PSW.Agent.AUES

[kape]

Je mag het logje onmiddellijk posten, maar daarna moet je de PC wel opnieuw opstarten !

[frouwipkus]

Ik heb nog wel een vraag over het uitschakelen van AVG en Zonealarm, Als ik het logfile van Zonealarm bekijk dan heeft services.exe in een minuut wel 15 keer contact proberen te maken naar allemaal IP adressen, wat geblockt wordt door Zonealarm. Als ik Zonealarm uitschakel voor het installeren van ComboFix dan worden die verbindingen niet meer geblokkeerd wat ik erg eng vind. Kan dat geen kwaad in dit geval?

[kape]

Laat ZoneAlarm even aan ... enkel AVG verwijderen moet volstaan.

[frouwipkus]

Tijdens het uitvoeren van ComboFix wilde pev.3xe steeds contact, als eerste met de trusted zone en daarna met internet. Als ik geen toestemming gaf ging ComboFix niet verder. Op een gegeven moment schakelde AVG weer in en toen ComboFix bijna klaar was zei AVG "bedreiging gededecteerd" regt.3xe en vroeg wat ik wilde, de keus was in quarantaine plaatsen of doorgaan, waarbij ik voor het laatste heb gekozen.

Hieronder mijn logfile, al vast bedankt voor het nakijken!

Vr.groet,

Jeanne

-------------------------------------------------------------------------------------------------

ComboFix 12-04-06.02 - BenJ 06-04-2012 20:54:50.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.1023.438 [GMT 2:00]

Gestart vanuit: c:\documents and settings\BenJ\Bureaublad\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\BenJ\Application Data\isfree3_0.tmp

c:\documents and settings\BenJ\Application Data\isfree3_1.tmp

c:\documents and settings\BenJ\Onlangs geopend\Thumbs.db

c:\documents and settings\BenJ\WINDOWS

c:\windows\system32\drivers\nabplmwkuulj.sys

c:\windows\system32\ijl11.dll

.

Besmet exemplaar van c:\windows\system32\Drivers\atapi.sys werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\expand\atapi.sys

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_RKHIT

-------\Service_RkHit

-------\Service_xcpip

-------\Legacy_nabplmwkuulj

-------\Service_nabplmwkuulj

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-03-06 to 2012-04-06 ))))))))))))))))))))))))))))))

.

.

2012-04-05 17:52 . 2012-04-06 10:47 -------- d-----w- c:\documents and settings\BenJ\Application Data\Dropbox

2012-04-05 14:04 . 2012-04-05 14:04 388096 ----a-r- c:\documents and settings\BenJ\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-04-04 14:56 . 2012-04-04 14:56 4125344 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2012-04-04 12:13 . 2012-04-04 14:56 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-04-04 09:29 . 2012-04-04 09:29 -------- d-----w- c:\windows\system32\LogFiles

2012-04-03 14:27 . 2003-08-26 09:16 344064 ----a-w- c:\windows\system32\msvcr70.dll

2012-04-03 14:12 . 2012-04-03 14:12 -------- d-----w- c:\documents and settings\LocalService\Application Data\X10 Commander

2012-04-03 13:58 . 1999-06-25 07:56 127184 ----a-w- c:\windows\Unwise.exe

2012-04-03 13:58 . 2012-04-03 13:58 -------- d-----w- c:\program files\Common Files\X10

2012-04-02 19:13 . 2004-08-13 14:38 140544 ----a-w- c:\windows\system32\drivers\rt2500usb.sys

2012-04-02 17:44 . 2001-11-23 09:08 712704 ----a-r- c:\windows\system32\Audio3D.dll

2012-03-31 19:46 . 2012-03-31 19:46 -------- d-----w- c:\documents and settings\LocalService\Bureaublad

2012-03-31 19:11 . 2012-03-31 19:11 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2012-03-31 19:08 . 2012-04-06 18:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2012-03-31 13:00 . 2006-06-19 11:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll

2012-03-31 13:00 . 2006-05-25 13:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll

2012-03-31 13:00 . 2005-08-25 23:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll

2012-03-31 13:00 . 2003-02-02 18:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll

2012-03-31 13:00 . 2002-03-05 23:00 75264 ----a-w- c:\windows\system32\unacev2.dll

2012-03-31 13:00 . 2012-04-06 15:19 -------- d-----w- c:\program files\Trojan Remover

2012-03-31 13:00 . 2012-03-31 13:00 -------- d-----w- c:\documents and settings\BenJ\Application Data\Simply Super Software

2012-03-31 13:00 . 2012-03-31 13:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software

2012-03-31 12:49 . 2012-03-31 12:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Fighters

2012-03-30 16:34 . 2012-04-06 14:15 -------- d-----w- c:\program files\PCSafeDoctor

2012-03-30 16:34 . 2010-12-30 08:54 34736 ----a-w- c:\windows\system32\drivers\RKHit-oud.sys

2012-03-17 14:23 . 2012-03-17 14:23 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll

2012-03-17 14:23 . 2012-03-17 14:23 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-04 14:56 . 2011-05-18 17:22 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-03-31 22:01 . 2010-04-23 12:42 472808 ----a-w- c:\windows\system32\deployJava1.dll

2012-03-31 22:01 . 2008-04-09 19:09 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-03-17 14:23 . 2011-04-01 12:16 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2010-07-28 1267024]

.

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]

[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-08-27 434960]

"EasyNoterLite352C328535FB488E0EFD1CE8CBB50357F8C6692A0F"="c:\program files\Art Plus\EasyNoter37LE\enlite.exe" [2006-03-26 1901568]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]

"Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 61952]

"PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2004-10-06 81920]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]

"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2012-01-17 2339168]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RkHit.sys]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"sdCoreService"=2 (0x2)

"sdAuxService"=2 (0x2)

"SolutoService"=3 (0x3)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\RM.exe"=

"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=

"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\umi.exe"=

"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=

"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=

"c:\\Documents and Settings\\BenJ\\Application Data\\Dropbox\\bin\\Dropbox.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:Remote Desktop

"65533:TCP"= 65533:TCP:Services

"52344:TCP"= 52344:TCP:Services

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13-9-2010 16:27 22992]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7-9-2010 3:48 32592]

R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [30-9-2010 8:21 56208]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7-9-2010 3:48 248656]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7-9-2010 3:49 297168]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [31-1-2012 16:02 7391072]

R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [8-2-2011 5:33 269520]

R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [9-4-2008 14:21 698368]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19-8-2010 21:42 134480]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19-8-2010 21:42 24144]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19-8-2010 21:42 27216]

R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [9-4-2008 16:47 1272000]

R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [9-4-2008 14:06 19928]

R3 xpsec;IPSEC-stuurprogramma;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4-4-2012 14:13 253600]

S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [9-4-2008 14:16 17408]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]

S4 !SASCORE;SAS Core Service;"l:\super anti spyware portable\SASCORE.EXE" --> l:\super anti spyware portable\SASCORE.EXE [?]

S4 ba0a9i.sys;ba0a9i.sys;\??\c:\windows\system32\drivers\ba0a9i.sys --> c:\windows\system32\drivers\ba0a9i.sys [?]

S4 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\68.tmp --> c:\windows\system32\68.tmp [?]

S4 msuswesd;Music Media Services;c:\windows\system32\msuswe.exe --> c:\windows\system32\msuswe.exe [?]

S4 RHDISK;RHDISK;\??\m:\rohos mini drive\Rohos\RHDISK.SYS --> m:\rohos mini drive\Rohos\RHDISK.SYS [?]

S4 SASDIFSV;SASDIFSV;\??\l:\super anti spyware portable\SASDIFSV.SYS --> l:\super anti spyware portable\SASDIFSV.SYS [?]

S4 SAS***IL;SAS***IL;\??\l:\super anti spyware portable\SAS***IL.SYS --> l:\super anti spyware portable\SAS***IL.SYS [?]

S4 VAD_DEV;Virtual Audio Service;c:\windows\system32\drivers\vad.sys --> c:\windows\system32\drivers\vad.sys [?]

S4 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm --> c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm [?]

.

Inhoud van de 'Gedeelde Taken' map

.

2012-04-06 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 14:56]

.

2012-04-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1123561945-725345543-1003UA.job

- c:\documents and settings\BenJ\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-13 21:46]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

mStart Page = hxxp://dutch.toggle.com/nl/index.php?rvs=google

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\program files\SpeedBit Video Accelerator\SBLSP.dll

Trusted Zone: musicmatch.com

Trusted Zone: musicmatch.com

TCP: DhcpNameServer = 192.168.1.1

DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://77.61.1.225/activex/AMC.cab

FF - ProfilePath - c:\documents and settings\BenJ\Application Data\Mozilla\Firefox\Profiles\4iaigd6o.default\

FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

.

- - - - ORPHANS VERWIJDERD - - - -

.

HKLM-Run-Cmaudio - cmicnfg.cpl

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - l:\super anti spyware portable\SASSEH.DLL

SafeBoot-SolutoService

AddRemove-Rohos_Rohos22_is1 - m:\rohos mini drive\Rohos\unins000.exe

AddRemove-{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} - l:\super anti spyware portable\Uninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-04-06 21:16

Windows 5.1.2600 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\68.tmp"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'lsass.exe'(1072)

c:\program files\SpeedBit Video Accelerator\SBLSP.dll

c:\program files\SpeedBit Video Accelerator\ConfigDB.dll

.

- - - - - - - > 'explorer.exe'(5064)

c:\windows\system32\tabhook.dll

c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

c:\program files\CyberLink\Shared Files\CLRCEngine.dll

c:\windows\system32\shdoclc.dll

c:\windows\system32\msi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\progra~1\AVG\AVG10\avgchsvx.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Sandboxie\SbieSvc.exe

c:\windows\System32\SCardSvr.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\system32\RunDll32.exe

c:\program files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Photodex\ProShowGold\ScsiAccess.exe

c:\windows\system32\Tablet.exe

c:\windows\system32\wdfmgr.exe

c:\program files\AVG\AVG10\avgnsx.exe

c:\windows\system32\wscntfy.exe

c:\progra~1\COMMON~1\X10\Common\x10nets.exe

c:\progra~1\AVG\AVG10\avgrsx.exe

c:\program files\AVG\AVG10\avgcsrvx.exe

.

**************************************************************************

.

Voltooingstijd: 2012-04-06 21:22:08 - machine werd herstart

ComboFix-quarantined-files.txt 2012-04-06 19:22

.

Pre-Run: 39.358.251.008 bytes beschikbaar

Post-Run: 39.250.776.064 bytes beschikbaar

.

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /bootlog

.

- - End Of File - - C6EF4944488D59A2D9B6F0361B2081B1

6 april 2012 aangepast door frouwipkus

[frouwipkus]

AVG gaf nu een melding dat C:\Combofix\CF3306.3xe een infectie had, heb hem in quarantaine laten plaatsen waarop AVG opnieuw ging starten, daarna kwam de melding dat 680 processen waren beeindigd, 31 bestanden waren verwijderd en 1 registersleutel. Ik ben benieuwd wat ik straks niet meer kan gebruiken...

Services.exe probeert nog steeds contact te maken. Ik heb nog niet verder virus gescand, ik stop nu eerst maar, ben erg moe geworden hier van.

[kape]

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\drivers\ba0a9i.sys

c:\windows\system32\68.tmp

Driver::

ba0a9i.sys

MEMSWEEP2

Sla dit bestand op je bureaublad op als CFScript.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

Download TDSSKiller en plaats het op je bureaublad.

Pak de bestanden in tdsskiller.zip uit.

Open de map tdsskiller en dubbelklik op TDSSKiller.exe om de tool te starten.

Windows 7 en Windows Vista gebruikers:

Rechtsklik op TDSSKiller.exe -> Uitvoeren als Administrator om de tool te starten.

Als TDSSKiller bericht geeft van een beschikbare update, dan voer je deze eerst uit.

Klik op de knop "Start Scan" en volg de instructies.

Wanneer de scan klaar is klik je op de knop "Report".

Er opent een kladblokbestand. Post de inhoud van dit bestand.

Herstart de pc als TDSSKiller die optie geeft. (Reboot now)

Wanneer er een herstart nodig was, vind je de logfile in C:\TDSSKiller.[Version]_[Date]_[Time]_log.txt

[frouwipkus]

Na het uitvoeren van ComboFix en herstarten liep de PC vast en na een half uur wachten heb ik hem zelf maar uit en weer aan gedaan. Hierbij het logfile van ComboFix van vanmorgen.

=========================================

ComboFix 12-04-06.02 - BenJ 07-04-2012 10:05:26.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.1023.316 [GMT 2:00]

Gestart vanuit: c:\documents and settings\BenJ\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\BenJ\Bureaublad\CFScript.txt

AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

FILE ::

"c:\windows\system32\68.tmp"

"c:\windows\system32\drivers\ba0a9i.sys"

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

Besmet exemplaar van c:\windows\system32\drivers\ntfs.sys werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\ERDNT\cache\ntfs.sys

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_BA0A9I.SYS

-------\Legacy_MEMSWEEP2

-------\Service_ba0a9i.sys

-------\Service_MEMSWEEP2

-------\Service_xcpip

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-03-07 to 2012-04-07 ))))))))))))))))))))))))))))))

.

.

2012-04-05 17:52 . 2012-04-06 10:47 -------- d-----w- c:\documents and settings\BenJ\Application Data\Dropbox

2012-04-05 14:04 . 2012-04-05 14:04 388096 ----a-r- c:\documents and settings\BenJ\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-04-04 14:56 . 2012-04-04 14:56 4125344 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2012-04-04 12:13 . 2012-04-04 14:56 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-04-04 09:29 . 2012-04-04 09:29 -------- d-----w- c:\windows\system32\LogFiles

2012-04-03 14:27 . 2003-08-26 09:16 344064 ----a-w- c:\windows\system32\msvcr70.dll

2012-04-03 14:12 . 2012-04-03 14:12 -------- d-----w- c:\documents and settings\LocalService\Application Data\X10 Commander

2012-04-03 13:58 . 1999-06-25 07:56 127184 ----a-w- c:\windows\Unwise.exe

2012-04-03 13:58 . 2012-04-03 13:58 -------- d-----w- c:\program files\Common Files\X10

2012-04-02 19:13 . 2004-08-13 14:38 140544 ----a-w- c:\windows\system32\drivers\rt2500usb.sys

2012-04-02 17:44 . 2001-11-23 09:08 712704 ----a-r- c:\windows\system32\Audio3D.dll

2012-03-31 19:46 . 2012-03-31 19:46 -------- d-----w- c:\documents and settings\LocalService\Bureaublad

2012-03-31 19:11 . 2012-03-31 19:11 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2012-03-31 19:08 . 2012-04-06 18:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2012-03-31 13:00 . 2006-06-19 11:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll

2012-03-31 13:00 . 2006-05-25 13:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll

2012-03-31 13:00 . 2005-08-25 23:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll

2012-03-31 13:00 . 2003-02-02 18:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll

2012-03-31 13:00 . 2002-03-05 23:00 75264 ----a-w- c:\windows\system32\unacev2.dll

2012-03-31 13:00 . 2012-04-06 15:19 -------- d-----w- c:\program files\Trojan Remover

2012-03-31 13:00 . 2012-03-31 13:00 -------- d-----w- c:\documents and settings\BenJ\Application Data\Simply Super Software

2012-03-31 13:00 . 2012-03-31 13:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software

2012-03-31 12:49 . 2012-03-31 12:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Fighters

2012-03-30 16:34 . 2012-04-06 14:15 -------- d-----w- c:\program files\PCSafeDoctor

2012-03-30 16:34 . 2010-12-30 08:54 34736 ----a-w- c:\windows\system32\drivers\RKHit-oud.sys

2012-03-17 14:23 . 2012-03-17 14:23 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll

2012-03-17 14:23 . 2012-03-17 14:23 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-04 14:56 . 2011-05-18 17:22 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-03-31 22:01 . 2010-04-23 12:42 472808 ----a-w- c:\windows\system32\deployJava1.dll

2012-03-31 22:01 . 2008-04-09 19:09 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-03-17 14:23 . 2011-04-01 12:16 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((( SnapShot@2012-04-06_19.13.49 )))))))))))))))))))))))))))))))))))))))))

.

+ 2012-04-07 08:42 . 2012-04-07 08:42 16384 c:\windows\Temp\Perflib_Perfdata_a38.dat

- 2008-12-02 10:07 . 2012-04-06 18:35 12362 c:\windows\system32\tablet.dat

+ 2008-12-02 10:07 . 2012-04-07 08:42 12362 c:\windows\system32\tablet.dat

+ 2001-09-07 12:00 . 2012-04-07 07:30 87068 c:\windows\system32\perfc013.dat

- 2001-09-07 12:00 . 2012-04-06 18:39 87068 c:\windows\system32\perfc013.dat

+ 2001-09-07 12:00 . 2012-04-07 07:30 68156 c:\windows\system32\perfc009.dat

- 2001-09-07 12:00 . 2012-04-06 18:39 68156 c:\windows\system32\perfc009.dat

+ 2001-09-07 12:00 . 2012-04-07 07:30 501868 c:\windows\system32\perfh013.dat

- 2001-09-07 12:00 . 2012-04-06 18:39 501868 c:\windows\system32\perfh013.dat

- 2001-09-07 12:00 . 2012-04-06 18:39 435260 c:\windows\system32\perfh009.dat

+ 2001-09-07 12:00 . 2012-04-07 07:30 435260 c:\windows\system32\perfh009.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2010-07-28 1267024]

.

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]

[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-08-27 434960]

"EasyNoterLite352C328535FB488E0EFD1CE8CBB50357F8C6692A0F"="c:\program files\Art Plus\EasyNoter37LE\enlite.exe" [2006-03-26 1901568]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]

"Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 61952]

"PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2004-10-06 81920]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]

"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2012-01-17 2339168]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RkHit.sys]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"sdCoreService"=2 (0x2)

"sdAuxService"=2 (0x2)

"SolutoService"=3 (0x3)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\RM.exe"=

"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=

"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\umi.exe"=

"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=

"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=

"c:\\Documents and Settings\\BenJ\\Application Data\\Dropbox\\bin\\Dropbox.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:Remote Desktop

"65533:TCP"= 65533:TCP:Services

"52344:TCP"= 52344:TCP:Services

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13-9-2010 16:27 22992]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7-9-2010 3:48 32592]

R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [30-9-2010 8:21 56208]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7-9-2010 3:48 248656]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7-9-2010 3:49 297168]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [31-1-2012 16:02 7391072]

R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [8-2-2011 5:33 269520]

R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [9-4-2008 14:21 698368]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19-8-2010 21:42 134480]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19-8-2010 21:42 24144]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19-8-2010 21:42 27216]

R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [9-4-2008 16:47 1272000]

R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [9-4-2008 14:06 19928]

R3 xpsec;IPSEC-stuurprogramma;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4-4-2012 14:13 253600]

S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [9-4-2008 14:16 17408]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]

S4 !SASCORE;SAS Core Service;"l:\super anti spyware portable\SASCORE.EXE" --> l:\super anti spyware portable\SASCORE.EXE [?]

S4 msuswesd;Music Media Services;c:\windows\system32\msuswe.exe --> c:\windows\system32\msuswe.exe [?]

S4 RHDISK;RHDISK;\??\m:\rohos mini drive\Rohos\RHDISK.SYS --> m:\rohos mini drive\Rohos\RHDISK.SYS [?]

S4 SASDIFSV;SASDIFSV;\??\l:\super anti spyware portable\SASDIFSV.SYS --> l:\super anti spyware portable\SASDIFSV.SYS [?]

S4 SAS***IL;SAS***IL;\??\l:\super anti spyware portable\SAS***IL.SYS --> l:\super anti spyware portable\SAS***IL.SYS [?]

S4 VAD_DEV;Virtual Audio Service;c:\windows\system32\drivers\vad.sys --> c:\windows\system32\drivers\vad.sys [?]

S4 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm --> c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm [?]

.

Inhoud van de 'Gedeelde Taken' map

.

2012-04-07 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 14:56]

.

2012-04-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1123561945-725345543-1003UA.job

- c:\documents and settings\BenJ\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-13 21:46]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

mStart Page = hxxp://dutch.toggle.com/nl/index.php?rvs=google

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\program files\SpeedBit Video Accelerator\SBLSP.dll

Trusted Zone: musicmatch.com

Trusted Zone: musicmatch.com

TCP: DhcpNameServer = 192.168.1.1

DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://77.61.1.225/activex/AMC.cab

FF - ProfilePath - c:\documents and settings\BenJ\Application Data\Mozilla\Firefox\Profiles\4iaigd6o.default\

FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-04-07 10:43

Windows 5.1.2600 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'lsass.exe'(1100)

c:\program files\SpeedBit Video Accelerator\SBLSP.dll

c:\program files\SpeedBit Video Accelerator\ConfigDB.dll

.

- - - - - - - > 'explorer.exe'(244)

c:\windows\system32\tabhook.dll

c:\documents and settings\BenJ\Application Data\Dropbox\bin\DropboxExt.14.dll

c:\program files\CyberLink\Shared Files\CLRCEngine.dll

c:\windows\system32\msi.dll

c:\windows\system32\shdoclc.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\progra~1\AVG\AVG10\avgchsvx.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Sandboxie\SbieSvc.exe

c:\windows\System32\SCardSvr.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Photodex\ProShowGold\ScsiAccess.exe

c:\windows\system32\Tablet.exe

c:\windows\system32\wdfmgr.exe

c:\program files\AVG\AVG10\avgnsx.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\RUNDLL32.EXE

c:\program files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

c:\progra~1\COMMON~1\X10\Common\x10nets.exe

c:\progra~1\AVG\AVG10\avgrsx.exe

c:\program files\AVG\AVG10\avgcsrvx.exe

.

**************************************************************************

.

Voltooingstijd: 2012-04-07 10:49:32 - machine werd herstart

ComboFix-quarantined-files.txt 2012-04-07 08:49

ComboFix2.txt 2012-04-06 19:22

.

Pre-Run: 39.218.954.240 bytes beschikbaar

Post-Run: 39.176.089.600 bytes beschikbaar

.

- - End Of File - - C66240AAFE341D883133E2887A43333D

=================================================

Daarna heb ik TDSSKiller uitgevoerd en er werd een rootkit gevonden. Nu lijkt mijn PC rustig, hij probeert niet steeds via services.exe contact te leggen met internet. Ik post hieronder het logfile van TDSSKiller, daarna ga ik even virusscannen, in eerste instantie doe ik het alleen voor C: om te zien of de dreiging van PSW.Agent.AUES weer tevoorschijn komt. IK ben allang blij dat services.exe zo rustig is.

=================================================

11:09:33.0781 3144 TDSS rootkit removing tool 2.7.26.0 Apr 4 2012 19:52:02

11:09:35.0781 3144 ============================================================

11:09:35.0781 3144 Current date / time: 2012/04/07 11:09:35.0781

11:09:35.0781 3144 SystemInfo:

11:09:35.0781 3144

11:09:35.0781 3144 OS Version: 5.1.2600 ServicePack: 2.0

11:09:35.0781 3144 Product type: Workstation

11:09:35.0781 3144 ComputerName: HISKE

11:09:35.0781 3144 UserName: BenJ

11:09:35.0781 3144 Windows directory: C:\WINDOWS

11:09:35.0781 3144 System windows directory: C:\WINDOWS

11:09:35.0781 3144 Processor architecture: Intel x86

11:09:35.0781 3144 Number of processors: 2

11:09:35.0781 3144 Page size: 0x1000

11:09:35.0781 3144 Boot type: Normal boot

11:09:35.0781 3144 ============================================================

11:09:37.0718 3144 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

11:09:37.0718 3144 Drive \Device\Harddisk1\DR4 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

11:09:37.0734 3144 \Device\Harddisk0\DR0:

11:09:37.0734 3144 MBR used

11:09:37.0734 3144 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x9C41AD8

11:09:37.0750 3144 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9C41B56, BlocksNum 0x9C41AD8

11:09:37.0765 3144 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1388366D, BlocksNum 0x993D053

11:09:37.0765 3144 \Device\Harddisk1\DR4:

11:09:37.0765 3144 MBR used

11:09:37.0765 3144 \Device\Harddisk1\DR4\Partition0: MBR, Type 0xB, StartLBA 0x3F, BlocksNum 0x1D1C4542

11:09:37.0890 3144 Initialize success

11:09:37.0890 3144 ============================================================

11:09:42.0125 4916 ============================================================

11:09:42.0125 4916 Scan started

11:09:42.0125 4916 Mode: Manual;

11:09:42.0125 4916 ============================================================

11:09:42.0937 4916 !SASCORE - ok

11:09:43.0218 4916 3xHybrid (1ea2cd0426ab053df019cdcff97a5cd8) C:\WINDOWS\system32\DRIVERS\3xHybrid.sys

11:09:43.0218 4916 3xHybrid - ok

11:09:43.0375 4916 Abiosdsk - ok

11:09:43.0515 4916 abp480n5 - ok

11:09:43.0562 4916 ACDaemon (61a581e5481e22a76a88490c57015105) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

11:09:43.0562 4916 ACDaemon - ok

11:09:43.0609 4916 ACPI (12139c5b5d7366e54ef3029c65b8ca97) C:\WINDOWS\system32\DRIVERS\ACPI.sys

11:09:43.0609 4916 ACPI - ok

11:09:43.0687 4916 ACPIEC (63f517b1a87dabf3f5acb8a7952fc1d1) C:\WINDOWS\system32\drivers\ACPIEC.sys

11:09:43.0687 4916 ACPIEC - ok

11:09:43.0750 4916 AdobeFlashPlayerUpdateSvc (0d4c486a24a711a45fd83acdf4d18506) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

11:09:43.0750 4916 AdobeFlashPlayerUpdateSvc - ok

11:09:43.0750 4916 adpu160m - ok

11:09:43.0812 4916 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys

11:09:43.0812 4916 aec - ok

11:09:43.0843 4916 AegisP (4b66e250c94c92522c33a759d5d273cb) C:\WINDOWS\system32\DRIVERS\AegisP.sys

11:09:43.0843 4916 AegisP - ok

11:09:43.0875 4916 Afc (a7b8a3a79d35215d798a300df49ed23f) C:\WINDOWS\system32\drivers\Afc.sys

11:09:43.0875 4916 Afc - ok

11:09:43.0906 4916 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys

11:09:43.0906 4916 AFD - ok

11:09:43.0906 4916 Aha154x - ok

11:09:43.0921 4916 aic78u2 - ok

11:09:43.0937 4916 aic78xx - ok

11:09:43.0953 4916 Alerter (c5ea8facbedbb459c93288b484a59379) C:\WINDOWS\system32\alrsvc.dll

11:09:43.0953 4916 Alerter - ok

11:09:43.0968 4916 ALG (15cff49392f765356ebbf05d87ffb6b2) C:\WINDOWS\System32\alg.exe

11:09:43.0968 4916 ALG - ok

11:09:43.0984 4916 AliIde - ok

11:09:44.0000 4916 amsint - ok

11:09:44.0031 4916 Apple Mobile Device (1961cb10bb48eb4d97e37db6373e9e63) C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

11:09:44.0031 4916 Apple Mobile Device - ok

11:09:44.0062 4916 AppMgmt (cc888653e0dec81b525b956c77960f88) C:\WINDOWS\System32\appmgmts.dll

11:09:44.0062 4916 AppMgmt - ok

11:09:44.0078 4916 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

11:09:44.0078 4916 Arp1394 - ok

11:09:44.0093 4916 asc - ok

11:09:44.0093 4916 asc3350p - ok

11:09:44.0109 4916 asc3550 - ok

11:09:44.0171 4916 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

11:09:44.0171 4916 aspnet_state - ok

11:09:44.0203 4916 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

11:09:44.0203 4916 AsyncMac - ok

11:09:44.0218 4916 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys

11:09:44.0218 4916 atapi - ok

11:09:44.0234 4916 Atdisk - ok

11:09:44.0250 4916 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

11:09:44.0250 4916 Atmarpc - ok

11:09:44.0265 4916 AudioSrv (d2aa479b238ff4cd0a5aa26afc1cbe8c) C:\WINDOWS\System32\audiosrv.dll

11:09:44.0265 4916 AudioSrv - ok

11:09:44.0296 4916 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

11:09:44.0312 4916 audstub - ok

11:09:44.0546 4916 AVGIDSAgent (7a0f6a3e0e41425b9ba54616b482668a) C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

11:09:44.0593 4916 AVGIDSAgent - ok

11:09:44.0625 4916 AVGIDSDriver (2d18221aab3db2d408d6c55c0f23090a) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys

11:09:44.0625 4916 AVGIDSDriver - ok

11:09:44.0656 4916 AVGIDSEH (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys

11:09:44.0656 4916 AVGIDSEH - ok

11:09:44.0703 4916 AVGIDSFilter (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys

11:09:44.0703 4916 AVGIDSFilter - ok

11:09:44.0843 4916 AVGIDSShim (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys

11:09:44.0843 4916 AVGIDSShim - ok

11:09:44.0906 4916 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys

11:09:44.0906 4916 Avgldx86 - ok

11:09:44.0906 4916 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys

11:09:44.0906 4916 Avgmfx86 - ok

11:09:44.0937 4916 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys

11:09:44.0937 4916 Avgrkx86 - ok

11:09:44.0968 4916 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys

11:09:44.0968 4916 Avgtdix - ok

11:09:45.0015 4916 avgwd (fc2bc51120a945f7c70376495e4e7737) C:\Program Files\AVG\AVG10\avgwdsvc.exe

11:09:45.0015 4916 avgwd - ok

11:09:45.0046 4916 BANTExt (5d7be7b19e827125e016325334e58ff1) C:\WINDOWS\System32\Drivers\BANTExt.sys

11:09:45.0078 4916 BANTExt - ok

11:09:45.0109 4916 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

11:09:45.0125 4916 Beep - ok

11:09:45.0171 4916 bgsvcgen (acc9c8c560c567fad6f79c977ab2ea09) C:\WINDOWS\system32\bgsvcgen.exe

11:09:45.0171 4916 bgsvcgen - ok

11:09:45.0203 4916 BITS (772027cc5ffaea3e7d10af2691ee7095) C:\WINDOWS\system32\qmgr.dll

11:09:45.0234 4916 BITS - ok

11:09:45.0265 4916 Browser (195b1255d9383aeffbdfa8a11ae4d282) C:\WINDOWS\System32\browser.dll

11:09:45.0265 4916 Browser - ok

11:09:45.0296 4916 CardReaderFilter (66b71dd7794d3b8a88ccb645896d3e53) C:\WINDOWS\system32\Drivers\USBCRFT.SYS

11:09:45.0312 4916 CardReaderFilter - ok

11:09:45.0312 4916 catchme - ok

11:09:45.0343 4916 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

11:09:45.0375 4916 cbidf2k - ok

11:09:45.0375 4916 cd20xrnt - ok

11:09:45.0406 4916 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

11:09:45.0406 4916 Cdaudio - ok

11:09:45.0437 4916 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys

11:09:45.0437 4916 Cdfs - ok

11:09:45.0468 4916 cdrbsdrv (e0042bd5bef17a6a3ef1df576bde24d1) C:\WINDOWS\system32\drivers\cdrbsdrv.sys

11:09:45.0500 4916 cdrbsdrv - ok

11:09:45.0531 4916 Cdrom (7b53584d94e9d8716b2de91d5f1cb42d) C:\WINDOWS\system32\DRIVERS\cdrom.sys

11:09:45.0531 4916 Cdrom - ok

11:09:45.0546 4916 Changer - ok

11:09:45.0562 4916 CiSvc (81700207389cbe1911a5eaee9fc812ce) C:\WINDOWS\system32\cisvc.exe

11:09:45.0562 4916 CiSvc - ok

11:09:45.0578 4916 ClipSrv (64d5673c075dd40e2f55387ee9b0cad7) C:\WINDOWS\system32\clipsrv.exe

11:09:45.0578 4916 ClipSrv - ok

11:09:45.0625 4916 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

11:09:45.0656 4916 clr_optimization_v2.0.50727_32 - ok

11:09:45.0656 4916 CmdIde - ok

11:09:45.0734 4916 cmudax (53c90d77476edd52b3abafca8d5d01db) C:\WINDOWS\system32\drivers\cmudax.sys

11:09:45.0734 4916 cmudax - ok

11:09:45.0765 4916 COMSysApp - ok

11:09:45.0781 4916 Cpqarray - ok

11:09:45.0859 4916 CryptSvc (5f321535d399516b6d780ff9ef8d8b7a) C:\WINDOWS\System32\cryptsvc.dll

11:09:45.0859 4916 CryptSvc - ok

11:09:45.0921 4916 dac2w2k - ok

11:09:45.0937 4916 dac960nt - ok

11:09:45.0968 4916 DcomLaunch (dde0457b7706c3ad4e5afdd502698a06) C:\WINDOWS\system32\rpcss.dll

11:09:45.0968 4916 DcomLaunch - ok

11:09:46.0000 4916 Dhcp (d9b43e85b246711585844a43fb50ffd8) C:\WINDOWS\System32\dhcpcsvc.dll

11:09:46.0000 4916 Dhcp - ok

11:09:46.0031 4916 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys

11:09:46.0031 4916 Disk - ok

11:09:46.0046 4916 dmadmin - ok

11:09:46.0109 4916 dmboot (d9542b70560cda5c4f5e62b1eed412cd) C:\WINDOWS\system32\drivers\dmboot.sys

11:09:46.0109 4916 dmboot - ok

11:09:46.0140 4916 dmio (b5f7ac6bb9445e9c59e0686fe52a47e8) C:\WINDOWS\system32\drivers\dmio.sys

11:09:46.0140 4916 dmio - ok

11:09:46.0156 4916 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

11:09:46.0156 4916 dmload - ok

11:09:46.0187 4916 dmserver (da7063647c9260e4cbeb6bdb648603be) C:\WINDOWS\System32\dmserver.dll

11:09:46.0187 4916 dmserver - ok

11:09:46.0203 4916 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys

11:09:46.0203 4916 DMusic - ok

11:09:46.0218 4916 Dnscache (57084f6eb6ec1951aa9b5b2b5eeb8e8b) C:\WINDOWS\System32\dnsrslvr.dll

11:09:46.0234 4916 Dnscache - ok

11:09:46.0234 4916 dpti2o - ok

11:09:46.0265 4916 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys

11:09:46.0265 4916 drmkaud - ok

11:09:46.0265 4916 ERSvc (ec0f2b78c2e10f3b2a4a83022af03030) C:\WINDOWS\System32\ersvc.dll

11:09:46.0265 4916 ERSvc - ok

11:09:46.0296 4916 Eventlog (39991cd3c17b7529d039151a88e84499) C:\WINDOWS\system32\services.exe

11:09:46.0296 4916 Eventlog - ok

11:09:46.0312 4916 EventSystem (3f59bcdfac47550f43001c4ce8cb0b91) C:\WINDOWS\system32\es.dll

11:09:46.0312 4916 EventSystem - ok

11:09:46.0328 4916 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys

11:09:46.0328 4916 Fastfat - ok

11:09:46.0343 4916 FastUserSwitchingCompatibility (394fd6ce1ac84bb318b806a6f8d90f66) C:\WINDOWS\System32\shsvcs.dll

11:09:46.0343 4916 FastUserSwitchingCompatibility - ok

11:09:46.0375 4916 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys

11:09:46.0375 4916 Fdc - ok

11:09:46.0406 4916 FETNDISB (29063004926b225c417e7147822f5866) C:\WINDOWS\system32\DRIVERS\fetnd5b.sys

11:09:46.0406 4916 FETNDISB - ok

11:09:46.0421 4916 Fips (dac8cab287a959c2f717d3748177374b) C:\WINDOWS\system32\drivers\Fips.sys

11:09:46.0437 4916 Fips - ok

11:09:46.0468 4916 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

11:09:46.0468 4916 Flpydisk - ok

11:09:46.0500 4916 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\DRIVERS\fltMgr.sys

11:09:46.0500 4916 FltMgr - ok

11:09:46.0578 4916 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

11:09:46.0578 4916 FontCache3.0.0.0 - ok

11:09:46.0593 4916 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

11:09:46.0609 4916 Fs_Rec - ok

11:09:46.0640 4916 Ftdisk (fa8ca22e70245c81ff29c36af56292fc) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

11:09:46.0640 4916 Ftdisk - ok

11:09:46.0687 4916 GEARAspiWDM (5dc17164f66380cbfefd895c18467773) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys

11:09:46.0687 4916 GEARAspiWDM - ok

11:09:46.0703 4916 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys

11:09:46.0703 4916 Gpc - ok

11:09:46.0734 4916 HdAudAddService (160b24fd894e79e71c983ea403a6e6e7) C:\WINDOWS\system32\drivers\HdAudio.sys

11:09:46.0734 4916 HdAudAddService - ok

11:09:46.0750 4916 HDAudBus (cbbb304dc69e0b56f789852f6455f7ec) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

11:09:46.0750 4916 HDAudBus - ok

11:09:46.0781 4916 helpsvc (3f658987c756abfa3384bc830f6c4e21) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

11:09:46.0781 4916 helpsvc - ok

11:09:46.0812 4916 HidServ (229574a46459152c9c20942ac5172335) C:\WINDOWS\System32\hidserv.dll

11:09:46.0812 4916 HidServ - ok

11:09:46.0843 4916 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys

11:09:46.0843 4916 HidUsb - ok

11:09:46.0875 4916 hotcore3 (39ae0be51f51a660ce2b14af9be8548f) C:\WINDOWS\system32\DRIVERS\hotcore3.sys

11:09:46.0875 4916 hotcore3 - ok

11:09:46.0890 4916 hpn - ok

11:09:46.0953 4916 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys

11:09:46.0968 4916 HTTP - ok

11:09:47.0015 4916 HTTPFilter (930a625a3ce2ccbf309ccf02c1f7053d) C:\WINDOWS\System32\w3ssl.dll

11:09:47.0015 4916 HTTPFilter - ok

11:09:47.0031 4916 i2omgmt - ok

11:09:47.0046 4916 i2omp - ok

11:09:47.0078 4916 i8042prt (ddb567b5fe32d917a34b98de50b3c923) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

11:09:47.0078 4916 i8042prt - ok

11:09:47.0187 4916 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

11:09:47.0187 4916 idsvc - ok

11:09:47.0218 4916 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys

11:09:47.0218 4916 Imapi - ok

11:09:47.0234 4916 ImapiService (f85149aa4afea9200484715cf15f568d) C:\WINDOWS\system32\imapi.exe

11:09:47.0234 4916 ImapiService - ok

11:09:47.0250 4916 ini910u - ok

11:09:47.0281 4916 IntelIde (133b243ee5ccc607686a5648b807542d) C:\WINDOWS\system32\DRIVERS\intelide.sys

11:09:47.0281 4916 IntelIde - ok

11:09:47.0312 4916 intelppm (17f6ae3cb6b478c6054e2e894a6d89bf) C:\WINDOWS\system32\DRIVERS\intelppm.sys

11:09:47.0312 4916 intelppm - ok

11:09:47.0343 4916 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

11:09:47.0343 4916 Ip6Fw - ok

11:09:47.0390 4916 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

11:09:47.0390 4916 IpFilterDriver - ok

11:09:47.0406 4916 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys

11:09:47.0406 4916 IpInIp - ok

11:09:47.0437 4916 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys

11:09:47.0437 4916 IpNat - ok

11:09:47.0484 4916 iPod Service (1cb96e83fd76eb5580451cef29e24303) C:\Program Files\iPod\bin\iPodService.exe

11:09:47.0500 4916 iPod Service - ok

11:09:47.0531 4916 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys

11:09:47.0531 4916 IPSec - ok

11:09:47.0578 4916 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys

11:09:47.0578 4916 IRENUM - ok

11:09:47.0593 4916 isapnp (fd298ad13acb19fc43b627aca0806231) C:\WINDOWS\system32\DRIVERS\isapnp.sys

11:09:47.0593 4916 isapnp - ok

11:09:47.0640 4916 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe

11:09:47.0640 4916 JavaQuickStarterService - ok

11:09:47.0671 4916 Kbdclass (59549e9180ce29d832289e1a1d9e3c60) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

11:09:47.0671 4916 Kbdclass - ok

11:09:47.0703 4916 kbdhid (6b97674104b15a2dd135f7b365223194) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

11:09:47.0718 4916 kbdhid - ok

11:09:47.0734 4916 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys

11:09:47.0750 4916 kmixer - ok

11:09:47.0750 4916 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys

11:09:47.0781 4916 KSecDD - ok

11:09:47.0812 4916 lanmanserver (95f1d37de9aa1432968f7266bc853f4f) C:\WINDOWS\System32\srvsvc.dll

11:09:47.0812 4916 lanmanserver - ok

11:09:47.0828 4916 lanmanworkstation (645df1092f6fd164b89b03c8d763dd1a) C:\WINDOWS\System32\wkssvc.dll

11:09:47.0828 4916 lanmanworkstation - ok

11:09:47.0859 4916 Lavasoft Kernexplorer - ok

11:09:47.0859 4916 lbrtfdc - ok

11:09:47.0890 4916 LmHosts (a3a959d256c4bc662f6a29c4809cd583) C:\WINDOWS\System32\lmhsvc.dll

11:09:47.0890 4916 LmHosts - ok

11:09:47.0921 4916 MarvinBus (a3e700d78eec390f1208098cdca5c6b6) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys

11:09:47.0921 4916 MarvinBus - ok

11:09:47.0937 4916 Messenger (1405b1431f51cab25fe9b2ecf13cb198) C:\WINDOWS\System32\msgsvc.dll

11:09:47.0937 4916 Messenger - ok

11:09:47.0968 4916 Microsoft Office Groove Audit Service (fafe367d032ed82e9332b4c741a20216) C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

11:09:47.0968 4916 Microsoft Office Groove Audit Service - ok

11:09:48.0000 4916 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

11:09:48.0015 4916 mnmdd - ok

11:09:48.0093 4916 mnmsrvc (8ca3298ee96d6b75f28c991518dc2dd9) C:\WINDOWS\system32\mnmsrvc.exe

11:09:48.0093 4916 mnmsrvc - ok

11:09:48.0125 4916 Modem (7151be7fe5bd6671bf8ab745c419a42e) C:\WINDOWS\system32\drivers\Modem.sys

11:09:48.0140 4916 Modem - ok

11:09:48.0171 4916 Mouclass (0ff36ca1ac0b7d2e46c291d30b516df1) C:\WINDOWS\system32\DRIVERS\mouclass.sys

11:09:48.0171 4916 Mouclass - ok

11:09:48.0203 4916 mouhid (18017899254e01371e1a39754d6bf98c) C:\WINDOWS\system32\DRIVERS\mouhid.sys

11:09:48.0203 4916 mouhid - ok

11:09:48.0281 4916 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys

11:09:48.0281 4916 MountMgr - ok

11:09:48.0359 4916 MPE (55a9a7e6bb297bf0f5b144029dcb79cc) C:\WINDOWS\system32\DRIVERS\MPE.sys

11:09:48.0359 4916 MPE - ok

11:09:48.0375 4916 mraid35x - ok

11:09:48.0390 4916 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

11:09:48.0390 4916 MRxDAV - ok

11:09:48.0421 4916 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

11:09:48.0421 4916 MRxSmb - ok

11:09:48.0468 4916 MSDTC (aefd24aa5703407480527c395ee07565) C:\WINDOWS\system32\msdtc.exe

11:09:48.0468 4916 MSDTC - ok

11:09:48.0484 4916 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys

11:09:48.0484 4916 Msfs - ok

11:09:48.0484 4916 MSIServer - ok

11:09:48.0515 4916 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys

11:09:48.0515 4916 MSKSSRV - ok

11:09:48.0531 4916 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

11:09:48.0531 4916 MSPCLOCK - ok

11:09:48.0562 4916 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys

11:09:48.0562 4916 MSPQM - ok

11:09:48.0593 4916 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

11:09:48.0593 4916 mssmbios - ok

11:09:48.0609 4916 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys

11:09:48.0609 4916 MSTEE - ok

11:09:48.0625 4916 msuswesd - ok

11:09:48.0640 4916 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys

11:09:48.0671 4916 Mup - ok

11:09:48.0703 4916 MxlW2k (a1520761f42dbb06db7929d6fa9753ea) C:\WINDOWS\system32\drivers\MxlW2k.sys

11:09:48.0750 4916 MxlW2k - ok

11:09:48.0765 4916 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

11:09:48.0765 4916 NABTSFEC - ok

11:09:48.0796 4916 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys

11:09:48.0796 4916 NDIS - ok

11:09:48.0828 4916 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

11:09:48.0828 4916 NdisIP - ok

11:09:48.0843 4916 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

11:09:48.0843 4916 NdisTapi - ok

11:09:48.0875 4916 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

11:09:48.0875 4916 Ndisuio - ok

11:09:48.0875 4916 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

11:09:48.0875 4916 NdisWan - ok

11:09:48.0906 4916 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys

11:09:48.0906 4916 NDProxy - ok

11:09:48.0937 4916 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys

11:09:48.0937 4916 NetBIOS - ok

11:09:48.0968 4916 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys

11:09:48.0968 4916 NetBT - ok

11:09:49.0000 4916 NetDDE (7e61d52d2d9259c63dfb6c156719d3b4) C:\WINDOWS\system32\netdde.exe

11:09:49.0000 4916 NetDDE - ok

11:09:49.0000 4916 NetDDEdsdm (7e61d52d2d9259c63dfb6c156719d3b4) C:\WINDOWS\system32\netdde.exe

11:09:49.0015 4916 NetDDEdsdm - ok

11:09:49.0031 4916 Netlogon (34a82debefb057fcccbe15f619fc98a7) C:\WINDOWS\system32\lsass.exe

11:09:49.0031 4916 Netlogon - ok

11:09:49.0046 4916 Netman (b2665a1b502ec037388b7919cbd58c28) C:\WINDOWS\System32\netman.dll

11:09:49.0046 4916 Netman - ok

11:09:49.0218 4916 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

11:09:49.0218 4916 NetTcpPortSharing - ok

11:09:49.0234 4916 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys

11:09:49.0234 4916 NIC1394 - ok

11:09:49.0265 4916 Nla (0c53db0671ab5a93d169daffc8da11cf) C:\WINDOWS\System32\mswsock.dll

11:09:49.0265 4916 Nla - ok

11:09:49.0281 4916 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys

11:09:49.0281 4916 Npfs - ok

11:09:49.0328 4916 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys

11:09:49.0421 4916 Ntfs - ok

11:09:49.0500 4916 NtLmSsp (34a82debefb057fcccbe15f619fc98a7) C:\WINDOWS\system32\lsass.exe

11:09:49.0515 4916 NtLmSsp - ok

11:09:49.0562 4916 NtmsSvc (ac75e028773cbbd7d8b1313f382e7c05) C:\WINDOWS\system32\ntmssvc.dll

11:09:49.0562 4916 NtmsSvc - ok

11:09:49.0593 4916 NTSIM (4d3eb5a8021af05c7fe5f313443a533b) C:\WINDOWS\system32\ntsim.sys

11:09:49.0593 4916 NTSIM - ok

11:09:49.0640 4916 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

11:09:49.0640 4916 Null - ok

11:09:49.0937 4916 nv (30913cbf518396912e54c2c9f1dd0f09) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

11:09:50.0000 4916 nv - ok

11:09:50.0031 4916 NVSvc (c0204c1a7a2d2433d48f49e4ecc09ab6) C:\WINDOWS\system32\nvsvc32.exe

11:09:50.0031 4916 NVSvc - ok

11:09:50.0062 4916 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

11:09:50.0062 4916 NwlnkFlt - ok

11:09:50.0078 4916 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

11:09:50.0078 4916 NwlnkFwd - ok

11:09:50.0171 4916 odserv (84de1dd996b48b05ace31ad015fa108a) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

11:09:50.0171 4916 odserv - ok

11:09:50.0203 4916 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

11:09:50.0203 4916 ohci1394 - ok

11:09:50.0296 4916 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

11:09:50.0296 4916 ose - ok

11:09:50.0328 4916 Parport (83a120f43a1424d9c51701fd91d3bc8e) C:\WINDOWS\system32\DRIVERS\parport.sys

11:09:50.0328 4916 Parport - ok

11:09:50.0359 4916 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys

11:09:50.0359 4916 PartMgr - ok

11:09:50.0375 4916 ParVdm (1eade28746a64c21e0a808bb12a63326) C:\WINDOWS\system32\drivers\ParVdm.sys

11:09:50.0375 4916 ParVdm - ok

11:09:50.0390 4916 PCI (3060407163c2daf8b0dbc878c3052cf0) C:\WINDOWS\system32\DRIVERS\pci.sys

11:09:50.0390 4916 PCI - ok

11:09:50.0406 4916 PCIDump - ok

11:09:50.0406 4916 PCIIde (b31edeba4da28283f6b8dc4756fb9585) C:\WINDOWS\system32\drivers\PCIIde.sys

11:09:50.0421 4916 PCIIde - ok

11:09:50.0468 4916 Pcmcia (8673108cad88d629ba0f7758ec5b1924) C:\WINDOWS\system32\drivers\Pcmcia.sys

11:09:50.0468 4916 Pcmcia - ok

11:09:50.0484 4916 PDCOMP - ok

11:09:50.0500 4916 PDFRAME - ok

11:09:50.0500 4916 PDRELI - ok

11:09:50.0515 4916 PDRFRAME - ok

11:09:50.0531 4916 PenClass (4a108cc9cc0e0605e68cce7021479879) C:\WINDOWS\system32\drivers\PenClass.sys

11:09:50.0531 4916 PenClass - ok

11:09:50.0546 4916 perc2 - ok

11:09:50.0562 4916 perc2hib - ok

11:09:50.0593 4916 pfc (444f122e68db44c0589227781f3c8b3f) C:\WINDOWS\system32\drivers\pfc.sys

11:09:50.0593 4916 pfc - ok

11:09:50.0609 4916 PlugPlay (39991cd3c17b7529d039151a88e84499) C:\WINDOWS\system32\services.exe

11:09:50.0609 4916 PlugPlay - ok

11:09:50.0625 4916 PolicyAgent (34a82debefb057fcccbe15f619fc98a7) C:\WINDOWS\system32\lsass.exe

11:09:50.0640 4916 PolicyAgent - ok

11:09:50.0656 4916 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys

11:09:50.0656 4916 PptpMiniport - ok

11:09:50.0656 4916 ProtectedStorage (34a82debefb057fcccbe15f619fc98a7) C:\WINDOWS\system32\lsass.exe

11:09:50.0656 4916 ProtectedStorage - ok

11:09:50.0671 4916 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys

11:09:50.0671 4916 PSched - ok

11:09:50.0687 4916 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

11:09:50.0703 4916 Ptilink - ok

11:09:50.0718 4916 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys

11:09:50.0718 4916 PxHelp20 - ok

11:09:50.0734 4916 ql1080 - ok

11:09:50.0750 4916 Ql10wnt - ok

11:09:50.0750 4916 ql12160 - ok

11:09:50.0765 4916 ql1240 - ok

11:09:50.0781 4916 ql1280 - ok

11:09:50.0796 4916 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

11:09:50.0796 4916 RasAcd - ok

11:09:50.0828 4916 RasAuto (8e033b9d88fcdd9fcbd1ed74a2e4cec7) C:\WINDOWS\System32\rasauto.dll

11:09:50.0828 4916 RasAuto - ok

11:09:50.0875 4916 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

11:09:50.0875 4916 Rasl2tp - ok

11:09:50.0890 4916 RasMan (c5009c76c4bb3cf7a65c4c228c96845f) C:\WINDOWS\System32\rasmans.dll

11:09:50.0890 4916 RasMan - ok

11:09:50.0906 4916 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

11:09:50.0906 4916 RasPppoe - ok

11:09:50.0921 4916 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

11:09:50.0921 4916 Raspti - ok

11:09:50.0937 4916 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys

11:09:50.0953 4916 Rdbss - ok

11:09:50.0953 4916 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

11:09:50.0953 4916 RDPCDD - ok

11:09:50.0984 4916 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

11:09:50.0984 4916 rdpdr - ok

11:09:51.0000 4916 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys

11:09:51.0015 4916 RDPWD - ok

11:09:51.0031 4916 RDSessMgr (a81b92d6ae9f0433b14a54dbf63a1ff3) C:\WINDOWS\system32\sessmgr.exe

11:09:51.0031 4916 RDSessMgr - ok

11:09:51.0046 4916 redbook (7bb9c58a13323f5edc89c88f98c80cba) C:\WINDOWS\system32\DRIVERS\redbook.sys

11:09:51.0062 4916 redbook - ok

11:09:51.0093 4916 RemoteAccess (bf6297975d92b0950783034257961544) C:\WINDOWS\System32\mprdim.dll

11:09:51.0093 4916 RemoteAccess - ok

11:09:51.0125 4916 RemoteRegistry (d01bb100558945178e4bcb33b0fe9364) C:\WINDOWS\system32\regsvc.dll

11:09:51.0125 4916 RemoteRegistry - ok

11:09:51.0125 4916 RHDISK - ok

11:09:51.0156 4916 RpcLocator (69b970645e78c1ed5fa7caf34a1a13e6) C:\WINDOWS\system32\locator.exe

11:09:51.0156 4916 RpcLocator - ok

11:09:51.0171 4916 RpcSs (dde0457b7706c3ad4e5afdd502698a06) C:\WINDOWS\System32\rpcss.dll

11:09:51.0187 4916 RpcSs - ok

11:09:51.0218 4916 RSVP (ad1b5f1b99fff08c99f443d784711a81) C:\WINDOWS\system32\rsvp.exe

11:09:51.0218 4916 RSVP - ok

11:09:51.0265 4916 RT2500USB (6f6ce24f243458c92b54e0016ad46bd7) C:\WINDOWS\system32\DRIVERS\rt2500usb.sys

11:09:51.0265 4916 RT2500USB - ok

11:09:51.0296 4916 SamSs (34a82debefb057fcccbe15f619fc98a7) C:\WINDOWS\system32\lsass.exe

11:09:51.0296 4916 SamSs - ok

11:09:51.0296 4916 SASDIFSV - ok

11:09:51.0296 4916 SAS***IL - ok

11:09:51.0421 4916 SbieDrv (a4aac62e6c1a5a56ae41b6c0570ab68b) C:\Program Files\Sandboxie\SbieDrv.sys

11:09:51.0453 4916 SbieDrv - ok

11:09:51.0484 4916 SbieSvc (9581517ef4b3e6f84b6cfd503a0178c4) C:\Program Files\Sandboxie\SbieSvc.exe

11:09:51.0484 4916 SbieSvc - ok

11:09:51.0515 4916 SCardSvr (11344a685293c0a5d228de5381cd9e5d) C:\WINDOWS\System32\SCardSvr.exe

11:09:51.0515 4916 SCardSvr - ok

11:09:51.0562 4916 Schedule (d245b3e32f8ab3b2fb576afcfdec105e) C:\WINDOWS\system32\schedsvc.dll

11:09:51.0562 4916 Schedule - ok

11:09:51.0625 4916 ScsiAccess (958e956e119eb7b9aba142afed1b5ff4) C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe

11:09:51.0625 4916 ScsiAccess - ok

11:09:51.0640 4916 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys

11:09:51.0640 4916 Secdrv - ok

11:09:51.0671 4916 seclogon (2d5122859174871c07e8f4640884afbf) C:\WINDOWS\System32\seclogon.dll

11:09:51.0671 4916 seclogon - ok

11:09:51.0687 4916 SENS (08c43746105e0c231ed2ac620c2f0f86) C:\WINDOWS\system32\sens.dll

11:09:51.0687 4916 SENS - ok

11:09:51.0718 4916 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys

11:09:51.0718 4916 serenum - ok

11:09:51.0734 4916 Serial (97e86d03d082d369cb025113b4b7b781) C:\WINDOWS\system32\DRIVERS\serial.sys

11:09:51.0734 4916 Serial - ok

11:09:51.0781 4916 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\DRIVERS\sfloppy.sys

11:09:51.0781 4916 Sfloppy - ok

11:09:51.0828 4916 SharedAccess (34f401e1756261320b16d42900a70163) C:\WINDOWS\System32\ipnathlp.dll

11:09:51.0828 4916 SharedAccess - ok

11:09:51.0843 4916 ShellHWDetection (394fd6ce1ac84bb318b806a6f8d90f66) C:\WINDOWS\System32\shsvcs.dll

11:09:51.0843 4916 ShellHWDetection - ok

11:09:51.0859 4916 Simbad - ok

11:09:51.0890 4916 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys

11:09:51.0890 4916 SLIP - ok

11:09:51.0906 4916 Sparrow - ok

11:09:51.0921 4916 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys

11:09:51.0921 4916 splitter - ok

11:09:51.0953 4916 Spooler (cccb8b94b17466efb9dc27f42625b0e5) C:\WINDOWS\system32\spoolsv.exe

11:09:51.0953 4916 Spooler - ok

11:09:51.0984 4916 sr (a859c2da6b06024c9b4d995b90fe8175) C:\WINDOWS\system32\DRIVERS\sr.sys

11:09:51.0984 4916 sr - ok

11:09:52.0031 4916 srescan (bb1cc49b817d2551eb321f4a9afb7d8c) C:\WINDOWS\system32\ZoneLabs\srescan.sys

11:09:52.0031 4916 srescan - ok

11:09:52.0046 4916 srservice (0b96a1e4252f663222c9c3bac89f596c) C:\WINDOWS\system32\srsvc.dll

11:09:52.0062 4916 srservice - ok

11:09:52.0078 4916 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys

11:09:52.0078 4916 Srv - ok

11:09:52.0093 4916 SSDPSRV (b02fdce64f64cde3aa809d28d25d2a12) C:\WINDOWS\System32\ssdpsrv.dll

11:09:52.0109 4916 SSDPSRV - ok

11:09:52.0125 4916 stisvc (a52aa02ddb663fef22c18c693b0ee891) C:\WINDOWS\system32\wiaservc.dll

11:09:52.0140 4916 stisvc - ok

11:09:52.0171 4916 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

11:09:52.0171 4916 streamip - ok

11:09:52.0203 4916 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys

11:09:52.0203 4916 swenum - ok

11:09:52.0218 4916 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys

11:09:52.0234 4916 swmidi - ok

11:09:52.0234 4916 SwPrv - ok

11:09:52.0250 4916 symc810 - ok

11:09:52.0265 4916 symc8xx - ok

11:09:52.0265 4916 sym_hi - ok

11:09:52.0281 4916 sym_u3 - ok

11:09:52.0296 4916 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys

11:09:52.0296 4916 sysaudio - ok

11:09:52.0328 4916 SysmonLog (c4d7d00c5ea67a557c95c44e3a226bad) C:\WINDOWS\system32\smlogsvc.exe

11:09:52.0328 4916 SysmonLog - ok

11:09:52.0375 4916 TabletService (c48b9fd7e18b524ca76fffa7d809d3bb) C:\WINDOWS\system32\Tablet.exe

11:09:52.0390 4916 TabletService - ok

11:09:52.0484 4916 TapiSrv (f38c48ee55ad051bf5474f5bdd69c846) C:\WINDOWS\System32\tapisrv.dll

11:09:52.0484 4916 TapiSrv - ok

11:09:52.0531 4916 Tcpip (9f4b36614a0fc234525ba224957de55c) C:\WINDOWS\system32\DRIVERS\tcpip.sys

11:09:52.0531 4916 Tcpip - ok

11:09:52.0562 4916 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys

11:09:52.0578 4916 TDPIPE - ok

11:09:52.0609 4916 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys

11:09:52.0625 4916 TDTCP - ok

11:09:52.0656 4916 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys

11:09:52.0656 4916 TermDD - ok

11:09:52.0687 4916 TermService (e2ce999886a4636026f157deb886aa94) C:\WINDOWS\System32\termsrv.dll

11:09:52.0703 4916 TermService - ok

11:09:52.0718 4916 Themes (394fd6ce1ac84bb318b806a6f8d90f66) C:\WINDOWS\System32\shsvcs.dll

11:09:52.0718 4916 Themes - ok

11:09:52.0734 4916 TlntSvr (bbc15c8d711d558fb5baccb3c922feac) C:\WINDOWS\system32\tlntsvr.exe

11:09:52.0734 4916 TlntSvr - ok

11:09:52.0750 4916 TosIde - ok

11:09:52.0781 4916 TPkd (003058d77dd952b872cc0f8e14cf3bc5) C:\WINDOWS\system32\drivers\TPkd.sys

11:09:52.0828 4916 TPkd - ok

11:09:52.0859 4916 TrkWks (e6ebf15491c5f80c55da23821a75c9dd) C:\WINDOWS\system32\trkwks.dll

11:09:52.0859 4916 TrkWks - ok

11:09:52.0890 4916 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys

11:09:52.0906 4916 Udfs - ok

11:09:52.0937 4916 UimBus (e0e3268453c3d4ed68a632099482b543) C:\WINDOWS\system32\DRIVERS\UimBus.sys

11:09:52.0937 4916 UimBus - ok

11:09:52.0968 4916 Uim_IM (71fc84677af3f6416338b14efe02ddd7) C:\WINDOWS\system32\Drivers\Uim_IM.sys

11:09:52.0968 4916 Uim_IM - ok

11:09:52.0968 4916 ultra - ok

11:09:53.0000 4916 UMWdf (ab0a7ca90d9e3d6a193905dc1715ded0) C:\WINDOWS\system32\wdfmgr.exe

11:09:53.0015 4916 UMWdf - ok

11:09:53.0031 4916 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys

11:09:53.0031 4916 Update - ok

11:09:53.0062 4916 upnphost (348b60067b10efa7d7763ee44674108c) C:\WINDOWS\System32\upnphost.dll

11:09:53.0062 4916 upnphost - ok

11:09:53.0078 4916 UPS (5124d4054c62991a65d616f202965740) C:\WINDOWS\System32\ups.exe

11:09:53.0093 4916 UPS - ok

11:09:53.0125 4916 USBAAPL (f340199e8cb097e1acd58a967c665919) C:\WINDOWS\system32\Drivers\usbaapl.sys

11:09:53.0125 4916 USBAAPL - ok

11:09:53.0156 4916 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys

11:09:53.0156 4916 usbaudio - ok

11:09:53.0171 4916 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

11:09:53.0171 4916 usbccgp - ok

11:09:53.0203 4916 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys

11:09:53.0203 4916 usbehci - ok

11:09:53.0218 4916 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys

11:09:53.0218 4916 usbhub - ok

11:09:53.0250 4916 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys

11:09:53.0250 4916 usbprint - ok

11:09:53.0281 4916 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys

11:09:53.0281 4916 usbscan - ok

11:09:53.0296 4916 usbstor (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

11:09:53.0296 4916 usbstor - ok

11:09:53.0312 4916 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

11:09:53.0312 4916 usbuhci - ok

11:09:53.0328 4916 VAD_DEV - ok

11:09:53.0343 4916 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys

11:09:53.0359 4916 VgaSave - ok

11:09:53.0359 4916 ViaIde - ok

11:09:53.0406 4916 VideoAcceleratorService - ok

11:09:53.0421 4916 VolSnap (4d90d2768b7d0902b011bf6707b10423) C:\WINDOWS\system32\drivers\VolSnap.sys

11:09:53.0453 4916 VolSnap - ok

11:09:53.0531 4916 vsdatant (13a225a31f8d64a395373e9434d2d1ab) C:\WINDOWS\system32\vsdatant.sys

11:09:53.0531 4916 vsdatant - ok

11:09:53.0562 4916 vsmon - ok

11:09:53.0593 4916 VSS (faec7a09c545a16b7534ff57cc8e2a4a) C:\WINDOWS\System32\vssvc.exe

11:09:53.0593 4916 VSS - ok

11:09:53.0625 4916 W32Time (ef361e7a6319c445c21c81a131cf1f99) C:\WINDOWS\system32\w32time.dll

11:09:53.0625 4916 W32Time - ok

11:09:53.0656 4916 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys

11:09:53.0656 4916 Wanarp - ok

11:09:53.0687 4916 wbscr (67014473f902f3023f892c3a0950958a) C:\WINDOWS\system32\drivers\wbscr.sys

11:09:53.0687 4916 wbscr - ok

11:09:53.0703 4916 WDICA - ok

11:09:53.0734 4916 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys

11:09:53.0734 4916 wdmaud - ok

11:09:53.0765 4916 WebClient (79c65680b625d636bf4884f0a0c995e2) C:\WINDOWS\System32\webclnt.dll

11:09:53.0765 4916 WebClient - ok

11:09:53.0812 4916 winmgmt (b0e590c9260bb08f0832383fdb6eebfb) C:\WINDOWS\system32\wbem\WMIsvc.dll

11:09:53.0828 4916 winmgmt - ok

11:09:53.0875 4916 WmdmPmSN (140ef97b64f560fd78643cae2cdad838) C:\WINDOWS\system32\MsPMSNSv.dll

11:09:53.0875 4916 WmdmPmSN - ok

11:09:53.0921 4916 Wmi (65101014d1fe2b0c69d96fa9ff6990ff) C:\WINDOWS\System32\advapi32.dll

11:09:53.0921 4916 Wmi - ok

11:09:53.0953 4916 WmiApSrv (2398e9f520df78a96fcd577f3a261e98) C:\WINDOWS\system32\wbem\wmiapsrv.exe

11:09:53.0953 4916 WmiApSrv - ok

11:09:53.0984 4916 WpdUsb (1385e5aa9c9821790d33a9563b8d2dd0) C:\WINDOWS\system32\Drivers\wpdusb.sys

11:09:53.0984 4916 WpdUsb - ok

11:09:54.0031 4916 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

11:09:54.0046 4916 WS2IFSL - ok

11:09:54.0062 4916 wscsvc (d24e5fcf419d4e0dff27b08efc022625) C:\WINDOWS\system32\wscsvc.dll

11:09:54.0062 4916 wscsvc - ok

11:09:54.0093 4916 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

11:09:54.0093 4916 WSTCODEC - ok

11:09:54.0125 4916 wuauserv (2c25b42c668a3cf104acbd946d6688bb) C:\WINDOWS\system32\wuauserv.dll

11:09:54.0125 4916 wuauserv - ok

11:09:54.0140 4916 WZCSVC (0d87d0a91d7b86ec07223a27cd6bd157) C:\WINDOWS\System32\wzcsvc.dll

11:09:54.0156 4916 WZCSVC - ok

11:09:54.0203 4916 x10nets (5a0c788c5bc5f2c993cb60940adcf95e) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

11:09:54.0203 4916 x10nets - ok

11:09:54.0218 4916 xmlprov (f4c8d4b0a294aaf37fe50c407b6e03f9) C:\WINDOWS\System32\xmlprov.dll

11:09:54.0234 4916 xmlprov - ok

11:09:54.0234 4916 xpsec - ok

11:09:54.0265 4916 MBR (0x1B8) (25fdd3b61791a226676b12dc5bddef71) \Device\Harddisk0\DR0

11:09:54.0265 4916 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - infected

11:09:54.0265 4916 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Sinowal.b (0)

11:09:54.0281 4916 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR4

11:09:54.0906 4916 \Device\Harddisk1\DR4 - ok

11:09:54.0906 4916 Boot (0x1200) (dfec4947f80e34c701aa469ff1410493) \Device\Harddisk0\DR0\Partition0

11:09:54.0906 4916 \Device\Harddisk0\DR0\Partition0 - ok

11:09:54.0921 4916 Boot (0x1200) (cfb9672cf5fbb1910ff3f8689a795e17) \Device\Harddisk0\DR0\Partition1

11:09:54.0921 4916 \Device\Harddisk0\DR0\Partition1 - ok

11:09:54.0953 4916 Boot (0x1200) (39b17933ebf9f4f36edb5bf88c7f8744) \Device\Harddisk0\DR0\Partition2

11:09:54.0953 4916 \Device\Harddisk0\DR0\Partition2 - ok

11:09:54.0953 4916 Boot (0x1200) (27a424ac1aaefe13f422e1ab9ff1cff8) \Device\Harddisk1\DR4\Partition0

11:09:54.0953 4916 \Device\Harddisk1\DR4\Partition0 - ok

11:09:54.0953 4916 ============================================================

11:09:54.0953 4916 Scan finished

11:09:54.0953 4916 ============================================================

11:09:54.0968 4908 Detected object count: 1

11:09:54.0968 4908 Actual detected object count: 1

11:11:06.0546 4908 \Device\Harddisk0\DR0\# - copied to quarantine

11:11:06.0546 4908 \Device\Harddisk0\DR0 - copied to quarantine

11:11:06.0562 4908 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - will be cured on reboot

11:11:06.0562 4908 \Device\Harddisk0\DR0 - ok

11:11:06.0562 4908 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - User select action: Cure

11:11:13.0968 4344 Deinitialize success

===================================================

Al vast weer hartelijk dank voor het bekijken van mijn logjes, ik zou het heerlijk vinden als het probleem nu verholpen zou zijn!

Vr. groet,

Jeanne

[frouwipkus]

Hierbij het verslag van het scannen door AVG, PSW.Agent.AUES is niet meer aangetroffen op C:!!! Heerlijk, mocht u nog dingen ontdekken in de logfiles die ik stuurde, dingen die ik moet veranderen dan hoor ik het wel. Als dat niet nodig is dan lijkt het mij toe dat er een slotje op mag. Ik heb meteen ook maar een herstelpunt gemaakt.

Scan "Bepaalde mappen/bestanden scannen" is voltooid.

Er is geen infectie gevonden tijdens deze scan

Voor scan geselecteerde mappen:;"C:\;"

Scan is gestart:;"zaterdag 7 april 2012, 11:30:00"

Scan voltooid:;"zaterdag 7 april 2012, 12:17:07 (47 min. 6 seconde (n))"

Totaal gescande objecten:;"998602"

Gebruiker die de scan heeft gestart:;"BenJ"

In ieder geval heel hartelijk bedankt, ik ben er erg blij mee!!! En wens u een heerlijk paasweekend.

Vr. groet,

Jeanne

[kape]

Problemen van de baan, dan is het tijd voor de “grote schoonmaak” : verwijderen van gebruikte programma’s, een cleaning en het verwijderen van de besmette herstelpunten.

Verwijder manueel TDSSKiller.

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht en typ: ComboFix /Uninstall

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Download CCleaner.

Klik op “Download Latest Version” en dan start de download van CCleaner automatisch en gratis op.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Wil je dit uitgebreid in beeld bekijken, klik dan hier voor de handleiding.

Het is aangewezen om de bestaande herstelpunten te verwijderen (daar zitten besmette herstelpunten tussen die je eventueel zou kunnen terugzetten) door systeemherstel tijdelijk uit te schakelen. Doe dit via Start -> Configuratiescherm -> Prestaties en Onderhoud -> Systeem -> Systeemherstel -> "Systeemherstel op alle stations uitschakelen" aanvinken. Toepassen en OK. PC herstarten en het vinkje terug weg halen.

Indien dit allemaal probleemloos verlopen is, mag je hieronder op "markeer als opgelost" tokkelen !

Prettige paasdagen, ook voor jou !

[frouwipkus]

Is het belangrijk om TDSSKiller en Combofix te verwijderen?

Verborgen bestanden, de extensies en d systeembestanden zijn bij mij op de PC nooit verborgen, ik vind het juist erg prettig dat ik alles gewoon kan zien.

CCleaner heb ik al jaren op mijn PC en gebruik ik af en toe om het register op te schonen.

Een en ander zal ik morgen uitvoeren, ik kom daar vandaag niet meer aan toe, eerlijk gezegd heb ik wat genoeg van de PC en dat heb ik niet snel.

Groetjes, Jeanne