ComboFix 09-05-02.4 - flore 03/05/2009 11:46.2 - NTFSx86 Microsoft® Windows Vista Black Edition™ 2009 6.0.6001.1.1252.32.1033.18.2046.1318 [GMT 2:00] Gestart vanuit: c:\users\flore\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\flore\Desktop\CFScript.txt . (((((((((((((((((((( Bestanden Gemaakt van 2009-04-03 to 2009-05-03 )))))))))))))))))))))))))))))) . 2009-05-03 08:35 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-05-03 08:35 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-05-03 08:35 . 2009-05-03 08:35 -------- d-----w c:\programdata\Malwarebytes 2009-05-03 08:35 . 2009-05-03 08:35 -------- d-----w c:\users\All Users\Malwarebytes 2009-05-03 08:35 . 2009-05-03 08:35 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-02 20:51 . 2009-05-02 20:51 -------- d-----w c:\program files\Trend Micro 2009-04-30 08:33 . 2008-10-16 21:09 43544 ----a-w c:\windows\system32\wups2.dll 2009-04-30 08:33 . 2008-10-16 21:09 51224 ----a-w c:\windows\system32\wuauclt.exe 2009-04-30 08:33 . 2008-10-16 20:56 1524736 ----a-w c:\windows\system32\wucltux.dll 2009-04-30 08:33 . 2008-10-16 21:13 1809944 ----a-w c:\windows\system32\wuaueng.dll 2009-04-30 08:33 . 2008-10-16 21:08 34328 ----a-w c:\windows\system32\wups.dll 2009-04-30 08:33 . 2008-10-16 20:55 83456 ----a-w c:\windows\system32\wudriver.dll 2009-04-30 08:33 . 2008-10-16 21:12 561688 ----a-w c:\windows\system32\wuapi.dll 2009-04-30 08:32 . 2008-10-16 12:08 162064 ----a-w c:\windows\system32\wuwebv.dll 2009-04-30 08:32 . 2008-10-16 11:56 31232 ----a-w c:\windows\system32\wuapp.exe 2009-04-29 19:47 . 2009-05-02 20:31 -------- d-----w c:\program files\Panda Security 2009-04-10 09:42 . 2002-02-27 15:50 197120 ----a-w c:\windows\patchw32.dll 2009-04-10 09:42 . 2009-04-10 09:42 -------- d-----w c:\program files\Common Files\PocketSoft 2009-04-10 09:39 . 2009-04-10 09:39 -------- d-----w c:\program files\Atari . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-03 09:08 . 2009-03-07 18:03 31871 ----a-w c:\users\All Users\nvModes.dat 2009-05-03 09:08 . 2009-03-07 18:03 31871 ----a-w c:\programdata\nvModes.dat 2009-05-03 09:08 . 2006-11-02 13:00 6 ---ha-w c:\windows\Tasks\SA.DAT 2009-05-02 20:32 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstrng.dat 2009-05-02 20:32 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstor.dat 2009-05-02 20:32 . 2006-11-02 10:25 51200 ----a-w c:\windows\inf\infpub.dat 2009-04-24 11:08 . 2009-03-07 17:35 11952 ----a-w c:\windows\system32\avgrsstx.dll 2009-04-24 11:08 . 2009-03-07 17:35 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-04-24 11:07 . 2009-03-07 17:34 23832 ----a-w c:\windows\system32\drivers\avgfwd6x.sys 2009-04-24 11:07 . 2009-03-07 17:35 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys 2009-04-24 11:07 . 2009-03-07 17:35 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-04-10 09:39 . 2009-03-10 20:39 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-02 14:12 . 2009-04-02 14:12 -------- d-----w c:\program files\Common Files\Oberon Media 2009-03-25 14:56 . 2009-03-25 14:56 -------- d-----w c:\program files\Millisecond Software 2009-03-17 18:14 . 2009-03-17 18:14 -------- d-----w c:\program files\BitTorrent 2009-03-17 18:14 . 2009-03-17 18:14 -------- d-----w c:\program files\DNA 2009-03-16 20:42 . 2009-03-16 20:42 98304 ----a-w c:\windows\system32\CmdLineExt.dll 2009-03-16 20:35 . 2009-03-16 20:35 -------- d-----w c:\program files\2K Games 2009-03-16 20:34 . 2009-03-16 20:34 -------- d-----w c:\program files\Common Files\InstallShield 2009-03-12 18:16 . 2009-03-12 09:28 -------- d-----w c:\program files\NOS 2009-03-12 09:31 . 2009-03-12 09:31 -------- d-----w c:\program files\Common Files\Adobe AIR 2009-03-12 09:31 . 2009-03-12 09:30 -------- d-----w c:\program files\Common Files\Adobe 2009-03-10 20:39 . 2009-03-10 20:39 -------- d-----w c:\program files\Atheros 2009-03-10 20:17 . 2009-03-10 20:17 -------- d-----w c:\program files\CONEXANT 2009-03-07 17:34 . 2009-03-07 17:34 -------- d-----w c:\program files\AVG 2009-03-07 17:19 . 2009-03-07 17:19 -------- d-----w c:\program files\Microsoft Works 2009-03-07 17:19 . 2006-11-02 12:35 -------- d-----w c:\program files\MSBuild 2009-03-07 17:19 . 2009-03-07 17:19 -------- d-----w c:\program files\Microsoft.NET 2009-03-07 17:17 . 2009-03-07 17:17 -------- d-----w c:\program files\Microsoft Visual Studio 8 2009-03-07 17:01 . 2009-03-07 17:01 -------- d-----w c:\program files\Microsoft 2009-03-07 17:01 . 2009-03-07 17:01 -------- d-----w c:\program files\Windows Live 2009-03-07 17:01 . 2009-03-07 17:01 -------- d-----w c:\program files\Windows Live SkyDrive 2009-03-07 16:57 . 2009-03-07 16:57 -------- d-----w c:\program files\Common Files\Windows Live 2009-03-07 16:51 . 2009-03-07 16:51 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2009-03-07 16:35 . 2009-03-07 16:35 -------- d-----w c:\program files\K-Lite Codec Pack 2009-03-07 16:35 . 2009-03-07 16:35 -------- d-----w c:\program files\CCleaner 2009-03-07 16:35 . 2009-03-07 16:35 -------- d-----w c:\program files\Utilities 2009-03-07 16:35 . 2009-03-07 16:35 -------- d-----w c:\program files\ImgBurn 2009-03-07 16:35 . 2009-03-07 16:35 -------- d-----w c:\program files\7-Zip 2009-03-07 16:27 . 2006-11-02 12:49 174 --sha-w c:\program files\desktop.ini 2009-02-26 11:46 . 2009-02-26 11:46 74760 ----a-w c:\windows\system32\drivers\UniversalDD.sys 2009-02-26 11:46 . 2009-02-26 11:46 25608 ----a-w c:\windows\system32\drivers\AVGIDSErHr.sys 2009-02-06 17:52 . 2009-02-06 17:52 49504 ----a-w c:\windows\system32\sirenacm.dll 2009-02-04 04:45 . 2009-03-07 17:44 453152 ----a-w c:\windows\system32\NVUNINST.EXE 2008-07-17 13:04 . 2006-11-22 14:58 8192 --sha-w c:\windows\Users\Default\NTUSER.DAT . ((((((((((((((((((((((((((((( SnapShot@2009-05-03_09.05.02 ))))))))))))))))))))))))))))))))))))))))) . + 2009-03-07 17:43 . 2009-05-03 09:10 28110 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2006-11-02 13:03 . 2009-05-03 08:16 57364 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2006-11-02 13:03 . 2009-05-03 09:10 57364 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-03-07 16:38 . 2009-05-03 09:10 5928 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3601692030-2378274365-694430874-1000_UserData.bin - 2009-05-03 08:14 . 2009-05-03 08:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-05-03 09:08 . 2009-05-03 09:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-05-03 09:08 . 2009-05-03 09:08 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-05-03 08:14 . 2009-05-03 08:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2006-11-02 10:33 . 2009-05-03 09:13 595946 c:\windows\System32\perfh009.dat - 2006-11-02 10:33 . 2009-05-03 08:19 595946 c:\windows\System32\perfh009.dat + 2006-11-02 10:33 . 2009-05-03 09:13 105276 c:\windows\System32\perfc009.dat - 2006-11-02 10:33 . 2009-05-03 08:19 105276 c:\windows\System32\perfc009.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] "BitTorrent DNA"="c:\users\flore\Program Files\DNA\btdna.exe" [2009-03-18 321344] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-24 1947928] "AVGIDS"="c:\program files\AVG\AVG8\IdentityProtection\agent\bin\AVGIDSUI.exe" [2009-02-26 1579528] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-30 13605408] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-30 92704] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{3FD0A374-CC94-444D-B14E-25C1B0F3A2A3}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{F80B9546-9CA8-4F4A-8254-E8BB74DDE534}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{8601A6B5-7025-4297-8749-DCEF7707DF36}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{1F081ACA-B749-40D7-B61B-55F0DDAF4D16}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{B5231E27-8F10-4424-9C5A-8CE8F829E68F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{BEC66C7D-2AB0-4E7F-BEF3-2D3C267E084C}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe "{90C80DCC-1CAD-4549-BB90-6A61E8FB4C4B}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe "{5C58B951-3B5C-4B93-BFC3-C7022924C013}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe "{FD9A91C1-BD68-4968-92EE-4C2DBE161878}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe "{B0C38AC9-AA96-4DF7-8C23-EA0C5799D622}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{8FAFEA31-11D2-4571-B63F-0782C75BCECA}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe "{BD9EC95E-DA2F-47B8-8F65-B567A5B42FE6}"= UDP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox "{14DC5AD9-0BF5-494B-A6CE-0EE626EA3F8A}"= TCP:c:\program files\Mozilla Firefox\firefox.exe:Mozilla Firefox "{142D9DF1-7327-45BD-BC79-8C084ACA1830}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In) "{599F4A1A-B2B2-4346-8DCA-636FCD3E7615}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent S0 AVGIDSErHr;AVGIDSErHr;c:\windows\System32\Drivers\AVGIDSErHr.sys [2009-02-26 25608] S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-04-24 12552] S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2009-04-24 23832] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-24 325896] S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-24 108552] S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-24 908568] S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-24 298776] S2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-04-24 1366904] S2 AVGIDSAgent;AVGIDSAgent; [x] S2 AVGIDSWatcher;AVGIDSWatcher;c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe [2009-02-26 563720] S3 AVGIDSDriver;AVGIDSDriver;c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_VISTA\AVGIDSDriver.sys [2009-02-26 121352] S3 AVGIDSFilter;AVGIDSFilter;c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_VISTA\AVGIDSFilter.sys [2009-02-26 30216] S3 AVGIDSShim;AVGIDSShim;c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_VISTA\AVGIDSShim.sys [2009-02-26 29136] . . ------- Bijkomende Scan ------- . uInternet Settings,ProxyServer = proxy.pandora.be:8080 IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\users\flore\AppData\Roaming\Mozilla\Firefox\Profiles\kwa6wedh.default\ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\program files\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3020.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npInquisit_3020.dll FF - plugin: c:\users\flore\Program Files\DNA\plugins\npbtdna.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-03 11:49 Windows 6.0.6001 Service Pack 1 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... c:\users\flore\AppData\Local\Temp\catchme.dll 53248 bytes executable Scan succesvol afgerond verborgen bestanden: 1 ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_USERS\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0[/u]000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_USERS\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0[/u]000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2009-05-03 11:51 ComboFix-quarantined-files.txt 2009-05-03 09:51 ComboFix2.txt 2009-05-03 09:06 Pre-Run: 35.827.404.800 bytes free Post-Run: 35.697.463.296 bytes free 188