ik heb hem hij is gelukt
ComboFix 09-11-23.04 - Marco 24-11-2009 13:13.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.3071.2654 [GMT 1:00]
Gestart vanuit: C:\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Nieuw herstelpunt werd aangemaakt
.
(((((((((((((((((((( Bestanden Gemaakt van 2009-10-24 to 2009-11-24 ))))))))))))))))))))))))))))))
.
2009-11-24 12:10 . 2009-11-24 12:11 3574677 ----a-r- C:\ComboFix.exe
2009-11-18 17:25 . 2009-11-18 17:25 -------- d-----w- c:\program files\Trend Micro
2009-11-18 17:20 . 2009-11-18 19:01 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-11-18 17:09 . 2009-11-18 17:09 812344 ----a-w- C:\HijackThisInstaller.exe
2009-11-17 14:13 . 2009-11-17 14:13 -------- d-----w- c:\windows\ServicePackFiles
2009-11-17 14:05 . 2008-06-14 18:00 272640 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-11-17 14:05 . 2008-06-14 18:00 272640 ------w- c:\windows\system32\drivers\bthport.sys
2009-11-17 13:54 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-11-17 13:53 . 2009-08-04 17:07 2062080 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-11-17 13:53 . 2009-08-04 17:07 2184704 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-11-17 13:53 . 2009-08-04 17:07 2140672 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-11-17 13:53 . 2009-08-04 17:07 2020352 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-11-13 21:32 . 2009-11-18 17:27 -------- d--h--w- c:\windows\$hf_mig$
2009-11-13 21:16 . 2009-11-13 21:17 -------- d-----w- c:\windows\system32\NtmsData
2009-11-13 20:29 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-11-13 20:29 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-11-13 20:29 . 2003-02-21 04:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2009-11-13 20:29 . 2009-11-13 20:29 -------- d-----w- c:\program files\Alwil Software
2009-11-13 20:25 . 2009-11-13 20:25 -------- d-----w- C:\$AVG
2009-11-13 20:25 . 2009-11-13 20:25 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-13 20:25 . 2009-11-13 20:25 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-13 20:25 . 2009-11-13 20:25 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-13 20:25 . 2009-11-13 20:25 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-11-13 20:25 . 2009-11-24 12:13 -------- d-----w- c:\windows\system32\drivers\Avg
2009-11-13 20:25 . 2009-11-13 20:25 -------- d-----w- c:\program files\AVG
2009-11-13 20:25 . 2009-11-20 09:30 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-11-13 20:21 . 2009-11-13 20:21 891248 ----a-w- C:\avg_free_stb_all_9_40_cnet.exe
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-18 17:23 . 2004-08-04 12:00 53652 ----a-w- c:\windows\system32\perfc013.dat
2009-11-18 17:23 . 2004-08-04 12:00 364644 ----a-w- c:\windows\system32\perfh013.dat
2009-11-11 11:13 . 2009-11-11 11:13 12328 ----a-w- c:\documents and settings\Marco\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-11 11:03 . 2009-11-11 11:03 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-11-11 11:03 . 2009-11-11 11:03 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-11 11:01 . 2009-11-11 10:50 87263 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-11-11 10:57 . 2009-11-11 10:57 -------- d-----w- c:\program files\Realtek
2009-11-11 10:57 . 2009-11-11 10:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-11 10:57 . 2009-11-11 10:57 315392 ----a-w- c:\windows\HideWin.exe
2009-11-11 10:57 . 2009-11-11 10:57 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-11 10:56 . 2009-11-11 10:56 -------- d-----w- c:\documents and settings\Marco\Application Data\InstallShield
2009-11-11 10:51 . 2009-11-11 10:51 -------- d-----w- c:\program files\microsoft frontpage
2009-11-11 10:48 . 2009-11-11 10:48 21748 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-25 05:58 . 2004-08-04 12:00 665088 ----a-w- c:\windows\system32\wininet.dll
2009-09-25 05:58 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-11 14:37 . 2004-08-04 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 20:47 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-13 2020120]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-03-26 16859136]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-13 20:25 12464 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13-11-2009 21:25 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13-11-2009 21:25 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [13-11-2009 21:25 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [13-11-2009 21:25 285392]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [11-11-2009 12:05 335104]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
Inhoud van de 'Gedeelde Taken' map
2009-11-24 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-11-17 21:18]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://google.nl/
.
- - - - ORPHANS VERWIJDERD - - - -
AddRemove-NVIDIA Drivers - c:\windows\system32\NVUNINST.EXE UninstallGUI
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-11-24 13:16
Windows 5.1.2600 Service Pack 2 NTFS
scannen van verborgen processen ...
scannen van verborgen autostart items ...
scannen van verborgen bestanden ...
Scan succesvol afgerond
verborgen bestanden: 0
**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
- - - - - - - > 'explorer.exe'(3032)
c:\windows\system32\msi.dll
.
Voltooingstijd: 2009-11-24 13:16
ComboFix-quarantined-files.txt 2009-11-24 12:16
Pre-Run: 993.978.150.912 bytes beschikbaar
Post-Run: 994.344.869.888 bytes beschikbaar
WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 6668C433DBD51311FFB38267A96BDA35
en hier is de log van combofix
m.v.g marco