Trojaans paard

kape · 3 januari 2010

Dan gaan we toch nog even iets dieper kijken :

Download Combofix naar je Bureaublad.

Lees hier meer over correct gebruik van Combofix.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.

Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Dubbelklik op Combofix.exe om het te starten.
Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.
Volg de instructies, aanvaard de disclaimer door op Ja te klikken.
Indien de Recovery Console niet geïnstalleerd is, wordt je gevraagd om dit alsnog te doen door op JA te klikken in het "Query - Recovery Console" venster (enkel voor XP, niet voor VISTA).
Klik op OK en Ja om automatisch de Recovery Console te laten installeren.
Klik na afloop terug op Ja om het scannen op malware te starten.
Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post dit logje in je volgende antwoord.

debiemy · 3 januari 2010

Oei, installatie lukte niet: kreeg tijdens installatie inderdaad melding alvorens op OK te drukken antivirusprogramma uit te schakelen. Heb dit gedaan: geen reactie. Vervolgens opnieuw combo gedownload maar kreeg melding kan combofix niet herbenoemen, benoem opnieuw liefst met numerieke getallen (of zoiets) en vervolgens geen reactie meer.

kape · 3 januari 2010

Dat betekent normaal dat je onmiddellijk op "uitvoeren" hebt geklikt. Bedoeling is dat je Combofix eerst download naar bureaublad en daar opstart vanaf de rode snelkoppeling.

debiemy · 3 januari 2010

Hallo: ik ben ongelooflijk benieuwd.

ComboFix 10-01-02.05 - Lieven 03/01/2010 15:07:50.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1014.388 [GMT 1:00]

Gestart vanuit: c:\documents and settings\Lieven\Mijn documenten\ComboFix.exe

AV: Telenet Security Pack 9.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}

FW: Telenet Security Pack 9.01 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator\Application Data\02000000a8060d86724C.manifest

c:\documents and settings\Administrator\Application Data\02000000a8060d86724O.manifest

c:\documents and settings\Administrator\Application Data\02000000a8060d86724P.manifest

c:\documents and settings\Administrator\Application Data\02000000a8060d86724S.manifest

c:\documents and settings\Lieven\Application Data\02000000a8060d86724C.manifest

c:\documents and settings\Lieven\Application Data\02000000a8060d86724O.manifest

c:\documents and settings\Lieven\Application Data\02000000a8060d86724P.manifest

c:\documents and settings\Lieven\Application Data\02000000a8060d86724S.manifest

c:\documents and settings\Lieven\Application Data\SystemProc

c:\documents and settings\Myriam\Application Data\02000000a8060d86724C.manifest

c:\documents and settings\Myriam\Application Data\02000000a8060d86724O.manifest

c:\documents and settings\Myriam\Application Data\02000000a8060d86724P.manifest

c:\documents and settings\Myriam\Application Data\02000000a8060d86724S.manifest

c:\windows\desktop

c:\windows\desktop\Partituur Expert.lnk

c:\windows\system32\1050768916

c:\windows\system32\unrar.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-12-03 to 2010-01-03 ))))))))))))))))))))))))))))))

.

2010-01-03 11:19 . 2010-01-03 11:19 -------- d--h--r- c:\documents and settings\Lieven\Onlangs geopend

2010-01-02 21:59 . 2010-01-02 21:59 -------- d-----w- c:\documents and settings\Lieven\Application Data\Malwarebytes

2010-01-02 21:59 . 2009-12-30 13:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-02 21:59 . 2010-01-02 21:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-01-02 21:59 . 2009-12-30 13:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-02 21:59 . 2010-01-02 21:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-02 21:01 . 2010-01-02 21:01 388096 ----a-r- c:\documents and settings\Lieven\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2010-01-02 21:01 . 2010-01-02 21:01 -------- d-----w- c:\program files\TrendMicro

2009-12-30 20:51 . 2009-12-30 20:56 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys

2009-12-30 20:50 . 2009-08-05 15:57 80000 ----a-w- c:\windows\system32\drivers\fsdfw.sys

2009-12-30 20:49 . 2009-12-30 20:56 -------- d-----w- c:\program files\Telenet Security Pack

2009-12-30 10:42 . 2005-01-14 01:41 11254 ----a-w- c:\windows\system32\locate.com

2009-12-29 17:57 . 2009-12-29 17:57 -------- d-----w- C:\ISeeYouXP

2009-12-29 17:56 . 2009-12-29 17:56 -------- d-----w- c:\program files\CCleaner

2009-12-29 17:53 . 2009-12-29 17:53 -------- d-----w- c:\program files\a-squared HiJackFree

2009-12-29 11:48 . 2009-12-30 21:29 -------- d-----w- c:\program files\a-squared Free

2009-12-29 10:55 . 2009-12-29 10:55 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer

2009-12-29 10:48 . 2009-12-29 10:48 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2009-12-28 23:50 . 2008-04-17 12:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2009-12-28 23:48 . 2009-12-28 23:48 -------- d-----w- c:\program files\iPod

2009-12-28 23:48 . 2009-12-28 23:50 -------- d-----w- c:\program files\iTunes

2009-12-28 23:47 . 2009-12-28 23:47 -------- d-----w- c:\program files\Bonjour

2009-12-28 19:17 . 2009-12-28 19:17 -------- d-----w- c:\program files\Windows Sidebar

2009-12-28 19:16 . 2009-12-30 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton

2009-12-28 14:12 . 2009-12-28 14:13 -------- d-----w- c:\program files\Windows Live Safety Center

2009-12-28 14:00 . 2009-12-30 20:42 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller

2009-12-26 10:38 . 2009-12-26 10:38 -------- d-----w- C:\filmtype

2009-12-26 10:16 . 2009-12-26 10:16 -------- d-----w- c:\documents and settings\Lieven\Local Settings\Application Data\ArcSoft

2009-12-26 10:15 . 2009-12-26 10:21 -------- d-----w- c:\documents and settings\All Users\Application Data\ArcSoft

2009-12-26 10:11 . 2006-11-10 14:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys

2009-12-26 10:11 . 2005-04-27 15:36 245408 ----a-w- c:\windows\system32\unicows.dll

2009-12-26 10:11 . 2009-12-26 10:11 -------- d-----w- c:\program files\Common Files\ArcSoft

2009-12-26 10:08 . 2009-12-26 10:08 -------- d-----w- c:\windows\OVT

2009-12-18 18:38 . 2009-12-18 18:38 15849968 ----a-w- c:\documents and settings\Lieven\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airinstaller1x0\airinstaller1x0.exe

2009-12-09 21:02 . 2009-12-09 21:02 -------- d-----w- c:\documents and settings\Lieven\Local Settings\Application Data\WMTools Downloaded Files

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-03 11:45 . 2009-11-10 20:00 79488 ----a-w- c:\documents and settings\Lieven\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2009-12-30 21:28 . 2006-11-27 16:34 -------- d-----w- c:\documents and settings\Lieven\Application Data\F-Secure

2009-12-30 20:50 . 2004-09-14 07:38 97370 ----a-w- c:\windows\system32\perfc013.dat

2009-12-30 20:50 . 2004-09-14 07:38 523460 ----a-w- c:\windows\system32\perfh013.dat

2009-12-30 20:50 . 2006-11-27 16:24 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure

2009-12-30 20:49 . 2007-08-16 08:44 -------- d-----w- c:\documents and settings\All Users\Application Data\fssg

2009-12-28 23:52 . 2009-11-11 21:23 41328 ---ha-w- c:\windows\system32\mlfcache.dat

2009-12-28 23:48 . 2007-11-04 10:58 -------- d-----w- c:\program files\Common Files\Apple

2009-12-28 23:47 . 2006-08-28 16:32 -------- d-----w- c:\program files\QuickTime

2009-12-28 23:11 . 2006-11-10 18:54 54320 ----a-w- c:\documents and settings\Lieven\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-28 19:54 . 2008-01-18 11:01 -------- d-----w- c:\program files\Pinnacle

2009-12-28 19:49 . 2007-03-16 17:12 -------- d-----w- c:\program files\Harry Potter Creative CD

2009-12-28 19:36 . 2008-08-01 09:25 -------- d-----w- c:\program files\ExtraFilm PhotoAssistant

2009-12-28 19:32 . 2006-07-28 16:55 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-12-28 19:25 . 2006-08-28 16:26 -------- d-----w- c:\program files\Common Files\Adobe

2009-12-28 14:03 . 2006-11-27 16:22 -------- d-----w- c:\program files\Telenet Internet Security Pack

2009-12-26 10:26 . 2006-09-01 20:46 -------- d-----w- c:\documents and settings\Lieven\Application Data\ArcSoft

2009-12-26 10:23 . 2009-08-30 13:11 -------- d-----w- c:\program files\Spector Photo Software

2009-12-26 10:11 . 2006-08-28 16:30 -------- d-----w- c:\program files\ArcSoft

2009-12-18 20:28 . 2007-11-24 15:26 -------- d-----w- c:\documents and settings\Lieven\Application Data\LEGO Company

2009-11-12 16:07 . 2009-11-12 16:07 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

2009-11-11 21:12 . 2007-11-04 11:00 -------- d-----w- c:\documents and settings\Lieven\Application Data\Apple Computer

2009-11-07 17:25 . 2009-11-07 17:23 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2009-10-29 07:46 . 2004-09-14 07:38 832512 ----a-w- c:\windows\system32\wininet.dll

2009-10-29 07:46 . 2004-09-14 07:38 78336 ----a-w- c:\windows\system32\ieencode.dll

2009-10-29 07:46 . 2004-09-14 07:38 17408 ----a-w- c:\windows\system32\corpol.dll

2009-10-21 05:40 . 2004-09-14 07:38 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:40 . 2004-09-14 07:38 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-03 22:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-17 17:37 . 2009-10-17 17:37 68 ----a-w- C:\scandata.dat

2009-10-13 10:38 . 2004-09-14 07:38 270848 ----a-w- c:\windows\system32\oakley.dll

2009-10-12 13:40 . 2004-09-14 07:38 79872 ----a-w- c:\windows\system32\raschap.dll

2009-10-12 13:40 . 2004-09-14 07:38 150016 ----a-w- c:\windows\system32\rastls.dll

2009-10-10 16:04 . 2009-02-08 16:47 49152 ----a-r- c:\documents and settings\Lieven\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe

2009-10-10 16:03 . 2009-10-10 16:03 335872 ----a-r- c:\documents and settings\Lieven\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe

2009-10-10 15:53 . 2009-02-08 16:45 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 68856]

"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-07-08 393216]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-16 148888]

"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 49152]

"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]

"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-22 63712]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2007-10-31 378784]

"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-02-24 479232]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

"F-Secure Manager"="c:\program files\Telenet Security Pack\Common\FSM32.EXE" [2009-08-05 199264]

"F-Secure TNB"="c:\program files\Telenet Security Pack\FSGUI\TNBUtil.exe" [2009-08-05 2349664]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Reader Snelle start.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

FotoStation Easy AutoLaunch.lnk - c:\program files\FotoStation Easy\FotoStation Easy AutoLaunch.exe [2006-8-28 49152]

Image Transfer.lnk - c:\program files\Sony Corporation\Image Transfer\SonyTray.exe [2006-8-28 73728]

NkvMon.exe.lnk - c:\program files\Nikon\NkView5\NkvMon.exe [2006-8-28 233472]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

"c:\\Program Files\\Spelletjes\\KetnetKick\\KetnetKick.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=

"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [30/12/2009 21:51 33920]

R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [30/12/2009 21:50 80000]

R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Telenet Security Pack\HIPS\drivers\fshs.sys [30/12/2009 21:50 68064]

R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [29/12/2009 12:48 1858144]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [21/12/2008 11:17 55152]

R2 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [6/02/2009 18:08 533360]

R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Telenet Security Pack\Anti-Virus\minifilter\fsgk.sys [30/12/2009 21:49 107104]

R3 FSORSPClient;F-Secure ORSP Client;c:\program files\Telenet Security Pack\ORSP Client\fsorsp.exe [30/12/2009 21:50 55936]

S3 APL531;OVT Scanner;c:\windows\system32\Drivers\ov550i.sys --> c:\windows\system32\Drivers\ov550i.sys [?]

S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\drivers\s916bus.sys [16/08/2008 10:40 83496]

S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\drivers\s916mdfl.sys [16/08/2008 10:42 15016]

S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\drivers\s916mdm.sys [16/08/2008 10:42 109992]

S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s916mgmt.sys [16/08/2008 10:50 103976]

S3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\drivers\s916obex.sys [16/08/2008 10:50 100008]

S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Telenet Security Pack\Anti-Virus\win2k\fsfilter.sys [30/12/2009 21:49 39776]

S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Telenet Security Pack\Anti-Virus\win2k\fsrec.sys [30/12/2009 21:49 25184]

.

Inhoud van de 'Gedeelde Taken' map

2009-11-11 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-01-02 c:\windows\Tasks\OGADaily.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 15:04]

2010-01-03 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 15:04]

.

------- Bijkomende Scan -------

.

uStart Page = about:blank

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

LSP: c:\program files\Telenet Security Pack\FSPS\program\FSLSP.DLL

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-01-03 15:13

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

"3140710900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(640)

c:\program files\telenet security pack\hips\fshook32.dll

c:\windows\system32\igfxdev.dll

- - - - - - - > 'lsass.exe'(696)

c:\program files\Telenet Security Pack\FSPS\program\FSLSP.DLL

c:\program files\telenet security pack\hips\fshook32.dll

.

Voltooingstijd: 2010-01-03 15:15:28

ComboFix-quarantined-files.txt 2010-01-03 14:15

Pre-Run: 115.555.848.192 bytes beschikbaar

Post-Run: 116.135.047.168 bytes beschikbaar

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - A60A5E36D2B881E5A658B9F197954B94

kape · 3 januari 2010

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\Drivers\ov550i.sys

c:\windows\system32\drivers\afc.sys

c:\windows\system32\locate.com

Driver::

afc

APL531

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

debiemy · 3 januari 2010

ComboFix 10-01-02.05 - Lieven 03/01/2010 17:39:13.2.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1014.348 [GMT 1:00]

Gestart vanuit: c:\documents and settings\Lieven\Mijn documenten\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Lieven\Bureaublad\CFScript.txt

AV: Telenet Security Pack 9.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}

FW: Telenet Security Pack 9.01 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}

FILE ::

"c:\windows\system32\drivers\afc.sys"

"c:\windows\system32\Drivers\ov550i.sys"

"c:\windows\system32\locate.com"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\afc.sys

c:\windows\system32\locate.com

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_Afc

-------\Service_APL531

(((((((((((((((((((( Bestanden Gemaakt van 2009-12-03 to 2010-01-03 ))))))))))))))))))))))))))))))

.

2010-01-03 11:19 . 2010-01-03 16:21 -------- d--h--r- c:\documents and settings\Lieven\Onlangs geopend