Pajaso

ComboFix 11-10-07.03 - Administrator 11/10/2011 10:52:35.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1271.829 [GMT 2:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe . ADS - svchost.exe: deleted 88 bytes in 2 streams. . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Administrator\WINDOWS C:\Recycle.Bin c:\windows\system32\d3d9caps.dat . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_b48b7117 . . ((((((((((((((((((((((((( Files Created from 2011-09-11 to 2011-10-11 ))))))))))))))))))))))))))))))) . . 2011-10-11 08:57 . 2011-10-11 08:57 -------- d-----w- c:\windows\system32\wbem\snmp 2011-10-11 06:43 . 2011-10-11 06:43 -------- d-----w- c:\program files\Trend Micro 2011-10-10 18:32 . 2011-10-10 18:32 -------- d-----w- c:\windows\system32\wbem\Repository 2011-10-10 18:26 . 2011-10-10 18:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG Secure Search 2011-10-10 18:26 . 2011-10-10 18:26 -------- d-----w- c:\program files\AVG Secure Search 2011-10-10 18:26 . 2011-10-10 18:26 -------- d-----w- c:\program files\Common Files\AVG Secure Search 2011-10-10 12:33 . 2011-10-10 18:22 -------- d-----w- c:\program files\Hewlett-Packard 2011-10-10 12:32 . 2011-10-10 12:32 -------- d-----w- c:\program files\Synaptics 2011-10-07 16:12 . 2011-10-07 16:12 784 ----a-w- c:\windows\trz20.tmp 2011-10-07 16:06 . 2011-10-07 16:06 -------- d-----w- c:\program files\AVAST Software 2011-10-07 16:06 . 2011-10-07 16:06 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software 2011-10-07 14:05 . 2011-10-07 14:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG2012 2011-10-07 14:03 . 2011-10-07 15:53 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2012 2011-10-07 10:53 . 2011-10-07 10:53 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2011-10-07 10:52 . 2011-10-07 10:53 -------- d-----w- c:\program files\SUPERAntiSpyware 2011-10-07 10:52 . 2011-10-07 10:52 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2011-10-07 10:35 . 2011-10-07 10:35 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-10-07 10:28 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-10-06 17:12 . 2011-10-06 17:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities 2011-10-06 16:39 . 2011-10-06 16:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-10-06 16:36 . 2011-10-06 16:36 -------- d--h--w- c:\windows\PIF 2011-10-06 16:33 . 2011-10-06 16:38 -------- d-----w- c:\program files\beschermingNIEUW 2011-10-06 15:50 . 2011-10-06 15:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2011-10-06 15:49 . 2011-10-06 15:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-09-19 16:14 . 1996-06-19 08:08 49664 ----a-w- c:\windows\system32\MFC42FRA.DLL 2011-09-19 16:14 . 1995-12-04 12:08 26624 ----a-w- c:\windows\system32\CTL3D95.DLL 2011-09-19 16:14 . 1997-07-19 15:00 604432 ----a-w- c:\windows\system32\COMCTL32.OCX 2011-09-19 16:14 . 1997-01-13 22:00 49664 ----a-w- c:\windows\system32\MSSTKPRP.DLL 2011-09-19 16:14 . 2011-09-19 16:14 -------- d-----w- c:\program files\Micro Application 2011-09-19 16:09 . 1998-10-07 11:08 327168 ----a-w- c:\windows\IsUn040c.exe 2011-09-16 13:01 . 2008-03-05 14:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll 2011-09-16 13:01 . 2008-03-05 14:03 238088 ----a-w- c:\windows\system32\xactengine3_0.dll 2011-09-16 13:01 . 2008-03-05 14:00 25608 ----a-w- c:\windows\system32\X3DAudio1_3.dll 2011-09-16 13:01 . 2008-03-05 13:56 1420824 ----a-w- c:\windows\system32\D3DCompiler_37.dll 2011-09-16 13:01 . 2008-02-05 21:07 462864 ----a-w- c:\windows\system32\d3dx10_37.dll 2011-09-16 13:01 . 2008-03-05 13:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll 2011-09-16 12:41 . 1996-11-06 10:04 302592 ----a-w- c:\windows\unin040c.exe 2011-09-13 04:30 . 2011-09-13 04:30 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-08-08 04:08 . 2011-08-08 04:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2011-09-06 19:59 . 2011-06-23 06:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2008-05-03 . 37D8387CBD4437C55F454209BE10EF11 . 361344 . . [5.1.2600.5508] . . c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2011-10-07 14:03 1451336 ----a-w- c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll" [2011-10-07 1451336] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-09-14 4611456] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\windows\system32\bcmntray" [X] "igfxtray"="c:\windows\system32\igfxtray.exe" [2007-06-19 101144] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2007-06-19 84760] "igfxpers"="c:\windows\system32\igfxpers.exe" [2007-06-19 125720] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544] "AGRSMMSG"="AGRSMMSG.exe" [2005-11-16 88209] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-09-23 2404704] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-10-07 218440] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVWSzItQUxZTUYtU0xLTFUtQVoyVUItNkdPS0ItSkhGTkg&inst=NzctNjE0Njc1MzE3LVRCOSsyLUZMKzktUUlYMSs0LUYxME0rNS1YMjAxMCsyLUxJQys3Ny1GTDEwKzEtU1AxKzEtU1AxVEIrMS1TVUQrMS1TMUkrMS1TVTMrMS1ERFQrMjk5MTktREQxMEYrMS1TVDEwRkFQUCsx∏=90&ver=10.0.1410" [?] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2007-08-13 123904] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "StartMenuFavorites"= 0 (0x0) "Start_ShowMyComputer"= 1 (0x1) "Start_ShowMyDocs"= 1 (0x1) "Start_ShowMyMusic"= 0 (0x0) "Start_ShowRun"= 1 (0x1) "Start_ShowSearch"= 0 (0x0) . [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "MemCheckBoxInRunDlg"= 1 (0x1) . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\prio.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1832:TCP"= 1832:TCP:xrcle "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 1:14 AM 23120] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/13/2011 6:30 AM 32592] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 295248] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 6:27 PM 12880] R1 SAS***IL;SAS***IL;c:\program files\SUPERAntiSpyware\SAS***IL.SYS [7/12/2011 11:55 PM 67664] R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/12/2011 1:38 AM 116608] R2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [10/7/2011 4:04 PM 246600] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 1:14 AM 134608] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 1:14 AM 24272] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [7/11/2011 1:14 AM 16720] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [12/24/2009 12:04 AM 88192] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7/11/2011 1:13 AM 229840] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [9/12/2011 6:23 AM 5265248] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776] S2 nqytr;System Support;c:\windows\system32\svchost.exe -k netsvcs [5/3/2008 2:00 PM 14336] S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?] S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [4/6/2010 8:40 PM 264576] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs nqytr . Contents of the 'Scheduled Tasks' folder . 2011-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-854245398-1177238915-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-14 23:46] . 2011-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-854245398-1177238915-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-14 23:46] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://downloads.phpnuke.org/nl/index.php?rvs=google uSearchURL,(Default) = hxxp://www.google.com/keyword/%s LSP: mswsock.dll TCP: DhcpNameServer = 192.168.1.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\m0hfi793.default\ FF - prefs.js: browser.search.selectedEngine - hxxp://downloads.phpnuke.org/nl/index.php?rvs=google FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B1b1bc39e-8a68-4c5b-bf02-0635fb14c494%7D&mid=a360e1cf25cc02b78b11a75098fe0931-7edb86899a032eaadc8093de199c9d7a7bd2f4f8&ds=AVG&v=8.0.0.34.1〈=en&pr=pr&d=2011-10-07%2016%3A04%3A02&sap=ku&q= . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-10-11 10:59 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . . c:\windows\393317300:1265929960.exe 784 bytes executable . . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nqytr] "ServiceDll"="c:\windows\system32\sgnfzen.dll" . ------------------------ Other Running Processes ------------------------ . c:\windows\System32\wltrysvc.exe c:\windows\System32\bcmwltry.exe c:\windows\System32\SCardSvr.exe c:\windows\393317300:1265929960.exe c:\windows\AGRSMMSG.exe c:\windows\system32\bcmntray.exe c:\windows\system32\igfxsrvc.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe . ************************************************************************** . Completion time: 2011-10-11 11:01:22 - machine was rebooted ComboFix-quarantined-files.txt 2011-10-11 09:01 ComboFix2.txt 2011-10-07 14:46 . Pre-Run: 15 494 103 040 bytes free Post-Run: 15 485 255 680 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - AE7F0EB0518970A0CDDA2DE64389E67F

wanneer ik op hijachthis scan uitvoeren klik wordt het programma na een seconde afgesloten. daarna wordt me de toegang tot dit programma geweigerd. wanneer ik hem uninstall en weer installeer gebeurd hetzelfde.

(ik heb onderhand via system restore mijn muis en keyboard weer op orde gekregen) Hoe kom ik van deze virus af? (ik zal geen acties meer zonder begeleiding nemen)

gelukt cool! ik zit nu in safe mode. en mijn touchpad en keyboard doen het hier wel. wat adviseert u mij vervolgens te doen?

ok in heb een externe muis aangesloten, succes ik heb weer muis control. Keyboard properties : device control; (code 19) zegt iets als Windows cannot start device because of incomplete or damaged configuration information in the registry. foute boel geloof ik.. nu heb ik nieuwe drivers gedownd voor muis, maar die kunnen niet installeren vanwege het huidige probleem.. is het mogenlijk om de registry configuratie wat betreft mijn muis (lees touchpad) te herstellen? en dan gelijk ook die van mijn keyboard?

ik kan veilige modus nog wel opstarten. het toetsen bord doet het tot dat wanneer windows begint. maar eenmaal in de veiligemodus aangekomen kan ik niet verder omdat me gevraagt wordt of ik er zeker van ben dat ik verder wil gaan in veilige modus, en aangezien mijn toetsenbord het dan niet meer doet (en muis) kom ik dus niet verder. De reden waarom ik combo-fix heb gebruikt is omdat het onderwerp van dennish van 25 sept (opgelost) erg overeen kwam met mijn probleem. Zijn discussie volgend kwam ik uit op combo-fix omdat niets anders werkte. alle virus-scanners, malware detectors (waaronder hijackthis) etc werden steeds uitgeschakeld. is er misschien een manier om aan dit probleem te sleutelen zonder windows opnieuw te installeren?

hoi kape, sterker nog, mijn muis en toetsenbord doen het nu ook niet meer (ik zit nu op een andere computer (ik werk normaal vanaf een laptop)).

ehm.. bij deze de log ComboFix 11-10-07.03 - Administrator 07/10/2011 16:35:59.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1271.806 [GMT 2:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe AV: AVG Anti-Virus 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ADS - svchost.exe: deleted 88 bytes in 2 streams. . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Administrator\WINDOWS C:\Recycle.Bin c:\recycle.bin\config.bin c:\windows\system32\d3d9caps.dat . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_b48b7117 . . ((((((((((((((((((((((((( Files Created from 2011-09-07 to 2011-10-07 ))))))))))))))))))))))))))))))) . . 2011-10-07 14:42 . 2011-10-07 14:42 -------- d-----w- c:\windows\system32\wbem\snmp 2011-10-07 14:42 . 2011-10-07 14:42 -------- d-----w- c:\windows\system32\xircom 2011-10-07 14:42 . 2011-10-07 14:42 -------- d-----w- c:\program files\microsoft frontpage 2011-10-07 14:18 . 2011-10-07 14:18 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-10-07 14:05 . 2011-10-07 14:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG2012 2011-10-07 14:04 . 2011-10-07 14:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG Secure Search 2011-10-07 14:03 . 2011-10-07 14:03 -------- d-----w- c:\program files\Common Files\AVG Secure Search 2011-10-07 14:03 . 2011-10-07 14:04 -------- d-----w- c:\program files\AVG Secure Search 2011-10-07 14:03 . 2011-10-07 14:26 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2012 2011-10-07 10:53 . 2011-10-07 10:53 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2011-10-07 10:52 . 2011-10-07 10:53 -------- d-----w- c:\program files\SUPERAntiSpyware 2011-10-07 10:52 . 2011-10-07 10:52 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2011-10-07 10:35 . 2011-10-07 10:35 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-10-07 10:28 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-10-06 17:12 . 2011-10-06 17:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities 2011-10-06 16:39 . 2011-10-06 16:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-10-06 16:36 . 2011-10-06 16:36 -------- d--h--w- c:\windows\PIF 2011-10-06 16:33 . 2011-10-06 16:38 -------- d-----w- c:\program files\beschermingNIEUW 2011-10-06 15:50 . 2011-10-06 15:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2011-10-06 15:49 . 2011-10-06 15:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-09-19 16:14 . 1996-06-19 08:08 49664 ----a-w- c:\windows\system32\MFC42FRA.DLL 2011-09-19 16:14 . 1995-12-04 12:08 26624 ----a-w- c:\windows\system32\CTL3D95.DLL 2011-09-19 16:14 . 1997-07-19 15:00 604432 ----a-w- c:\windows\system32\COMCTL32.OCX 2011-09-19 16:14 . 1997-01-13 22:00 49664 ----a-w- c:\windows\system32\MSSTKPRP.DLL 2011-09-19 16:14 . 2011-09-19 16:14 -------- d-----w- c:\program files\Micro Application 2011-09-19 16:09 . 1998-10-07 11:08 327168 ----a-w- c:\windows\IsUn040c.exe 2011-09-16 13:01 . 2008-03-05 14:03 479752 ----a-w- c:\windows\system32\XAudio2_0.dll 2011-09-16 13:01 . 2008-03-05 14:03 238088 ----a-w- c:\windows\system32\xactengine3_0.dll 2011-09-16 13:01 . 2008-03-05 14:00 25608 ----a-w- c:\windows\system32\X3DAudio1_3.dll 2011-09-16 13:01 . 2008-03-05 13:56 1420824 ----a-w- c:\windows\system32\D3DCompiler_37.dll 2011-09-16 13:01 . 2008-02-05 21:07 462864 ----a-w- c:\windows\system32\d3dx10_37.dll 2011-09-16 13:01 . 2008-03-05 13:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll 2011-09-16 12:41 . 1996-11-06 10:04 302592 ----a-w- c:\windows\unin040c.exe 2011-09-13 04:30 . 2011-09-13 04:30 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2011-09-10 18:39 . 2011-10-06 15:25 -------- d-----w- c:\program files\Jnes . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-08-08 04:08 . 2011-08-08 04:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2011-07-10 23:14 . 2011-07-10 23:14 295248 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2011-07-10 23:14 . 2011-07-10 23:14 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys 2011-07-10 23:14 . 2011-07-10 23:14 24272 ----a-w- c:\windows\system32\drivers\AVGIDSFilter.sys 2011-07-10 23:14 . 2011-07-10 23:14 23120 ----a-w- c:\windows\system32\drivers\AVGIDSEH.sys 2011-07-10 23:14 . 2011-07-10 23:14 134608 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys 2011-07-10 23:13 . 2011-07-10 23:13 229840 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2011-09-06 19:59 . 2011-06-23 06:44 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [7] 2008-03-20 . 65EA06F8711FB3A64EC7D323E350F456 . 96512 . . [5.1.2600.5508] . . c:\windows\system32\drivers\atapi.sys . [7] 2008-05-03 . 34C951228C152A248357409CB680CE13 . 14336 . . [5.1.2600.5508] . . c:\windows\system32\drivers\asyncmac.sys . [7] 2008-05-03 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys . [7] 2008-05-03 . 4780A418E0FA859B09311C87980D0F7E . 24576 . . [5.1.2600.5508] . . c:\windows\system32\drivers\kbdclass.sys . [7] 2008-05-03 . AFF1AED224D17C8BC38174ED932F68B6 . 182656 . . [5.1.2600.5508] . . c:\windows\system32\drivers\ndis.sys . [7] 2008-05-03 . D7F8A3F743C54C13D78954176AD483A2 . 574976 . . [5.1.2600.5508] . . c:\windows\system32\drivers\ntfs.sys . [7] 2008-05-03 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys . [-] 2008-05-03 . 37D8387CBD4437C55F454209BE10EF11 . 361344 . . [5.1.2600.5508] . . c:\windows\system32\drivers\tcpip.sys . [7] 2008-05-03 . 63135147C2D86A374ABF057F178907B7 . 77824 . . [5.1.2600.5508] . . c:\windows\system32\browser.dll . [7] 2008-05-03 . 809C3DFADC08D0EB15E5440F2A65434C . 13312 . . [5.1.2600.5508] . . c:\windows\system32\lsass.exe . [7] 2008-05-03 . 682F6E2FDE80B2A25CD39A771BE41797 . 198144 . . [5.1.2600.5508] . . c:\windows\system32\netman.dll . [7] 2008-05-03 12:00 . B59428B5EF51312D336BFAEB27A531F9 . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll . [7] 2008-05-03 . 2A18B9DDD9D297050BB7AD7C82BDAE9A . 409088 . . [6.7.2600.5508] . . c:\windows\system32\qmgr.dll . [7] 2008-05-03 . B29DF40EB7B4210D0D4A2AF78B621B07 . 399360 . . [5.1.2600.5508] . . c:\windows\system32\rpcss.dll . [7] 2008-05-03 . C91018FE1F9B53DE349398DD4AEC6F8C . 108544 . . [5.1.2600.5508] . . c:\windows\system32\services.exe . [7] 2008-05-03 . 037B1C61E298180A43A6401A6D12BD76 . 57856 . . [5.1.2600.5508] . . c:\windows\system32\spoolsv.exe . [7] 2008-05-03 . B8135E9ED99A0858DF535CE0A0271558 . 507904 . . [5.1.2600.5508] . . c:\windows\system32\winlogon.exe . [7] 2007-07-30 . F3E9065EB617A7E3A832A7976BFA021B . 53080 . . [7.0.6000.381] . . c:\windows\system32\wuauclt.exe . [7] 2008-05-03 . 93D4F7DFB9983D958B35180EDCB6A2FF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll [7] 2008-05-03 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [7] 2008-05-03 . 3082CD106E68C8B1BE7CB39FC7BBEB77 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5508_x-ww_35d3ce4a\comctl32.dll . [7] 2008-05-03 . ED2B536EE810EDD56CC2FEBCF4F40861 . 62464 . . [5.1.2600.5508] . . c:\windows\system32\cryptsvc.dll . [7] 2008-05-03 12:00 . C33868F98093076213D024678ACC0900 . 246272 . . [2001.12.4414.701] . . c:\windows\system32\es.dll . [7] 2008-05-03 . 3ECE68853C66254AE773E61F0B93142B . 110080 . . [5.1.2600.5508] . . c:\windows\system32\imm32.dll . [7] 2008-05-03 . 9A8D604748D9FE73B66021E5782A4A3C . 989696 . . [5.1.2600.5508] . . c:\windows\system32\kernel32.dll . [7] 2008-05-03 . B1663E0F6F10E772FB8C8D3FFDF2E05B . 19968 . . [5.1.2600.5508] . . c:\windows\system32\linkinfo.dll . [7] 2008-05-03 . EC8EDA24A6966DFF1AEF590555E73A0D . 22016 . . [5.1.2600.5508] . . c:\windows\system32\lpk.dll . [7] 2008-05-03 . 8F305EAC69163DFE0C75F7B5A4D73769 . 3066880 . . [6.00.2900.5508] . . c:\windows\ie7\mshtml.dll [7] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . c:\windows\system32\mshtml.dll [7] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . c:\windows\system32\dllcache\mshtml.dll . [7] 2008-05-03 . 1CA39C7E1423FF8821664E0E06FEA55E . 343040 . . [7.0.2600.5508] . . c:\windows\system32\msvcrt.dll [7] 2008-05-03 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll [7] 2008-05-03 . D55EFF08BC94BFD0A1E5D99527F6719A . 343040 . . [7.0.2600.5508] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5508_x-ww_3fd50d2a\msvcrt.dll . [7] 2008-05-03 . DC8B471702098212FC8AFE965E5CA760 . 245248 . . [5.1.2600.5508] . . c:\windows\system32\mswsock.dll . [7] 2008-05-03 . 86BC76CAB167ABEA2BEC9FA3B7EF51CA . 407040 . . [5.1.2600.5508] . . c:\windows\system32\netlogon.dll . [7] 2008-05-03 . 17CB8A84B1FEF3DFA0B9A6BCFB0D6305 . 17408 . . [6.00.2900.5508] . . c:\windows\system32\powrprof.dll . [7] 2008-05-03 . 752E372C6C1D91BD606BA837C759BF68 . 181248 . . [5.1.2600.5508] . . c:\windows\system32\scecli.dll . [7] 2008-05-03 . AD65F1A0DA1D2EAC15C8C8C1D9882B0B . 5120 . . [5.1.2600.5508] . . c:\windows\system32\sfc.dll . [7] 2011-04-13 . 0B3290FB3815F5F6553E198642BB7E07 . 14336 . . [5.1.2600.5508] . . c:\windows\system32\svchost.exe . [7] 2008-05-03 . 531EF469A192AC3266EA18E7D62EF79C . 249856 . . [5.1.2600.5508] . . c:\windows\system32\tapisrv.dll . [7] 2008-05-03 . F92D8964B5286DE225BD2B6BF89764BE . 578560 . . [5.1.2600.5508] . . c:\windows\system32\user32.dll . [7] 2008-05-03 . CCBF7E850D72B2DE4F5A1D64D2627686 . 26112 . . [5.1.2600.5508] . . c:\windows\system32\userinit.exe . [7] 2008-05-03 . 67E288984E845CC5540113950C57AC51 . 666112 . . [6.00.2900.5508] . . c:\windows\ie7\wininet.dll [7] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . c:\windows\system32\wininet.dll [7] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . c:\windows\system32\dllcache\wininet.dll . [7] 2008-05-03 . 3FE3D2C94B1F0A03C54D259434CE765E . 82432 . . [5.1.2600.5508] . . c:\windows\system32\ws2_32.dll . [7] 2008-05-03 . B73C886AB223924EA811AE291D2F4267 . 19968 . . [5.1.2600.5508] . . c:\windows\system32\ws2help.dll . [7] 2008-05-03 . 91172F1F7DECAA275ED52FCB61F57307 . 1033728 . . [6.00.2900.5508] . . c:\windows\explorer.exe . [7] 2008-05-03 . A56D3A65776A94CC45C9DDE53176D49B . 146432 . . [5.1.2600.5508] . . c:\windows\regedit.exe . [7] 2008-05-03 . 31653CDF039C3F415B8D33F2D133E6AB . 1287168 . . [5.1.2600.5508] . . c:\windows\system32\ole32.dll . [7] 2008-05-03 . CC8DEBA5A3EE13211274C4660C1CE8EA . 406016 . . [1.0420.2600.5508] . . c:\windows\system32\usp10.dll . [7] 2008-03-21 . 50CC9BDCF8D8A0EB9C3F6DD3D121B326 . 4096 . . [5.3.2600.5508] . . c:\windows\system32\ksuser.dll . [7] 2008-05-03 . F7E4331A79BA927333F3009E3FCD3772 . 171008 . . [5.1.2600.5508] . . c:\windows\system32\srsvc.dll . [7] 2008-05-03 . 142C8EC82139C554F3C9BF4C2DD8692D . 13824 . . [5.1.2600.5508] . . c:\windows\system32\wscntfy.exe . [7] 2008-05-03 . 89CCE39DDBC280F4950BAADCA5377CE4 . 129024 . . [5.1.2600.5508] . . c:\windows\system32\xmlprov.dll . [7] 2008-05-03 . 74D2776EB4A9CDAB4DEBC9FFB35E5772 . 56320 . . [5.1.2600.5508] . . c:\windows\system32\eventlog.dll . [7] 2008-05-03 . D4779D5597B56C17793958DEFD51B7D1 . 1614848 . . [5.1.2600.5508] . . c:\windows\system32\sfcfiles.dll . [7] 2008-05-03 . 49B33E2B875ABE592C81F0D679858DE0 . 15360 . . [5.1.2600.5508] . . c:\windows\system32\ctfmon.exe . [7] 2008-05-03 . BBECAAE6B47F775CC98FD38108386D93 . 135168 . . [6.00.2900.5508] . . c:\windows\system32\shsvcs.dll . [7] 2008-05-03 . 7C233CFFAF2680AF8F3F56E20B7FE126 . 59904 . . [5.1.2600.5508] . . c:\windows\system32\regsvc.dll . [7] 2008-05-03 . D77A0E39FF714D931F91052E357B5F04 . 192512 . . [5.1.2600.5508] . . c:\windows\system32\schedsvc.dll . [7] 2008-05-03 . 18AB8811FFDACDE62F36573ABDF19EA1 . 71680 . . [5.1.2600.5508] . . c:\windows\system32\ssdpsrv.dll . [7] 2008-05-03 . C143D487E0CAC3DE4714754843140D4A . 295424 . . [5.1.2600.5508] . . c:\windows\system32\termsrv.dll . [7] 2008-05-03 . D1F389D6C5A9B1D7ACF4F90F1CEBDF71 . 344064 . . [5.1.2600.5508] . . c:\windows\system32\hnetcfg.dll . [7] 2008-05-03 . BBF1F51AE53036101B9FA467A6621A0F . 167936 . . [5.1.2600.5508] . . c:\windows\system32\appmgmts.dll . [7] 2008-05-03 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys . [7] 2008-03-20 17:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys . [7] 2008-05-03 . 0F2A14149B767CD62559A4E060D63E0A . 36608 . . [5.1.2600.5508] . . c:\windows\system32\drivers\ip6fw.sys . [7] 2008-05-03 12:00 . C8CD9ED8C0B103F58E8461F4D0B7D0B9 . 927504 . . [4.1.0.61] . . c:\windows\system32\mfc40u.dll . [7] 2008-05-03 . B92FD1441485895BC65F40EA1041620B . 33792 . . [5.1.2600.5508] . . c:\windows\system32\msgsvc.dll . [7] 2008-05-03 12:00 . CB19629E7B11AE7B8B46AFCE9123BC0E . 52224 . . [9.0.1.56] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll [7] 2006-10-18 22:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll . [7] 2008-05-03 . F36EBB90382427F7B154F15D1743C88D . 2065792 . . [5.1.2600.5508] . . c:\windows\system32\ntkrnlpa.exe . [7] 2008-05-03 12:00 . BABCEAB5DC36947044BAD417E1E3210E . 435200 . . [5.1.2400.5508] . . c:\windows\system32\ntmssvc.dll . [7] 2008-05-03 . 6E900663DC8CC03689D6437B1D7CB2C5 . 185856 . . [5.1.2600.5508] . . c:\windows\system32\upnphost.dll . [7] 2008-05-03 . 63D98AFFBEE54FC7CDD0954EC112549B . 367616 . . [5.3.2600.5508] . . c:\windows\system32\dsound.dll . [7] 2008-05-03 . 4C9BA16412F2C77CFD753A946D76E44E . 1689088 . . [5.03.2600.5508] . . c:\windows\system32\d3d9.dll . [7] 2008-05-03 . 71C330C94FF32CA5B11BFCBEF0E2735F . 279552 . . [5.03.2600.5508] . . c:\windows\system32\ddraw.dll . [7] 2008-05-03 12:00 . 45F67A8395A9AC782D12B03AC982F0BF . 84992 . . [5.1.2600.5508] . . c:\windows\system32\olepro32.dll . [7] 2008-05-03 . 4193E2A574247A41D538F9011AA27D0B . 39936 . . [5.1.2600.5508] . . c:\windows\system32\perfctrs.dll . [7] 2008-05-03 . A5FEC64F6CE1FCEB5E5C877884827777 . 18944 . . [5.1.2600.5508] . . c:\windows\system32\version.dll . [7] 2008-05-03 . 2382C75EB05C16EFCE314DD68361A9DC . 93184 . . [6.00.2900.5508] . . c:\windows\ie7\iexplore.exe [7] 2007-08-13 . DE49B348A18369B4626FBA1D49B07FB4 . 622080 . . [7.00.5730.13] . . c:\windows\system32\dllcache\iexplore.exe . . [7] 2008-05-03 . 6D0C1419FA54644EB3695F361A3FA635 . 2188928 . . [5.1.2600.5508] . . c:\windows\system32\ntoskrnl.exe . [7] 2008-05-03 . F7E4331A79BA927333F3009E3FCD3772 . 171008 . . [5.1.2600.5508] . . c:\windows\system32\srsvc.dll . [7] 2008-05-03 . DB923B55D65325A4154BB89C70F15961 . 175104 . . [5.1.2600.5508] . . c:\windows\system32\w32time.dll . [7] 2008-05-03 . 254559635688D4CD65E8625C1087F24F . 333824 . . [5.1.2600.5508] . . c:\windows\system32\wiaservc.dll . [7] 2008-05-03 . 7BAA3B855C8368A1E9F03B847432BE64 . 18944 . . [5.1.2600.5508] . . c:\windows\system32\midimap.dll . [7] 2008-05-03 . 9BE40415F713138707C5714247CDAAA4 . 7680 . . [5.1.2600.5508] . . c:\windows\system32\rasadhlp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2011-10-07 14:03 1451336 ----a-w- c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll" [2011-10-07 1451336] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-09-14 4611456] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\windows\system32\bcmntray" [X] "igfxtray"="c:\windows\system32\igfxtray.exe" [2007-06-19 101144] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2007-06-19 84760] "igfxpers"="c:\windows\system32\igfxpers.exe" [2007-06-19 125720] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544] "AGRSMMSG"="AGRSMMSG.exe" [2005-11-16 88209] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-09-23 2404704] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-10-07 218440] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVWSzItQUxZTUYtU0xLTFUtQVoyVUItNkdPS0ItSkhGTkg&inst=NzctNjE0Njc1MzE3LVRCOSsyLUZMKzktUUlYMSs0LUYxME0rNS1YMjAxMCsyLUxJQys3Ny1GTDEwKzEtU1AxKzEtU1AxVEIrMS1TVUQrMS1TMUkrMS1TVTMrMS1ERFQrMjk5MTktREQxMEYrMS1TVDEwRkFQUCsx∏=90&ver=10.0.1410" [?] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2007-08-13 123904] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "StartMenuFavorites"= 0 (0x0) "Start_ShowMyComputer"= 1 (0x1) "Start_ShowMyDocs"= 1 (0x1) "Start_ShowMyMusic"= 0 (0x0) "Start_ShowRun"= 1 (0x1) "Start_ShowSearch"= 0 (0x0) . [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "MemCheckBoxInRunDlg"= 1 (0x1) . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\prio.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1832:TCP"= 1832:TCP:xrcle "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 1:14 AM 23120] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/13/2011 6:30 AM 32592] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7/11/2011 1:13 AM 229840] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 295248] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 6:27 PM 12880] R1 SAS***IL;SAS***IL;c:\program files\SUPERAntiSpyware\SAS***IL.SYS [7/12/2011 11:55 PM 67664] R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/12/2011 1:38 AM 116608] R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776] R2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [10/7/2011 4:04 PM 246600] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 1:14 AM 134608] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 1:14 AM 24272] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [7/11/2011 1:14 AM 16720] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [12/24/2009 12:04 AM 88192] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [9/12/2011 6:23 AM 5265248] S2 nqytr;System Support;c:\windows\system32\svchost.exe -k netsvcs [5/3/2008 2:00 PM 14336] S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?] S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [4/6/2010 8:40 PM 264576] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs nqytr . Contents of the 'Scheduled Tasks' folder . 2011-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-854245398-1177238915-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-14 23:46] . 2011-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-854245398-1177238915-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-14 23:46] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://downloads.phpnuke.org/nl/index.php?rvs=google uSearchURL,(Default) = hxxp://www.google.com/keyword/%s LSP: mswsock.dll TCP: DhcpNameServer = 192.168.1.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\m0hfi793.default\ FF - prefs.js: browser.search.selectedEngine - hxxp://downloads.phpnuke.org/nl/index.php?rvs=google FF - prefs.js: browser.startup.homepage - FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B1b1bc39e-8a68-4c5b-bf02-0635fb14c494%7D&mid=a360e1cf25cc02b78b11a75098fe0931-7edb86899a032eaadc8093de199c9d7a7bd2f4f8&ds=AVG&v=8.0.0.34.1〈=en&pr=pr&d=2011-10-07%2016%3A04%3A02&sap=ku&q= . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-10-07 16:44 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . . c:\windows\393317300:1265929960.exe 784 bytes executable . . ************************************************************************** . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nqytr] "ServiceDll"="c:\windows\system32\sgnfzen.dll" . ------------------------ Other Running Processes ------------------------ . c:\windows\System32\wltrysvc.exe c:\windows\System32\bcmwltry.exe c:\windows\393317300:1265929960.exe c:\windows\System32\SCardSvr.exe c:\windows\AGRSMMSG.exe c:\windows\system32\bcmntray.exe c:\windows\system32\igfxsrvc.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\AVG\AVG2012\avgnsx.exe c:\program files\AVG\AVG2012\avgemcx.exe . ************************************************************************** . Completion time: 2011-10-07 16:46:33 - machine was rebooted ComboFix-quarantined-files.txt 2011-10-07 14:46 . Pre-Run: 13 844 164 608 bytes free Post-Run: 16 403 611 648 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - BEFDFD96ECAE0D99A7CE6A512C9F840D

Hallo, Ik heb momenteel een trojan horse generic4c_.CBUU op mijn computer. Ik heb in de discussie gestart door Dennish op 25 Sep 2011 een gelijke situatie gezien. Ik heb combofix gebruikt om een log file te maken. Nu kan ik deze logfile niet interpreteren en vraag hierbij aan Kape of Kweezie Wabbit (of iemand anders die het weet) of ze me verder kunnen helpen. mvg