NielsD

27 januari 2011

Bedankt voor de hulp alvast, hier dat ComboFix logje:

ComboFix 11-01-26.04 - Niels_2 27/01/2011 18:56:46.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.511.161 [GMT 1:00]

Gestart vanuit: c:\documents and settings\Niels_2\Bureaublad\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\Niels_2\LOCALS~1\Temp\IadHide5.dll

c:\documents and settings\Niels_2\Bureaublad\Internet Explorer.lnk

c:\documents and settings\Niels_2\Local Settings\Temp\IadHide5.dll

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-12-27 to 2011-01-27 ))))))))))))))))))))))))))))))

.

2011-01-26 17:51 . 2011-01-26 17:51 -------- d-----w- c:\documents and settings\Niels_2\Application Data\Malwarebytes

2011-01-26 17:49 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-01-26 17:49 . 2011-01-26 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-01-26 17:48 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-01-26 17:48 . 2011-01-26 17:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-01-26 17:29 . 2011-01-13 09:41 5890896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{73C28AAB-7B74-4777-8EFD-3B443E038474}\mpengine.dll

2011-01-24 17:06 . 2011-01-24 17:06 -------- d-----w- c:\documents and settings\Niels_2\Local Settings\Application Data\antiphishing-webblog1_1dn

2011-01-23 11:31 . 2011-01-23 11:33 -------- d-----w- c:\windows\A8B9466986544126BD28D0D2412CDED6.TMP

2011-01-23 10:57 . 2011-01-23 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo

2011-01-14 22:41 . 2011-01-15 08:10 -------- d-----w- c:\documents and settings\All Users\Application Data\SmartSound Software Inc

2011-01-14 22:41 . 2011-01-14 22:41 -------- d-----w- c:\program files\SmartSound Software

2011-01-14 22:40 . 2011-01-14 22:40 -------- d-----w- c:\documents and settings\Niels\Bureaublad

2011-01-14 22:40 . 2011-01-14 22:40 -------- d-----w- c:\documents and settings\Niels\Menu Start

2011-01-13 19:52 . 2011-01-26 21:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Anti-phishing Domain Advisor

2011-01-12 19:56 . 2011-01-12 19:57 -------- d-----w- c:\program files\Digital Photo Navigator 1.5

2011-01-12 17:32 . 2011-01-12 17:32 -------- d-----w- c:\documents and settings\LocalService\Application Data\Megamedia

2011-01-12 17:19 . 2011-01-12 17:19 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Megamedia

2010-12-31 13:25 . 2010-12-31 13:25 -------- d-----w- c:\documents and settings\Niels_2\Local Settings\Application Data\Ares

2010-12-31 13:18 . 2010-12-31 13:25 -------- d-----w- c:\program files\Ares

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-01-13 09:41 . 2009-06-08 19:43 5890896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2011-01-13 08:47 . 2009-06-08 17:02 188216 ----a-w- c:\windows\system32\aswBoot.exe

2011-01-13 08:41 . 2009-06-08 17:03 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-01-13 08:40 . 2009-06-08 17:03 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-01-13 08:40 . 2009-06-08 17:03 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-01-13 08:39 . 2009-06-08 17:03 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-01-13 08:37 . 2009-06-08 17:03 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-01-13 08:37 . 2009-06-08 17:03 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-01-13 08:37 . 2009-06-08 17:03 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-12-31 20:06 . 2010-09-30 16:55 38848 ----a-w- c:\windows\avastSS.scr

2010-12-26 18:41 . 2010-12-26 18:41 118784 ------r- c:\windows\bwUnin-7.2.0.137-8876480SL.exe

2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-11-18 18:15 . 2009-06-08 16:46 86016 ----a-w- c:\windows\system32\isign32.dll

2010-11-12 17:53 . 2010-05-27 17:06 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-11-12 15:34 . 2010-10-03 14:16 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-11-09 14:52 . 2004-08-04 12:00 249856 ----a-w- c:\windows\system32\odbc32.dll

2010-11-06 00:23 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-11-06 00:23 . 2004-08-04 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-11-06 00:23 . 2004-08-04 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2010-11-03 12:27 . 2004-08-04 12:00 385024 ----a-w- c:\windows\system32\html.iec

2010-11-02 15:17 . 2004-08-04 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\documents and settings\Niels_2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-02-10 135664]

"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2010-12-26 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]

"SoundMan"="SOUNDMAN.EXE" [2009-06-08 577536]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]

"nwiz"="nwiz.exe" [2008-05-16 1630208]

"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592]

"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440]

"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-02-28 75048]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]

"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]

"NokiaMusic FastStart"="c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe" [2010-03-04 2192672]

"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]

"PCTools FGuard"="c:\program files\Spyware Doctor\BDT\FGuard.exe" [2010-09-02 108496]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]

"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2006-11-22 151552]

"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2010-12-26 450560]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\Program Files\\Xfire\\ua_lsp_inst.exe"=

"c:\\Program Files\\EA Games\\Medal of Honor Pacific Assault\\mohpa.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Documents and Settings\\Niels_2\\Bureaublad\\Niels\\Media\\Games\\EE\\Empire Earth Gold\\Empire Earth\\Empire Earth.exe"=

"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

"c:\\Program Files\\Nokia\\Nokia Ovi Suite\\NokiaOviSuite.exe"=

"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

"c:\\Program Files\\Ares\\Ares.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5353:TCP"= 5353:TCP:Adobe CSI CS4

"1032:TCP"= 1032:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [26/06/2009 8:22 237632]

R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [3/10/2010 14:13 338880]

R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [3/10/2010 14:13 656320]

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9/09/2009 20:47 717296]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [8/06/2009 18:03 294608]

R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [16/09/2008 11:03 169312]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/06/2009 18:03 17744]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [3/10/2010 14:21 235472]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3/11/2006 18:19 13592]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/08/2004 13:00 14336]

S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [21/08/2010 12:43 137344]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [22/01/2011 20:42 366840]

S4 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [26/06/2009 8:22 249616]

S4 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [26/06/2009 8:21 70536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Inhoud van de 'Gedeelde Taken' map

2011-01-12 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2011-01-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436374069-1500820517-839522115-1006Core.job

- c:\documents and settings\Niels_2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-10 13:39]

2011-01-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-436374069-1500820517-839522115-1006UA.job

- c:\documents and settings\Niels_2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-10 13:39]

2011-01-27 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2011-01-14 c:\windows\Tasks\OGADaily.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 15:04]

2011-01-27 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 15:04]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.msn.be/

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab

FF - ProfilePath - c:\documents and settings\Niels_2\Application Data\Mozilla\Firefox\Profiles\cyiajmyo.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

- - - - ORPHANS VERWIJDERD - - - -

AddRemove-504244733D18C8F63FF584AEB290E3904E791693 - c:\progra~1\DIFX\B4723E9A0713E5B1\dpinst.exe

AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-01-27 19:40

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]

@Denied: (Full) (Everyone)

"scansk"=hex(0):15,02,10,c7,16,a0,db,5d,eb,57,da,74,e8,11,c5,f8,eb,96,01,ad,72,

60,0b,30,7f,36,b7,2a,bc,30,ab,cf,c5,2d,05,6a,2e,3e,65,11,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7b3e93cd-aadc-4f4b-b9b7-653376ec3ab9}]

@Denied: (Full) (Everyone)

"Model"=dword:0000005a

"Therad"=dword:00000027

"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,

38,95,44,ab,9e,50,1b,eb,77,d1,ab,a5,dc,ce,c4,12,ad,eb,5f,83,e0,8b,c5,07,bb,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*]

"3140710900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(3916)

c:\docume~1\Niels_2\LOCALS~1\Temp\IadHide5.dll

c:\progra~1\WINDOW~2\wmpband.dll

c:\program files\iTunes\iTunesMiniPlayer.dll

c:\program files\iTunes\iTunesMiniPlayer.Resources\nl.lproj\iTunesMiniPlayerLocalized.dll

c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll

c:\windows\system32\msi.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\windows\system32\brss01a.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\CTsvcCDA.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\program files\CyberLink\Shared Files\RichVideo.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\SOUNDMAN.EXE

c:\windows\system32\RUNDLL32.EXE

c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Voltooingstijd: 2011-01-27 19:50:50 - machine werd herstart

ComboFix-quarantined-files.txt 2011-01-27 18:50

Pre-Run: 52.518.682.624 bytes beschikbaar

Post-Run: 53.772.193.792 bytes beschikbaar

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 617F9B29A945102AB2C84094F1B7124D

26 januari 2011

Alvast bedankt voor de hulp.

Hier MBAM logje en HiJackThis log:

MBAM:

Malwarebytes' Anti-Malware 1.50.1.1100

Malwarebytes

Databaseversie: 5610

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

26/01/2011 22:06:33

mbam-log-2011-01-26 (22-06-33).txt

Scantype: Snelle scan

Objecten gescand: 168546

Verstreken tijd: 1 uur/uren, 0 minuut/minuten, 1 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 0

Registerwaarden geïnfecteerd: 0

Registerdata geïnfecteerd: 1

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd: