ComboFix 09-08-24.06 - D.R. Norbruis 25-08-2009 13:25.1.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.894.408 [GMT 2:00] Gestart vanuit: c:\documents and settings\D.R. Norbruis\Bureaublad\ComboFix.exe AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} * Nieuw herstelpunt werd aangemaakt . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\-1932787033 c:\documents and settings\D.R. Norbruis\oashdihasidhasuidhiasdhiashdiuasdhasd C:\nonwmow.exe C:\ofrs.exe c:\windows\Installer\1a2d023.msi c:\windows\t55ft2692f44.dat c:\windows\system32\proquota.exe was verdwenen Hersteld exemplaar van - c:\windows\ServicePackFiles\i386\proquota.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_acpi32 -------\Service_ati64si -------\Service_fips32cup -------\Service_i386si -------\Service_ksi32sk -------\Service_netsik -------\Service_nicsk32 -------\Service_port135sik -------\Service_securentm -------\Service_systemntmi -------\Service_ws2_32sik (((((((((((((((((((( Bestanden Gemaakt van 2009-07-25 to 2009-08-25 )))))))))))))))))))))))))))))) . 2009-08-25 11:29 . 2008-04-14 17:03 50688 ----a-w- c:\windows\system32\proquota.exe 2009-08-25 11:29 . 2008-04-14 17:03 50688 ----a-w- c:\windows\system32\dllcache\proquota.exe . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-25 11:32 . 2007-01-16 14:36 -------- d-----w- c:\program files\Symantec AntiVirus 2009-08-19 16:00 . 2008-06-13 07:19 -------- d-----w- c:\program files\Norton Security Scan 2009-08-05 16:47 . 2009-05-08 19:44 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-06-19 13:01 . 2009-06-19 13:01 390664 ----a-w- c:\documents and settings\D.R. Norbruis\Application Data\Real\RealPlayer\Update\realplayer11gold.exe 2008-09-27 17:08 . 2008-09-27 17:08 122880 -c--a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll 2006-10-11 08:04 . 2008-04-03 09:37 61036 -c--a-w- c:\program files\mozilla firefox\components\jar50.dll 2006-10-11 08:04 . 2008-04-03 09:37 48742 -c--a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2006-10-11 08:05 . 2008-04-03 09:37 29313 -c--a-w- c:\program files\mozilla firefox\components\myspell.dll 2006-10-11 08:05 . 2008-04-03 09:37 41082 -c--a-w- c:\program files\mozilla firefox\components\spellchk.dll 2006-10-11 08:04 . 2008-04-03 09:37 166510 -c--a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-08-23 1032192] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-22 761947] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 66680] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-03-12 124128] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-20 198160] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-09-22 282624] "PMX Daemon"="ICO.EXE" - c:\windows\system32\ico.exe [2006-11-08 49152] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\ Adobe Reader Snelle start.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-1-4 24576] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "wltrysvc"=2 (0x2) "usnjsvc"=3 (0x3) "iPod Service"=3 (0x3) "GoogleDesktopManager-061008-081103"=3 (0x3) "Bonjour Service"=2 (0x2) "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\WINDOWS\\system32\\spider.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE"= "c:\\WINDOWS\\system32\\cleanmgr.exe"= "c:\\Program Files\\NetWaiting\\netwaiting.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\EXCEL.EXE"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Dell\\QuickSet\\quickset.exe"= "c:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"= "c:\\WINDOWS\\system32\\WLTRAY.exe"= "c:\\WINDOWS\\system32\\ICO.EXE"= "c:\\WINDOWS\\System32\\DLA\\DLACTRLW.EXE"= "c:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe"= "c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"= "c:\\Program Files\\Symantec AntiVirus\\VPTray.exe"= "c:\\Program Files\\iTunes\\iTunesHelper.exe"= "c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"= "c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"= "c:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe"= "c:\\Program Files\\Digital Line Detect\\DLG.exe"= "c:\\Program Files\\Common Files\\Real\\Update_OB\\RealOneMessageCenter.exe"= "c:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\WINDOWS\\system32\\netsh.exe"= "c:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe"= "c:\\WINDOWS\\stsystra.exe"= "c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"= R2 antivirschedulerservice;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8-5-2009 21:44 108289] S1 e09a7c0;e09a7c0;c:\windows\system32\drivers\e09a7c0.sys --> c:\windows\system32\drivers\e09a7c0.sys [?] S2 amd64si;amd64si;\??\c:\windows\system32\drivers\amd64si.sys --> c:\windows\system32\drivers\amd64si.sys [?] S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [12-3-2004 16:18 169192] S4 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [4-1-2007 21:34 29744] . Inhoud van de 'Gedeelde Taken' map 2009-07-07 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2009-08-19 c:\windows\Tasks\Norton Security Scan for D.R. Norbruis.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 03:18] . - - - - ORPHANS VERWIJDERD - - - - WebBrowser-{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - (no file) . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.kpnvandaag.nl/web/dashboard.htm#home uInternet Settings,ProxyOverride = *.local IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: runescape.com\www FF - ProfilePath - c:\documents and settings\D.R. Norbruis\Application Data\Mozilla\Firefox\Profiles\ohf17a9y.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.msn.nl FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=nl-nl&FORM=MICNE2&q= FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-25 13:32 Windows 5.1.2600 Service Pack 3 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'winlogon.exe'(908) c:\windows\system32\Ati2evxx.dll c:\windows\System32\BCMLogon.dll - - - - - - - > 'explorer.exe'(3772) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Andere Aktieve Processen ------------------------ . c:\windows\system32\ati2evxx.exe c:\program files\Common Files\Symantec Shared\ccSetMgr.exe c:\windows\system32\ati2evxx.exe c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Symantec AntiVirus\DefWatch.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Dell\QuickSet\NicConfigSvc.exe c:\program files\Symantec AntiVirus\Rtvscan.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe . ************************************************************************** . Voltooingstijd: 2009-08-25 13:38 - machine werd herstart ComboFix-quarantined-files.txt 2009-08-25 11:38 Pre-Run: 98.939.224.064 bytes beschikbaar Post-Run: 100.183.748.608 bytes beschikbaar WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer 193 --- E O F --- 2009-04-16 06:44