetBIOS - ok
20:02:21.0093 2508 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:02:21.0093 2508 NetBT - ok
20:02:21.0125 2508 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
20:02:21.0125 2508 NIC1394 - ok
20:02:21.0156 2508 NPDriver (f5812bcacbfdcfa9b8e849084d15a9e9) C:\WINDOWS\system32\Drivers\NPDRIVER.SYS
20:02:21.0171 2508 NPDriver - ok
20:02:21.0187 2508 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:02:21.0187 2508 Npfs - ok
20:02:21.0218 2508 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:02:21.0234 2508 Ntfs - ok
20:02:21.0265 2508 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:02:21.0265 2508 Null - ok
20:02:21.0406 2508 nv (f8be83f0c686533170f7537e94bf411a) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
20:02:21.0546 2508 nv - ok
20:02:21.0562 2508 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:02:21.0562 2508 NwlnkFlt - ok
20:02:21.0578 2508 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:02:21.0578 2508 NwlnkFwd - ok
20:02:21.0625 2508 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
20:02:21.0640 2508 ohci1394 - ok
20:02:21.0671 2508 Parport (e3934ccc20a4d24f1924e13d36d2a5bd) C:\WINDOWS\system32\drivers\Parport.sys
20:02:21.0687 2508 Parport - ok
20:02:21.0703 2508 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:02:21.0703 2508 PartMgr - ok
20:02:21.0718 2508 ParVdm (1eade28746a64c21e0a808bb12a63326) C:\WINDOWS\system32\drivers\ParVdm.sys
20:02:21.0718 2508 ParVdm - ok
20:02:21.0734 2508 PCI (3b166f9f753c21aedaa9a6bd76b49655) C:\WINDOWS\system32\DRIVERS\pci.sys
20:02:21.0734 2508 PCI - ok
20:02:21.0750 2508 PCIDump - ok
20:02:21.0781 2508 PCIIde (b31edeba4da28283f6b8dc4756fb9585) C:\WINDOWS\system32\drivers\PCIIde.sys
20:02:21.0781 2508 PCIIde - ok
20:02:21.0796 2508 Pcmcia (2137ffd65f8e609a3a5acd487c56cce0) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:02:21.0812 2508 Pcmcia - ok
20:02:21.0812 2508 PDCOMP - ok
20:02:21.0812 2508 PDFRAME - ok
20:02:21.0828 2508 PDRELI - ok
20:02:21.0828 2508 PDRFRAME - ok
20:02:21.0843 2508 perc2 - ok
20:02:21.0843 2508 perc2hib - ok
20:02:21.0875 2508 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:02:21.0875 2508 PptpMiniport - ok
20:02:21.0890 2508 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:02:21.0890 2508 PSched - ok
20:02:21.0921 2508 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:02:21.0921 2508 Ptilink - ok
20:02:21.0937 2508 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
20:02:21.0937 2508 PxHelp20 - ok
20:02:21.0953 2508 ql1080 - ok
20:02:21.0953 2508 Ql10wnt - ok
20:02:21.0968 2508 ql12160 - ok
20:02:21.0968 2508 ql1240 - ok
20:02:21.0984 2508 ql1280 - ok
20:02:22.0000 2508 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:02:22.0000 2508 RasAcd - ok
20:02:22.0015 2508 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:02:22.0015 2508 Rasl2tp - ok
20:02:22.0031 2508 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:02:22.0031 2508 RasPppoe - ok
20:02:22.0046 2508 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:02:22.0046 2508 Raspti - ok
20:02:22.0062 2508 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:02:22.0062 2508 Rdbss - ok
20:02:22.0062 2508 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:02:22.0062 2508 RDPCDD - ok
20:02:22.0078 2508 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
20:02:22.0093 2508 rdpdr - ok
20:02:22.0125 2508 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
20:02:22.0125 2508 RDPWD - ok
20:02:22.0125 2508 redbook (4173bc66e485fd77a03c4819f60bd0da) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:02:22.0125 2508 redbook - ok
20:02:22.0203 2508 SDdriver (491f052b8f1e05b396d15ec9bf36565a) C:\WINDOWS\system32\Drivers\sddriver.sys
20:02:22.0203 2508 SDdriver - ok
20:02:22.0234 2508 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:02:22.0234 2508 Secdrv - ok
20:02:22.0265 2508 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
20:02:22.0265 2508 serenum - ok
20:02:22.0281 2508 Serial (92c21762653bb2ce51147eb8a9aa654f) C:\WINDOWS\system32\DRIVERS\serial.sys
20:02:22.0281 2508 Serial - ok
20:02:22.0296 2508 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
20:02:22.0296 2508 Sfloppy - ok
20:02:22.0312 2508 Simbad - ok
20:02:22.0312 2508 Sparrow - ok
20:02:22.0343 2508 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:02:22.0343 2508 splitter - ok
20:02:22.0359 2508 sr (64d2a7640e0767ecd3bcb38d3200e7ce) C:\WINDOWS\system32\DRIVERS\sr.sys
20:02:22.0359 2508 sr - ok
20:02:22.0390 2508 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:02:22.0406 2508 Srv - ok
20:02:22.0437 2508 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:02:22.0453 2508 swenum - ok
20:02:22.0484 2508 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:02:22.0484 2508 swmidi - ok
20:02:22.0484 2508 symc810 - ok
20:02:22.0500 2508 symc8xx - ok
20:02:22.0531 2508 SymEvent (05d9613efe7809e384c10da26958dfa4) C:\Program Files\Symantec\SYMEVENT.SYS
20:02:22.0546 2508 SymEvent - ok
20:02:22.0546 2508 sym_hi - ok
20:02:22.0546 2508 sym_u3 - ok
20:02:22.0593 2508 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:02:22.0593 2508 sysaudio - ok
20:02:22.0625 2508 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:02:22.0625 2508 Tcpip - ok
20:02:22.0671 2508 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:02:22.0671 2508 TDPIPE - ok
20:02:22.0687 2508 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:02:22.0687 2508 TDTCP - ok
20:02:22.0703 2508 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:02:22.0718 2508 TermDD - ok
20:02:22.0718 2508 TosIde - ok
20:02:22.0734 2508 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:02:22.0750 2508 Udfs - ok
20:02:22.0750 2508 ultra - ok
20:02:22.0781 2508 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:02:22.0796 2508 Update - ok
20:02:22.0796 2508 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:02:22.0796 2508 usbccgp - ok
20:02:22.0828 2508 USBCCID (2825e0e294686a26506690059e1f437a) C:\WINDOWS\system32\DRIVERS\usbccid.sys
20:02:22.0828 2508 USBCCID - ok
20:02:22.0843 2508 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:02:22.0843 2508 usbehci - ok
20:02:22.0875 2508 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:02:22.0875 2508 usbhub - ok
20:02:22.0875 2508 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:02:22.0875 2508 usbprint - ok
20:02:22.0906 2508 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:02:22.0906 2508 usbscan - ok
20:02:22.0937 2508 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:02:22.0937 2508 usbstor - ok
20:02:22.0953 2508 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:02:22.0953 2508 usbuhci - ok
20:02:22.0968 2508 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:02:22.0984 2508 VgaSave - ok
20:02:22.0984 2508 ViaIde - ok
20:02:23.0015 2508 VolSnap (8ab662b3c4691e6ddf61c96bb5b7d103) C:\WINDOWS\system32\drivers\VolSnap.sys
20:02:23.0015 2508 VolSnap - ok
20:02:23.0046 2508 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:02:23.0046 2508 Wanarp - ok
20:02:23.0078 2508 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
20:02:23.0109 2508 Wdf01000 - ok
20:02:23.0109 2508 WDICA - ok
20:02:23.0125 2508 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:02:23.0125 2508 wdmaud - ok
20:02:23.0171 2508 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:02:23.0171 2508 WudfPf - ok
20:02:23.0187 2508 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:02:23.0187 2508 WudfRd - ok
20:02:23.0218 2508 MBR (0x1B8) (3051207086651214e435112e51817dc5) \Device\Harddisk0\DR0
20:02:23.0359 2508 \Device\Harddisk0\DR0 - ok
20:02:23.0359 2508 Boot (0x1200) (b3222466a615d3b62e45b106c35449d8) \Device\Harddisk0\DR0\Partition0
20:02:23.0359 2508 \Device\Harddisk0\DR0\Partition0 - ok
20:02:23.0390 2508 Boot (0x1200) (f933d2feb8040509fba56423292c599b) \Device\Harddisk0\DR0\Partition1
20:02:23.0390 2508 \Device\Harddisk0\DR0\Partition1 - ok
20:02:23.0406 2508 Boot (0x1200) (e03eac39e9e65b83d2691780e3085b7b) \Device\Harddisk0\DR0\Partition2
20:02:23.0406 2508 \Device\Harddisk0\DR0\Partition2 - ok
20:02:23.0421 2508 Boot (0x1200) (401a6e3f2a0ef15fed2be026a6206843) \Device\Harddisk0\DR0\Partition3
20:02:23.0421 2508 \Device\Harddisk0\DR0\Partition3 - ok
20:02:23.0421 2508 Boot (0x1200) (3a20430b7873fb280e18187e31f99e87) \Device\Harddisk0\DR0\Partition4
20:02:23.0421 2508 \Device\Harddisk0\DR0\Partition4 - ok
20:02:23.0421 2508 ============================================================
20:02:23.0421 2508 Scan finished
20:02:23.0421 2508 ============================================================
20:02:23.0437 1924 Detected object count: 0
20:02:23.0437 1924 Actual detected object count: 0

We have to find the source of that file.

Download http://public.avast.com/~gmerek/aswMBR.exe (aswMBR.exe) ( 511KB ) to your desktop. Double click the aswMBR.exe to run it

• Click the "Scan" button to start scan.
  
• Upon completion of the scan, click Save log, and save it to your desktop. (Note - do not select any Fix at this time) <- IMPORTANT
  
• Please post the contents of that log in your next reply.

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

===

Please let me know if this computer is connected via a wireless router.

There was something found, in the firefox profile cache. I didn't do the fix.

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-10-16 09:05:53
-----------------------------
09:05:53.250 OS Version: Windows 5.1.2600 Service Pack 3
09:05:53.250 Number of processors: 4 586 0xF0B
09:05:53.250 ComputerName: JANWERK UserName:
09:05:53.812 Initialize success
09:08:05.343 AVAST engine defs: 11101501
09:08:23.015 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
09:08:23.015 Disk 0 Vendor: WDC_WD50 12.0 Size: 476940MB BusType: 3
09:08:23.031 Disk 0 MBR read successfully
09:08:23.031 Disk 0 MBR scan
09:08:23.078 Disk 0 Windows XP default MBR code
09:08:23.078 Disk 0 scanning sectors +976752000
09:08:23.140 Disk 0 scanning C:\WINDOWS\system32\drivers
09:08:32.890 Service scanning
09:08:33.812 Modules scanning
09:08:40.140 Disk 0 trace - called modules:
09:08:40.140 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
09:08:40.140 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89326ab8]
09:08:40.156 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8a5dd030]
09:08:41.031 AVAST engine scan C:\WINDOWS
09:09:06.265 AVAST engine scan C:\WINDOWS\system32
09:10:57.437 AVAST engine scan C:\WINDOWS\system32\drivers
09:11:08.078 AVAST engine scan C:\Documents and Settings\Jan xxxx
09:19:22.515 File: C:\Documents and Settings\Jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\3\86\5934Dd01 **INFECTED** Win32:Agent-ANIT [Trj]
09:27:06.984 File: C:\Documents and Settings\Jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\A\36\0D2D2d01 **INFECTED** Win32:Agent-ANIT [Trj]
09:31:04.703 File: C:\Documents and Settings\Jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\D\86\95521d01 **INFECTED** Win32:Agent-ANIT [Trj]
09:34:13.500 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Jan xxxx\Mijn documenten\bleeb\MBR.dat"
09:34:13.500 The log file has been saved successfully to "C:\Documents and Settings\Jan xxxx\Mijn documenten\bleeb\aswMBR.txt"
10:05:55.578 AVAST engine scan C:\Documents and Settings\All Users
10:10:11.828 Scan finished successfully
10:24:41.906 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Jan xxxx\Mijn documenten\bleeb\MBR.dat"
10:24:41.906 The log file has been saved successfully to "C:\Documents and Settings\Jan xxxx\Mijn documenten\bleeb\aswMBR.txt"

==================================

As mentionned before, I do habve a wireless router, but this computer is connected to it with a wire.

Open notepad and copy/paste the text in the quote box below into it:

File::
C:\Documents and Settings\jan brinkers\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\3\86\5934Dd01
C:\Documents and Settings\jan brinkers\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\A\36\0D2D2d01
C:\Documents and Settings\jan brinkers\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\D\86\95521d01

Save this as CFScript on your desktop.



Referring to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Please let me know if the problem persists.

Regretffully no succes. I still get the malware bytes messages when using Firefox.
I hope you have another idea ...

This is the log
==============================
ComboFix 11-10-15.04 - Jan xxxx 16-10-2011 16:35:33.3.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.2046.1075 [GMT 2:00]
Gestart vanuit: c:\documents and settings\Jan xxxx\Bureaublad\ComboFix.exe
gebruikte Opdracht switches :: c:\documents and settings\Jan xxxx\Bureaublad\CFScript.txt
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\documents and settings\jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\3\86\5934Dd01"
"c:\documents and settings\jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\A\36\0D2D2d01"
"c:\documents and settings\jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\D\86\95521d01"
.
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\3\86\5934Dd01
c:\documents and settings\jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\A\36\0D2D2d01
c:\documents and settings\jan xxxx\Local Settings\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\Cache\D\86\95521d01
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-09-16 to 2011-10-16 ))))))))))))))))))))))))))))))
.
.
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-14 15:39 . 2011-05-19 07:31 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-14 14:29 . 2007-09-14 22:15 128000 ----a-w- c:\windows\system32\javacpl.cpl
2011-10-14 14:29 . 2010-07-27 06:16 544656 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-26 09:41 . 2008-07-29 17:59 614912 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-09-07 12:00 23040 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-09-07 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 09:12 . 2004-08-03 23:03 602624 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 14:09 . 2004-08-03 22:56 1859072 ----a-w- c:\windows\system32\win32k.sys
2011-08-31 15:00 . 2009-12-28 00:15 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-17 21:25 . 2004-08-03 23:03 832512 ----a-w- c:\windows\system32\wininet.dll
2011-08-17 21:25 . 2004-08-03 23:03 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-08-17 21:25 . 2004-08-03 23:03 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-08-17 21:25 . 2004-08-03 23:03 17408 ----a-w- c:\windows\system32\corpol.dll
2011-08-17 13:49 . 2004-08-03 21:14 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-08-17 12:22 . 2004-08-03 22:55 389120 ----a-w- c:\windows\system32\html.iec
2011-08-12 11:51 . 2007-08-24 19:33 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2011-08-03 17:41 . 2011-08-03 17:41 4608 ----a-w- c:\windows\system32\bbchlp.dll
2011-08-03 17:41 . 2011-08-03 17:41 4096 ----a-w- c:\windows\system32\drivers\bbcap.sys
2011-08-03 17:41 . 2011-08-03 17:41 30720 ----a-w- c:\windows\system32\bbcap.dll
2009-03-17 15:34 . 2009-03-17 15:34 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-03-17 15:34 . 2009-03-17 15:34 126360 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2011-10-01 06:41 . 2011-05-17 09:14 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-09-01 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-09-01 07:16 2532680 ----a-w- c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-09-01 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-09-01 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-27 68856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz"="nwiz.exe" [2007-06-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 16384000]
"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2002-12-10 24576]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2008-08-01 53248]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-09-10 2338656]
"QNAP_NASNetBak"="c:\program files\QNAP\NetBak\NetBak.exe" [2010-09-30 720896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Jan xxxx\Menu Start\Programma's\Opstarten\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
[BU]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LightScribeService"=2 (0x2)
"gusvc"=2 (0x2)
"gupdate"=2 (0x2)
"FirebirdServerDefaultInstance"=3 (0x3)
"FirebirdGuardianDefaultInstance"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\OfficeNet Extra\\eblink.exe"=
"c:\\Program Files\\Active WebCam\\WebCam.exe"=
"c:\\Program Files\\CoreFTP\\coreftp.exe"=
"c:\\Program Files\\gnucash\\bin\\gnucash-bin.exe"=
"c:\\Program Files\\gnucash\\bin\\gconfd-2.exe"=
"c:\\Program Files\\BankingTools\\C@shflow v3\\C@shflowApp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\FTP Commander\\ftpcomm.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\HP\\HP Color LaserJet CM2320 MFP Series\\hppfsu_cm2320.exe"=
"c:\\Program Files\\HP\\HP Color LaserJet CM2320 MFP Series\\hppfaxnc3.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\QNAP\\Finder\\Finder.exe"=
"c:\\Program Files\\QNAP\\NetBak\\NetBak.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\FileZilla Client\\filezilla.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5432:TCP"= 5432:TCP:postgres
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13-9-2010 17:27 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7-9-2010 4:48 32592]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [22-8-2007 18:21 189056]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7-9-2010 4:48 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7-9-2010 4:49 297168]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [8-2-2011 5:33 269520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19-8-2010 22:42 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19-8-2010 22:42 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19-8-2010 22:42 27216]
R3 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [3-8-2011 19:41 4096]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [1-11-2008 21:22 20504]
R3 IntelDH;IntelDH Driver;c:\windows\system32\drivers\IntelDH.sys [27-8-2007 14:44 5504]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28-12-2009 2:15 22216]
S0 mbfhpp;mbfhpp; [x]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [18-8-2011 1:33 7390560]
S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5-2-2010 1:27 135664]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [13-5-2011 8:16 1025352]
S3 GTwinUSB;GTwinUSB;c:\windows\system32\drivers\GTwinUSB.sys [25-10-2007 11:14 61776]
S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [5-2-2010 1:27 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbguard.exe -s [?]
S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s --> c:\program files\Firebird\Firebird_2_0\bin\fbserver.exe -s [?]
.
--- Andere Services/Drivers In Geheugen ---
.
*NewlyCreated* - ASWMBR
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhoud van de 'Gedeelde Taken' map
.
2011-10-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 11:34]
.
2011-10-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-27 08:37]
.
2011-10-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 23:27]
.
2011-10-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 23:27]
.
2011-10-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1957994488-839522115-1003Core.job
- c:\documents and settings\Jan xxxx\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-24 07:45]
.
2011-10-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1957994488-839522115-1003UA.job
- c:\documents and settings\Jan xxxx\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-24 07:45]
.
2011-10-14 c:\windows\Tasks\One Button Checkup van Norton SystemWorks.job
- c:\program files\Norton SystemWorks\OBC.exe [2003-09-24 09:01]
.
2011-10-12 c:\windows\Tasks\Symantec Drmc.job
- c:\program files\Common Files\Symantec Shared\SymDrmc.exe [2003-09-10 02:48]
.
2011-10-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2007-08-27 12:35]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.nl/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 212.54.35.25 192.168.1.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} - hxxp://www.cyclomedia.nl/download/components/CycloScopeLite.cab
FF - ProfilePath - c:\documents and settings\Jan xxxx\Application Data\Mozilla\Firefox\Profiles\4qc7meu5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - www.google.nl
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4ce23c4d&v=7.005.030.004&i=23&tp=ab&iy=&ychte=nl&lng=en-US&q=
.
- - - - ORPHANS VERWIJDERD - - - -
.
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre7\bin\jusched.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-16 16:45
Windows 5.1.2600 Service Pack 3 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\postgresql-8.4]
"ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\postgresql-8.4]
"ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
Voltooingstijd: 2011-10-16 16:46:40
ComboFix-quarantined-files.txt 2011-10-16 14:46
ComboFix2.txt 2011-10-14 14:23
ComboFix3.txt 2011-10-14 06:54
.
Pre-Run: 7.175.901.184 bytes beschikbaar
Post-Run: 7.111.856.128 bytes beschikbaar
.
- - End Of File - - 6EF822573E817BE52701C5F8B4D5C2D0
==============================



To be sure, I ran the aswMBR scan again:
============================
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-10-16 22:11:09
-----------------------------
22:11:09.312 OS Version: Windows 5.1.2600 Service Pack 3
22:11:09.312 Number of processors: 4 586 0xF0B
22:11:09.312 ComputerName: JANWERK UserName:
22:11:09.968 Initialize success
22:13:03.890 AVAST engine defs: 11101601
22:13:11.187 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
22:13:11.187 Disk 0 Vendor: WDC_WD50 12.0 Size: 476940MB BusType: 3
22:13:11.203 Disk 0 MBR read successfully
22:13:11.203 Disk 0 MBR scan
22:13:11.218 Disk 0 Windows XP default MBR code
22:13:11.218 Disk 0 scanning sectors +976752000
22:13:11.281 Disk 0 scanning C:\WINDOWS\system32\drivers
22:13:19.156 Service scanning
22:13:20.062 Modules scanning
22:13:23.437 Disk 0 trace - called modules:
22:13:23.437 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
22:13:23.437 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89326ab8]
22:13:23.437 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8a5dd030]
22:13:24.406 AVAST engine scan C:\WINDOWS
22:13:46.062 AVAST engine scan C:\WINDOWS\system32
22:15:14.218 AVAST engine scan C:\WINDOWS\system32\drivers
22:15:24.093 AVAST engine scan C:\Documents and Settings\Jan xxxx
23:09:19.671 AVAST engine scan C:\Documents and Settings\All Users
23:13:48.562 Scan finished successfully
23:14:19.125 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Jan xxxx\Mijn documenten\bleeb\MBR.dat"
23:14:19.156 The log file has been saved successfully to "C:\Documents and Settings\Jan xxxx\Mijn documenten\bleeb\aswMBR_2.txt"
============================

Lets remove this orphan driver.

Open notepad and copy/paste the text in the quote box below into it:

Driver::
mbfhpp

Save this as CFScript on your desktop.



Referring to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

If still no joy:

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)[list=1]
  
• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.

[*]Check
[*]Click the button.
[*]Accept any security warnings from your browser.
[*]Check

This post has been edited by nasdaq: 17 October 2011 - 08:27 AM