Antimalware Doctor - Hijackthis log

Kuona79 · 16 augustus 2010

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:39:17, on 16-8-2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe

C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

C:\Program Files\Microsoft Office\Office\OSA.EXE

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

C:\WINDOWS\system32\msiexec.exe

G:\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)

O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: HP Photosmart Premier Snelstart.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: McAfee Security Scan.lnk = ?

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

O8 - Extra context menu item: Locate Spot on Map by GPS - C:\Program Files\Opanda\IExif 2.3\IExifMap.htm

O8 - Extra context menu item: View Exif/GPS/IPTC with IExif - C:\Program Files\Opanda\IExif 2.3\IExifCom.htm

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://kuona79.spaces.live.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.nl/ImageUploader5.cab

O16 - DPF: {63D6DD13-C913-466D-9444-9357561E4D94} (Upload-applicatie Control) - http://www.mijnalbum.nl/v3/skinsrc/core/system/ma5.8.3/uploadtoepassing.cab

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyvz.com/statics/Aurigma/ImageUploader4.cab

O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} (Navigram Control) - http://www.navigram.com/engine/v902/Navigram.cab

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

O23 - Service: Planner voor Automatische LiveUpdate - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe

--

End of file - 10382 bytes

---------- Post toegevoegd om 12:45 ---------- Vorige post was om 12:44 ----------

ComboFix 10-08-15.02 - Anouk 16-08-2010 12:16:56.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.1023.594 [GMT 2:00]

Gestart vanuit: G:\ComboFix.exe

AV: avast! antivirus 4.7.1001 [VPS 000761-2] *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: Norton Internet Security 2006 *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security 2006 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Anouk\Application Data\CEDDB9E27A515BA6DDBF40D73BA79820

c:\documents and settings\Anouk\Application Data\CEDDB9E27A515BA6DDBF40D73BA79820\enemies-names.txt

c:\documents and settings\Anouk\Application Data\CEDDB9E27A515BA6DDBF40D73BA79820\local.ini

c:\documents and settings\Anouk\Application Data\CEDDB9E27A515BA6DDBF40D73BA79820\lsrslt.ini

c:\documents and settings\Anouk\Application Data\CEDDB9E27A515BA6DDBF40D73BA79820\secureapp70700.exe

c:\documents and settings\Anouk\Application Data\GabPath

c:\documents and settings\Anouk\Application Data\GabPath\config.cfg

c:\documents and settings\Anouk\Application Data\GabPath\gabpath.exe

c:\documents and settings\Anouk\Application Data\GabPath\GPUninstall.exe

c:\documents and settings\Anouk\Application Data\inst.exe

c:\documents and settings\Anouk\Application Data\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk

c:\documents and settings\Anouk\Application Data\ohydy.exe

c:\documents and settings\Anouk\Application Data\Sky-Banners

c:\documents and settings\Anouk\Application Data\Sky-Banners\skb\log.xml

c:\documents and settings\Anouk\Application Data\Street-Ads

c:\documents and settings\Anouk\Bureaublad\Antimalware Doctor.lnk

c:\documents and settings\Anouk\Local Settings\Application Data\bdgcatftj

c:\documents and settings\Anouk\Local Settings\Application Data\bdgcatftj\ivinepbshdw.exe

c:\documents and settings\Anouk\Local Settings\Application Data\mksnbwsqq

c:\documents and settings\Anouk\Local Settings\Application Data\mksnbwsqq\rldyiwgshdw.exe

c:\documents and settings\Anouk\Local Settings\Application Data\Windows Server

c:\documents and settings\Anouk\Local Settings\Application Data\Windows Server\admin.txt

c:\documents and settings\Anouk\Local Settings\Application Data\Windows Server\flags.ini

c:\documents and settings\Anouk\Local Settings\Application Data\Windows Server\server.dat

c:\documents and settings\Anouk\Local Settings\Application Data\Windows Server\uses32.dat

c:\documents and settings\Anouk\Menu Start\Antimalware Doctor.lnk

c:\documents and settings\Anouk\Menu Start\Programma's\Antimalware Doctor

c:\documents and settings\Anouk\Menu Start\Programma's\Antimalware Doctor\Antimalware Doctor.lnk

c:\documents and settings\Anouk\Menu Start\Programma's\Antimalware Doctor\Uninstall.lnk

c:\documents and settings\Anouk\Sjablonen\memory.tmp

C:\lsass.exe

c:\program files\Fast Browser Search

c:\program files\Fast Browser Search\IE\1.bat

c:\program files\Fast Browser Search\IE\about.html

c:\program files\Fast Browser Search\IE\affid.dat

c:\program files\Fast Browser Search\IE\basis.xml

c:\program files\Fast Browser Search\IE\basis_br.xml

c:\program files\Fast Browser Search\IE\basis_de.xml

c:\program files\Fast Browser Search\IE\basis_en.xml

c:\program files\Fast Browser Search\IE\basis_es.xml

c:\program files\Fast Browser Search\IE\basis_fr.xml

c:\program files\Fast Browser Search\IE\basis_it.xml

c:\program files\Fast Browser Search\IE\basis_nr.xml

c:\program files\Fast Browser Search\IE\basis_pt.xml

c:\program files\Fast Browser Search\IE\basis_ru.xml

c:\program files\Fast Browser Search\IE\basis_tr.xml

c:\program files\Fast Browser Search\IE\BHO.dll

c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe

c:\program files\Fast Browser Search\IE\error.html

c:\program files\Fast Browser Search\IE\FBSPlugin.dll

c:\program files\Fast Browser Search\IE\fbsProtection.xml

c:\program files\Fast Browser Search\IE\fbsSearchProvider.xml

c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe

c:\program files\Fast Browser Search\IE\FBStoolbar.dll

c:\program files\Fast Browser Search\IE\fbstoolbar.jar

c:\program files\Fast Browser Search\IE\fbstoolbar.manifest

c:\program files\Fast Browser Search\IE\icons.bmp

c:\program files\Fast Browser Search\IE\info.txt

c:\program files\Fast Browser Search\IE\local.xml

c:\program files\Fast Browser Search\IE\logobg.bmp

c:\program files\Fast Browser Search\IE\MTWBtoolbar.html

c:\program files\Fast Browser Search\IE\search.bmp

c:\program files\Fast Browser Search\IE\search_br.bmp

c:\program files\Fast Browser Search\IE\search_de.bmp

c:\program files\Fast Browser Search\IE\search_es.bmp

c:\program files\Fast Browser Search\IE\search_fr.bmp

c:\program files\Fast Browser Search\IE\search_it.bmp

c:\program files\Fast Browser Search\IE\search_pt.bmp

c:\program files\Fast Browser Search\IE\search_ru.bmp

c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe

c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico

c:\program files\Fast Browser Search\IE\SGPU.ico

c:\program files\Fast Browser Search\IE\sgpUpdater.exe

c:\program files\Fast Browser Search\IE\sgpUpdater.xml

c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe

c:\program files\Fast Browser Search\IE\tbhelper.dll

c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js

c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js

c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js

c:\program files\Fast Browser Search\IE\Toolbar Help.htm

c:\program files\Fast Browser Search\IE\uninstall.exe

c:\program files\Fast Browser Search\IE\uninstalSGP.exe

c:\program files\Fast Browser Search\IE\uninstalSGPU.exe

c:\program files\Fast Browser Search\IE\update.exe

c:\program files\Fast Browser Search\IE\version.txt

c:\program files\Search Guard Plus

c:\program files\Search Guard Plus\fbsProtection.xml

c:\program files\Search Guard Plus\fbsSearchProvider.xml

c:\program files\Search Guard Plus\FbsSearchProviderIE8.exe

c:\program files\Search Guard Plus\SearchGuardPlus.exe

c:\program files\Search Guard Plus\SearchGuardPlus.ico

c:\program files\Search Guard Plus\uninstalSGP.exe

c:\program files\Search Guard PlusU

c:\program files\Search Guard PlusU\SGPU.ico

c:\program files\Search Guard PlusU\sgpUpdater.exe

c:\program files\Search Guard PlusU\sgpUpdater.xml

c:\program files\Search Guard PlusU\sgpUpdaters.exe

c:\program files\Search Guard PlusU\uninstalSGPU.exe

c:\program files\SGPSA

c:\windows\$NtUninstallMTF1011$

c:\windows\$NtUninstallMTF1011$\apUninstall.exe

c:\windows\$NtUninstallMTF1011$\zrpt.xml

c:\windows\Downloaded Program Files\setup.dll

c:\windows\system32\5778.dll

c:\windows\system32\azllyit.dll

c:\windows\system32\drivers\aaqrzdrr.sys

c:\windows\system32\drivers\qbzcfizi.sys

c:\windows\system32\fyxigvc.dll

c:\windows\system32\ntlcp.dll

c:\windows\system32\rtlcp.dll

c:\windows\system32\winsrc.dll.tmp

Besmet exemplaar van c:\windows\system32\drivers\dmload.sys werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - Kitty had a snack

Besmet exemplaar van c:\windows\explorer.exe werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\ServicePackFiles\i386\explorer.exe

Besmet exemplaar van c:\windows\system32\winlogon.exe werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\ServicePackFiles\i386\winlogon.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_AAQRZDRR

-------\Legacy_WWTTVCNO

-------\Service_aaqrzdrr

-------\Service_wwttvcno

(((((((((((((((((((( Bestanden Gemaakt van 2010-07-16 to 2010-08-16 ))))))))))))))))))))))))))))))

.

2010-08-16 09:24 . 2010-08-16 09:29 -------- d-----w- c:\windows\system32\MpEngineStore

2010-08-15 14:36 . 2010-08-15 14:39 -------- d-----w- c:\program files\ResultDns

2010-08-15 14:36 . 2010-08-15 14:38 -------- d-----w- c:\documents and settings\All Users\Application Data\ResultDns

2010-08-15 14:36 . 2010-08-15 14:36 210816 -c--a-w- c:\windows\system32\dllcache\ndis.sys

2010-08-15 14:36 . 2010-08-16 10:35 781824 ----a-w- c:\windows\system32\drivers\dhkbfuap.sys

2010-08-01 19:37 . 2010-08-01 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\CodedColor Common

2010-08-01 19:37 . 2010-08-04 18:59 -------- d-----w- c:\documents and settings\Anouk\Application Data\fotoalbums-maken Publisher

2010-08-01 19:37 . 2010-08-01 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\fotoalbums-maken Publisher

2010-08-01 19:37 . 2010-08-01 19:37 -------- d-----w- c:\program files\fotoalbums-maken Publisher

2010-07-30 13:03 . 2010-07-30 13:03 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2010-07-30 13:03 . 2010-07-30 13:03 -------- d-----w- c:\program files\Common Files\Skype

2010-07-29 19:15 . 2010-07-29 19:15 -------- d-----w- c:\program files\DAEMON Tools Lite

2010-07-29 19:14 . 2010-07-30 13:07 -------- d-----w- c:\documents and settings\Anouk\Application Data\DAEMON Tools Lite

2010-07-29 19:14 . 2010-07-29 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

2010-07-29 16:53 . 2010-07-29 16:53 -------- d-----w- c:\documents and settings\Roeland\Application Data\Apple Computer

2010-07-29 16:53 . 2010-07-29 16:53 -------- d-----w- c:\documents and settings\Roeland\Local Settings\Application Data\Apple Computer

2010-07-27 19:12 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2010-07-27 19:12 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2010-07-27 19:10 . 2010-07-27 19:10 -------- d-----w- c:\program files\iPod

2010-07-27 19:09 . 2010-07-27 19:43 -------- d-----w- c:\program files\iTunes

2010-07-27 19:09 . 2010-07-27 19:12 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-07-27 18:59 . 2010-07-27 20:18 -------- d-----w- c:\documents and settings\Anouk\Application Data\LimeWire

2010-07-27 18:58 . 2010-07-27 18:58 -------- d-----w- c:\program files\Apple Software Update

2010-07-27 18:57 . 2010-04-19 18:47 3062048 ----a-w- c:\windows\system32\usbaaplrc.dll

2010-07-27 18:57 . 2010-04-19 18:47 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2010-07-27 18:54 . 2010-07-27 19:10 -------- d-----w- c:\program files\Common Files\Apple

2010-07-26 19:12 . 2010-07-26 19:12 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Azureus

2010-07-25 08:53 . 2010-07-25 08:53 -------- d-----w- C:\Brokeback Mountain(subs Ned.)(2Lions-Team)

2010-07-17 15:30 . 2010-08-15 13:58 -------- d-----w- c:\documents and settings\Anouk\Application Data\Raptr

2010-07-17 15:30 . 2010-08-15 13:55 -------- d-----w- c:\program files\Raptr

2010-07-17 15:08 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

2010-07-17 15:08 . 2010-06-24 12:27 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-15 14:52 . 2006-10-29 12:42 -------- d-----w- c:\documents and settings\Anouk\Application Data\Azureus

2010-08-15 14:52 . 2008-02-17 16:05 -------- d-----w- c:\documents and settings\Anouk\Application Data\Skype

2010-08-15 14:36 . 2010-08-15 14:36 737280 ----a-w- c:\documents and settings\Anouk\Application Data\Microsoft\Windows\jnipmo.exe

2010-08-15 14:01 . 2008-02-17 16:08 -------- d-----w- c:\documents and settings\Anouk\Application Data\skypePM

2010-08-15 13:58 . 2010-08-15 13:58 1251 ----a-w- c:\documents and settings\Anouk\Application Data\Raptr\config\certificates\x509\tls_peers\guestchat.raptr.com

2010-08-15 13:57 . 2010-08-15 13:57 96784 ----a-w- c:\windows\system32\WPRO_40_1340woem.tmp

2010-08-15 13:57 . 2010-08-15 13:57 109072 ----a-w- c:\windows\system32\WPRO_40_1340woem_nm.tmp

2010-08-15 13:54 . 2010-08-15 13:50 24800392 ----a-w- c:\documents and settings\Anouk\Application Data\Raptr\raptr-1.0.8-r42343-release.exe

2010-08-14 02:19 . 2010-08-15 14:38 57608 ----a-w- c:\documents and settings\All Users\Application Data\ResultDns\resultdns111.exe

2010-07-30 14:30 . 2009-10-10 12:37 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink

2010-07-30 13:03 . 2008-02-17 16:04 -------- d-----r- c:\program files\Skype

2010-07-30 13:03 . 2008-02-17 16:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2010-07-29 19:15 . 2006-10-22 14:27 691696 ----a-w- c:\windows\system32\drivers\sptd.sys

2010-07-28 18:55 . 2006-10-28 10:38 -------- d-----w- c:\program files\LimeWire

2010-07-27 19:26 . 2009-05-01 09:30 -------- d-----w- c:\documents and settings\Anouk\Application Data\Apple Computer

2010-07-27 19:09 . 2008-10-03 18:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-07-27 19:07 . 2009-05-01 09:31 -------- d-----w- c:\program files\QuickTime

2010-07-27 18:56 . 2009-05-22 12:36 -------- d-----w- c:\program files\Bonjour

2010-07-21 14:30 . 2010-07-21 14:30 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe

2010-07-17 15:22 . 2006-10-29 12:42 -------- d-----w- c:\program files\Azureus

2010-07-17 15:18 . 2010-07-17 15:18 503808 ----a-w- c:\documents and settings\Anouk\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4f2be0fa-n\msvcp71.dll

2010-07-17 15:18 . 2010-07-17 15:18 499712 ----a-w- c:\documents and settings\Anouk\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4f2be0fa-n\jmc.dll

2010-07-17 15:18 . 2010-07-17 15:18 348160 ----a-w- c:\documents and settings\Anouk\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-4f2be0fa-n\msvcr71.dll

2010-07-14 00:43 . 2010-07-14 00:43 40581 ----a-w- c:\windows\system32\etlcp.exe

2010-06-30 12:33 . 2006-09-30 06:20 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-24 12:27 . 2006-09-30 06:20 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-24 09:02 . 2006-09-30 06:20 1852032 ----a-w- c:\windows\system32\win32k.sys

2010-06-21 15:27 . 2006-09-30 06:20 354304 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-17 14:03 . 2006-09-30 06:20 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 14:31 . 2006-09-30 04:31 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-14 07:43 . 2006-09-30 06:20 1172480 ----a-w- c:\windows\system32\msxml3.dll

2010-05-18 14:35 . 2010-05-18 14:35 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-05-18 14:35 . 2010-05-18 14:35 75040 ----a-w- c:\windows\system32\jdns_sd.dll

2010-05-18 14:35 . 2010-05-18 14:35 197920 ----a-w- c:\windows\system32\dnssdX.dll

2010-05-18 14:35 . 2010-05-18 14:35 107808 ----a-w- c:\windows\system32\dns-sd.exe

2007-08-06 13:04 . 2007-08-06 13:04 16 ---ha-w- c:\program files\Common Files\mxfilerelatedcache.mxc2

2007-07-22 08:10 . 2007-07-22 08:10 16 ---ha-w- c:\program files\mxfilerelatedcache.mxc2

.

------- Sigcheck -------

[-] 2010-08-15 14:36 . 5B2D50A1E3B574DF5D446E2B37E1C54C . 210816 . . [------] . . c:\windows\system32\dllcache\ndis.sys

[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys

[-] 2004-09-02 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys

[7] 2008-04-14 . 1247D4D5444E28519BBE31BE8AB4C029 . 510464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe

[-] 2008-04-14 . E397F3EE2B3195705FD8696767E11B71 . 510464 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2004-09-02 . 732ED791711DF9C9DD15E5515BC681B8 . 504832 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

[-] 2008-04-14 . 8C8FF2129962D9E27826FA5F6FB01514 . 1037312 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[7] 2008-04-14 . AA04F042A820BF1868E643575887E1A6 . 1037312 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2007-06-13 . 1D6245AFBD3FAABC16A885116BE1874D . 1036800 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe

[-] 2005-04-07 . 9ADEF99545650835A162E28A3850A78F . 1035776 . . [6.00.2900.2649] . . c:\windows\$NtUninstallKB938828$\explorer.exe

[-] 2004-09-02 . A1D7304A87FC3093150F5E3CC7B0F338 . 1035776 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB884883$\explorer.exe

c:\windows\System32\drivers\ndis.sys ... is niet aanwezig !!

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Anouk\Menu Start\Programma's\Opstarten\

Microsoft Office Snelzoeken.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-2-3 111376]

Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-6-14 479232]

Office Opstarten.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-2-3 51984]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-20 113664]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

HP Photosmart Premier Snelstart.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\Azureus\\Azureus.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5000:UDP"= 5000:UDP:Azur2

"50000:TCP"= 50000:TCP:Azur3

"50001:TCP"= 50001:TCP:Limewire

"50001:UDP"= 50001:UDP:Limewire

"1222:UDP"= 1222:UDP:Windows Media Format SDK (iexplore.exe)

"1223:UDP"= 1223:UDP:Windows Media Format SDK (iexplore.exe)

"1224:UDP"= 1224:UDP:Windows Media Format SDK (iexplore.exe)

"1164:UDP"= 1164:UDP:Windows Media Format SDK (iexplore.exe)

"1165:UDP"= 1165:UDP:Windows Media Format SDK (iexplore.exe)

"1166:UDP"= 1166:UDP:Windows Media Format SDK (iexplore.exe)

R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [20-10-2004 5:47 98304]

R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [20-10-2004 4:40 118784]

R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i;c:\windows\system32\drivers\3xHybrid.sys [30-9-2006 8:23 882688]

S1 fvpenygg;fvpenygg;\??\c:\windows\system32\drivers\fvpenygg.sys --> c:\windows\system32\drivers\fvpenygg.sys [?]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7-2-2010 12:25 135664]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [?]

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\magix\Common\Database\bin\fbserver.exe [18-10-2006 20:17 1527900]

S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.SYS [14-5-2007 11:26 508288]

S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [30-9-2006 8:23 215040]

S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [15-6-2007 12:45 544768]

S3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys --> c:\windows\system32\drivers\WPRO_40_1340.sys [?]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22-10-2006 16:27 691696]

--- Andere Services/Drivers In Geheugen ---

*NewlyCreated* - AAQRZDRR

*Deregistered* - aaqrzdrr

*Deregistered* - dhkbfuap

.

Inhoud van de 'Gedeelde Taken' map

2010-07-27 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 10:25]

2010-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 10:25]

2010-08-16 c:\windows\Tasks\User_Feed_Synchronization-{01BFF0CA-738F-4E87-AEE3-17E4831152FE}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2010-08-07 c:\windows\Tasks\{48F11D9E-A59C-44E3-AC29-D5CCE2C2FFB0}_VANMEERVELD_Roeland.job

- c:\windows\system32\mobsync.exe [2006-09-30 17:03]

.

------- Bijkomende Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:6522

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Locate Spot on Map by GPS - c:\program files\Opanda\IExif 2.3\IExifMap.htm

IE: View Exif/GPS/IPTC with IExif - c:\program files\Opanda\IExif 2.3\IExifCom.htm

DPF: {63D6DD13-C913-466D-9444-9357561E4D94} - hxxp://www.mijnalbum.nl/v3/skinsrc/core/system/ma5.8.3/uploadtoepassing.cab

.

- - - - ORPHANS VERWIJDERD - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll

WebBrowser-{9C510AD2-D476-4F5A-9566-504CE5690F86} - c:\windows\system32\5778.dll

AddRemove-$NtUninstallMTF1011$ - c:\windows\$NtUninstallMTF1011$\apUninstall.exe

AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe

AddRemove-GabPath - c:\documents and settings\Anouk\Application Data\GabPath\GPUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-08-16 12:34

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dhkbfuap]

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(1308)

c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll

c:\program files\Common Files\Ahead\Lib\MFC71U.DLL

c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll

c:\windows\system32\msls31.dll

c:\windows\system32\webcheck.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\IoctlSvc.exe

c:\windows\System32\PAStiSvc.exe

c:\windows\system32\dllhost.exe

c:\windows\system32\wscntfy.exe

c:\program files\HP\Digital Imaging\bin\hpqimzone.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\windows\system32\msiexec.exe

.

**************************************************************************

.

Voltooingstijd: 2010-08-16 12:43:08 - machine werd herstart

ComboFix-quarantined-files.txt 2010-08-16 10:43

Pre-Run: 7.264.456.704 bytes beschikbaar

Post-Run: 11.224.383.488 bytes beschikbaar

- - End Of File - - 9C2F03DB669E073025CCFBCEA9ABAAB4

kape · 16 augustus 2010

Oeps ... Combofix heeft wel een berg rotzooi van de PC gehaald.

Vraagje : heb je momenteel eigenlijk nog een actieve virusscanner (die niet vervallen is) op deze PC ? En zo ja, welke dan ?

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522

O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)

O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\drivers\dhkbfuap.sys

c:\windows\system32\drivers\fvpenygg.sys

c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys

Driver::

dhkbfuap

fvpenygg

EraserUtilRebootDrv

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Kuona79 · 16 augustus 2010

ComboFix 10-08-15.02 - Anouk 16-08-2010 20:28:02.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.1023.658 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Anouk\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Anouk\Bureaublad\CFScript.txt

AV: Norton Internet Security 2006 *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security 2006 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

FILE ::

"c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys"

"c:\windows\system32\drivers\dhkbfuap.sys"

"c:\windows\system32\drivers\fvpenygg.sys"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\dhkbfuap.sys

Besmet exemplaar van c:\windows\explorer.exe werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\ServicePackFiles\i386\explorer.exe

Besmet exemplaar van c:\windows\system32\winlogon.exe werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\ServicePackFiles\i386\winlogon.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_DHKBFUAP

-------\Legacy_ERASERUTILREBOOTDRV

-------\Service_dhkbfuap

-------\Service_EraserUtilRebootDrv

-------\Service_fvpenygg

(((((((((((((((((((( Bestanden Gemaakt van 2010-07-16 to 2010-08-16 ))))))))))))))))))))))))))))))

.

2010-08-16 09:24 . 2010-08-16 09:29 -------- d-----w- c:\windows\system32\MpEngineStore

2010-08-15 14:38 . 2010-08-14 02:19 57608 ----a-w- c:\documents and settings\All Users\Application Data\ResultDns\resultdns111.exe

2010-08-15 14:36 . 2010-08-15 14:36 737280 ----a-w- c:\documents and settings\Anouk\Application Data\Microsoft\Windows\jnipmo.exe

2010-08-15 14:36 . 2010-08-15 14:39 -------- d-----w- c:\program files\ResultDns

2010-08-15 14:36 . 2010-08-15 14:38 -------- d-----w- c:\documents and settings\All Users\Application Data\ResultDns

2010-08-15 14:36 . 2010-08-15 14:36 210816 -c--a-w- c:\windows\system32\dllcache\ndis.sys

2010-08-15 13:58 . 2010-08-15 13:58 1251 ----a-w- c:\documents and settings\Anouk\Application Data\Raptr\config\certificates\x509\tls_peers\guestchat.raptr.com

2010-08-15 13:50 . 2010-08-15 13:54 24800392 ----a-w- c:\documents and settings\Anouk\Application Data\Raptr\raptr-1.0.8-r42343-release.exe