Ga naar inhoud

trager dan normaal


Aanbevolen berichten

ComboFix 09-05-05.02 - Van de Voorde Daniel 05/05/2009 23:02.3 - NTFSx86

Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.32.1033.18.3070.1922 [GMT 2:00]

Gestart vanuit: c:\users\Van de Voorde Daniel\Downloads\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Van de Voorde Daniel\Downloads\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-04-05 to 2009-05-05 ))))))))))))))))))))))))))))))

.

2009-05-03 16:05 . 2009-05-03 16:05 -------- d-----w c:\users\Van de Voorde Daniel\AppData\Roaming\Malwarebytes

2009-05-03 16:05 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-05-03 16:05 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-03 16:05 . 2009-05-03 16:05 -------- d-----w c:\programdata\Malwarebytes

2009-05-03 16:05 . 2009-05-03 16:05 -------- d-----w c:\users\All Users\Malwarebytes

2009-05-03 16:05 . 2009-05-03 19:32 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-05-02 10:44 . 2009-05-02 10:44 -------- d-----w c:\program files\Trend Micro

2009-05-02 09:57 . 2009-05-02 09:57 -------- d-----w c:\program files\MSXML 4.0

2009-05-01 12:13 . 2009-05-02 12:05 -------- d-----w c:\users\Van de Voorde Daniel\AppData\Roaming\Ahead

2009-05-01 11:17 . 2009-05-01 12:13 -------- d-----w c:\users\Van de Voorde Daniel\AppData\Local\Ahead

2009-05-01 11:14 . 2009-05-01 11:14 -------- d-----w c:\programdata\Ahead

2009-05-01 11:14 . 2009-05-01 11:14 -------- d-----w c:\users\All Users\Ahead

2009-05-01 11:10 . 2009-05-01 11:10 -------- d-----w c:\program files\Nero

2009-05-01 11:10 . 2009-05-01 11:10 -------- d-----w c:\programdata\Nero

2009-05-01 11:10 . 2009-05-01 11:10 -------- d-----w c:\users\All Users\Nero

2009-05-01 11:10 . 2009-05-01 11:12 -------- d-----w c:\program files\Common Files\Ahead

2009-04-29 14:27 . 2008-08-17 10:33 678408 ----a-w c:\windows\system32\gpprefcl.dll

2009-04-20 13:43 . 2009-04-20 13:43 -------- d-----w c:\program files\Microsoft Silverlight

2009-04-17 10:50 . 2009-04-17 10:50 -------- d-----w c:\program files\Microsoft Virtual PC

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-05 14:26 . 2009-01-21 18:32 668790 ----a-w c:\windows\system32\perfh013.dat

2009-05-05 14:26 . 2009-01-21 18:32 127364 ----a-w c:\windows\system32\perfc013.dat

2009-05-04 16:51 . 2009-05-04 16:51 -------- d-----w c:\program files\Lavalys

2009-05-01 21:19 . 2009-01-28 22:15 2560 ----a-w c:\windows\_MSRSTRT.EXE

2009-05-01 21:15 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstrng.dat

2009-05-01 21:15 . 2006-11-02 10:25 86016 ----a-w c:\windows\inf\infstor.dat

2009-05-01 21:15 . 2006-11-02 10:25 51200 ----a-w c:\windows\inf\infpub.dat

2009-04-28 16:09 . 2009-01-21 18:56 -------- d-----w c:\program files\Microsoft

2009-04-26 16:24 . 2009-01-21 17:39 54600 ----a-w c:\users\Van de Voorde Daniel\AppData\Local\GDIPFONTCACHEV1.DAT

2009-04-18 09:58 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail

2009-03-17 03:38 . 2009-04-17 10:24 13824 ----a-w c:\windows\system32\apilogen.dll

2009-03-17 03:38 . 2009-04-17 10:24 24064 ----a-w c:\windows\system32\amxread.dll

2009-03-11 22:06 . 2009-03-11 22:06 -------- d-----w c:\program files\Visiosonic

2009-03-09 21:07 . 2009-03-09 21:07 107888 ----a-w c:\windows\system32\CmdLineExt.dll

2009-03-09 20:50 . 2009-03-09 20:50 -------- d-----w c:\program files\Electronic Arts

2009-03-09 20:50 . 2009-01-21 17:44 -------- d--h--w c:\program files\InstallShield Installation Information

2009-03-09 20:48 . 2009-03-09 20:48 662 ----a-w c:\windows\system32\ealregsnapshot1.reg

2009-03-08 11:34 . 2009-04-30 23:49 914944 ----a-w c:\windows\system32\wininet.dll

2009-03-08 11:34 . 2009-04-30 23:49 43008 ----a-w c:\windows\system32\licmgr10.dll

2009-03-08 11:33 . 2009-04-30 23:49 18944 ----a-w c:\windows\system32\corpol.dll

2009-03-08 11:33 . 2009-04-30 23:49 109056 ----a-w c:\windows\system32\iesysprep.dll

2009-03-08 11:33 . 2009-04-30 23:49 109568 ----a-w c:\windows\system32\PDMSetup.exe

2009-03-08 11:33 . 2009-04-30 23:49 132608 ----a-w c:\windows\system32\ieUnatt.exe

2009-03-08 11:33 . 2009-04-30 23:49 107520 ----a-w c:\windows\system32\RegisterIEPKEYs.exe

2009-03-08 11:33 . 2009-04-30 23:49 107008 ----a-w c:\windows\system32\SetIEInstalledDate.exe

2009-03-08 11:33 . 2009-04-30 23:49 103936 ----a-w c:\windows\system32\SetDepNx.exe

2009-03-08 11:33 . 2009-04-30 23:49 420352 ----a-w c:\windows\system32\vbscript.dll

2009-03-08 11:32 . 2009-04-30 23:49 72704 ----a-w c:\windows\system32\admparse.dll

2009-03-08 11:32 . 2009-04-30 23:49 71680 ----a-w c:\windows\system32\iesetup.dll

2009-03-08 11:32 . 2009-04-30 23:49 66560 ----a-w c:\windows\system32\wextract.exe

2009-03-08 11:32 . 2009-04-30 23:49 169472 ----a-w c:\windows\system32\iexpress.exe

2009-03-08 11:31 . 2009-04-30 23:49 34816 ----a-w c:\windows\system32\imgutil.dll

2009-03-08 11:31 . 2009-04-30 23:49 48128 ----a-w c:\windows\system32\mshtmler.dll

2009-03-08 11:31 . 2009-04-30 23:49 45568 ----a-w c:\windows\system32\mshta.exe

2009-03-08 11:22 . 2009-04-30 23:49 156160 ----a-w c:\windows\system32\msls31.dll

2009-03-03 04:46 . 2009-04-17 10:24 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe

2009-03-03 04:46 . 2009-04-17 10:24 3547632 ----a-w c:\windows\system32\ntoskrnl.exe

2009-03-03 04:39 . 2009-04-17 10:24 183296 ----a-w c:\windows\system32\sdohlp.dll

2009-03-03 04:39 . 2009-04-17 10:24 551424 ----a-w c:\windows\system32\rpcss.dll

2009-03-03 04:39 . 2009-04-17 10:24 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll

2009-03-03 04:37 . 2009-04-17 10:24 98304 ----a-w c:\windows\system32\iasrecst.dll

2009-03-03 04:37 . 2009-04-17 10:24 54784 ----a-w c:\windows\system32\iasads.dll

2009-03-03 04:37 . 2009-04-17 10:24 44032 ----a-w c:\windows\system32\iasdatastore.dll

2009-03-03 03:04 . 2009-04-17 10:24 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe

2009-03-03 02:38 . 2009-04-17 10:24 17408 ----a-w c:\windows\system32\iashost.exe

2009-02-22 17:57 . 2009-02-22 17:53 141473 ----a-w c:\windows\hpiins06.dat

2009-02-19 15:25 . 2009-01-21 21:29 10520 ----a-w c:\windows\system32\avgrsstx.dll

2009-02-19 15:25 . 2009-02-19 15:25 107272 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-02-19 15:25 . 2009-01-21 21:29 325128 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-02-17 17:32 . 2009-01-21 17:39 2032 ----a-w c:\users\Van de Voorde Daniel\AppData\Local\d3d9caps.dat

2009-02-13 08:49 . 2009-04-17 10:24 72704 ----a-w c:\windows\system32\secur32.dll

2009-02-13 08:49 . 2009-04-17 10:24 1255936 ----a-w c:\windows\system32\lsasrv.dll

2009-02-09 03:10 . 2009-03-11 15:26 2033152 ----a-w c:\windows\system32\win32k.sys

2009-02-06 17:52 . 2009-02-06 17:52 49504 ----a-w c:\windows\system32\sirenacm.dll

2009-02-06 17:08 . 2009-02-18 20:48 55280 ----a-w c:\windows\system32\drivers\fssfltr.sys

2009-01-24 15:47 . 2006-11-02 12:49 174 --sha-w c:\program files\desktop.ini

2006-11-22 14:58 . 2006-11-22 14:58 8192 --sha-w c:\windows\Users\Default\NTUSER.DAT

.

((((((((((((((((((((((((((((( SnapShot@2009-05-05_19.30.31 )))))))))))))))))))))))))))))))))))))))))

.

- 2006-11-02 13:00 . 2009-05-05 19:27 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2006-11-02 13:00 . 2009-05-05 19:33 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2006-11-02 13:00 . 2009-05-05 19:33 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2006-11-02 13:00 . 2009-05-05 19:27 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2006-11-02 13:00 . 2009-05-05 19:33 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2006-11-02 13:00 . 2009-05-05 19:27 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-04-30 23:58 . 2009-05-05 19:33 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat

- 2009-04-30 23:58 . 2009-05-05 16:12 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]

"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2008-07-03 2177576]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"EzAgent"="c:\program files\ASUS\ASUS EzVCR.FM\ezagent.exe" [2002-10-31 114688]

"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2009-02-23 171448]

"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-02-06 3325952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]

"Launch LGDCore"="c:\program files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 1122304]

"Launch LCDMon"="c:\program files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 497152]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-19 1601304]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-02-27 570664]

"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2008-02-18 1629480]

"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2008-02-18 1057064]

"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-08-27 4702208]

"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-08-03 1826816]

c:\users\Van de Voorde Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Reliability and Performance Monitor.lnk - c:\windows\System32\perfmon.msc [2009-1-24 145455]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{258E52C9-1CFC-40CF-9302-BDCF085194ED}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe

"{5334BEA3-E077-4C1D-899A-D37D14B2137F}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe

"{DD55A754-67CA-4185-9929-FAB7C38E0F12}"= UDP:c:\windows\System32\rserver30\rserver3.exe:Radmin Server 3

"{B223907B-F86F-4444-AB19-6D804CAE3110}"= TCP:c:\windows\System32\rserver30\rserver3.exe:Radmin Server 3

"TCP Query User{AD325BB8-AE4E-464E-8C09-937960E69A8D}c:\\program files\\electronic arts\\eadm\\core.exe"= UDP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager

"UDP Query User{BA45A234-D352-4B9A-9819-FAF2C4A5BF92}c:\\program files\\electronic arts\\eadm\\core.exe"= TCP:c:\program files\electronic arts\eadm\core.exe:EA Download Manager

"TCP Query User{EEF3EA1B-12E1-4134-A1B3-4F8D1106B012}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"UDP Query User{C82F3BA3-28EF-4A0E-99D1-ADA2A0930918}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"TCP Query User{915AB1C6-366F-4E18-A12B-7F481F37B9D0}e:\\crysis\\bin32\\crysis.exe"= UDP:e:\crysis\bin32\crysis.exe:Crysis

"UDP Query User{05916FCA-56CB-4DD6-95D5-B003DD518BC4}e:\\crysis\\bin32\\crysis.exe"= TCP:e:\crysis\bin32\crysis.exe:Crysis

R0 amacpi;Microsoft Away Mode System;c:\windows\System32\drivers\null.sys [24/01/2009 16:09 4608]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [21/01/2009 23:29 325128]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [19/02/2009 17:25 107272]

R1 raddrvv3;raddrvv3;c:\windows\System32\rserver30\raddrvv3.sys [24/04/2008 9:49 45848]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [21/01/2009 23:29 903960]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [21/01/2009 23:29 298264]

R2 drhard;drhard;c:\windows\System32\drivers\drhard.sys [25/01/2009 1:56 23600]

R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [14/01/2009 18:53 226656]

R3 mirrorv3;mirrorv3;c:\windows\System32\drivers\rminiv3.sys [1/11/2006 7:01 3328]

R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\System32\drivers\Ph3xIB32.sys [3/04/2007 11:43 1131136]

R3 SMCWGU(SMC);SMCWUSB-G 802.11g Wireless USB 2.0 Adapter(SMC);c:\windows\System32\drivers\SMCWGU.sys [21/01/2009 20:18 408064]

S2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe --> c:\program files\Nero\Nero 7\InCD\NBHRegInCDSrv.exe [?]

S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [18/02/2009 22:48 55280]

S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [6/02/2009 19:08 533360]

S3 RServer3;Radmin Server V3;c:\windows\System32\rserver30\rserver3.exe [24/04/2008 9:44 1238344]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3418e2b5-35d7-11de-82aa-806e6f6e6963}]

\shell\AutoRun\command - M:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc56099f-e7e3-11dd-b7e6-001d7d03b995}]

\shell\AutoRun\command - L:\autorun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]

%SystemRoot%\system32\soundschemes.exe /AddRegistration

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]

%SystemRoot%\system32\soundschemes2.exe /AddRegistration

.

Inhoud van de 'Gedeelde Taken' map

2009-05-05 c:\windows\Tasks\User_Feed_Synchronization-{82257FB8-E9E5-404B-B3BF-BC87A65B1A6F}.job

- c:\windows\system32\msfeedssync.exe [2009-04-30 11:31]

.

.

------- Bijkomende Scan -------

.

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-05 23:04

Windows 6.0.6001 Service Pack 1 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-2109742368-2942914443-4059112236-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B9F75FF1-9BB3-D5CD-9DAC-691551B22043}*]

"japelmggjmoihemoldka"=hex:63,61,69,6b,6a,6c,00,00

"pahfmhjkokkedccncmlgckjjgdgbcdla"=hex:65,61,65,6c,69,6f,6d,70,68,6d,00,00

"hapelmggjmoihemo"=hex:61,61,00,00

[HKEY_USERS\S-1-5-21-2109742368-2942914443-4059112236-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:71,fd,93,ae,b8,35,5f,38,f6,d5,b1,33,fe,1a,9b,3f,d7,4a,3a,3c,31,72,77,

f3,56,e4,0d,a5,f7,5c,06,98,c1,cb,d0,a0,17,c9,0c,f1,df,33,6c,73,e7,91,a6,ba,\

"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49

[HKEY_USERS\S-1-5-21-2109742368-2942914443-4059112236-1000\Software\SecuROM\License information*]

"datasecu"=hex:02,32,8d,c6,57,49,a9,2a,23,ff,23,85,34,40,a8,c9,12,80,fd,05,b2,

3b,ad,a5,79,43,57,b3,31,58,90,ca,d6,ad,0f,ed,6e,80,72,6e,72,95,96,d5,6f,e1,\

"rkeysecu"=hex:3d,eb,72,17,a8,e6,0a,f6,53,4c,e3,85,9d,cc,85,78

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'Explorer.exe'(5056)

c:\program files\Microsoft Virtual PC\VPCShExH.DLL

.

Voltooingstijd: 2009-05-05 23:04

ComboFix-quarantined-files.txt 2009-05-05 21:04

ComboFix2.txt 2009-05-05 20:59

ComboFix3.txt 2009-05-05 19:31

Pre-Run: 12.692.590.592 bytes beschikbaar

Post-Run: 12.653.965.312 bytes beschikbaar

213 --- E O F --- 2009-05-04 14:22

ik weet niet of er iets veranderd is ik zie ze nog staan

Link naar reactie
Delen op andere sites

  • Reacties 22
  • Aangemaakt
  • Laatste reactie

Beste reacties in dit topic


×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.