Trojan downloader Win32/unruy.H

kape · 5 december 2010

Dit is wel een heel beperkt logje ? Wil je de scanner nog eens late runnen en dan een nieuw logje plaatsen ?

henkjee · 6 december 2010

Ik heb 't opnieuw geprobeerd maar het logje geeft hetzelfde aan en ik kan nergens een ander logje vinden!

henkjee · 7 december 2010

D:\HENK-PC\Backup Set 2010-11-20 003223\Backup Files 2010-11-20 003223\Backup files 1.zip multiple threats deleted - quarantined

dit is de gevonden "threats" van de ESET online scanner, dit is 't enige wat ik nog iets van een log heb kunnen maken/vinden

kape · 8 december 2010

Dat is geen goed nieuws (niet helemaal onlogisch, maar toch beter niet ...), want dat betekent dat ook je backups volledig besmet en dus onbruikbaar zouden zijn.

Laat de trialversie van Vipre eens los op je PC. Kunnen we eens kijken wat die te vertellen heeft ?

henkjee · 13 december 2010

Ik heb dat vipre gebruikt, maar die scan duurde wel meer dan een dag ofzo als ik 'm door liet gaan? en mijn computer werd er zo sloom van dat ik er 3 dagen over gedaan heb om Vipre weer te kunnen verwijderen! Vipre had in 't begin wel 3 dingen verwijderd die zeer schadelijk waren stond er en 800 bestanden met het gevaren niveau "low" gevonden. Maar hij heeft dus niet alles gescand..

kape · 13 december 2010

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Indien je problemen hebt bij het uitvoeren van ComboFix, gelieve dit te melden.

henkjee · 13 december 2010

ComboFix 10-12-13.02 - henk 14-12-2010 0:07.1.8 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.31.1043.18.4084.2850 [GMT 1:00]

Gestart vanuit: c:\users\henk\Desktop\ComboFix.exe

AV: McAfee Antivirus en antispyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee Antivirus en antispyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\henk\Desktop\Internet Explorer.lnk

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-11-13 to 2010-12-13 ))))))))))))))))))))))))))))))

.

2010-12-13 23:13 . 2010-12-13 23:13 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-12-13 14:39 . 2010-11-16 11:01 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{916E6147-FB0D-45E4-B2B4-EC1AF053CF4B}\mpengine.dll

2010-12-08 18:48 . 2010-12-08 18:48 -------- d-----w- c:\programdata\Sunbelt

2010-12-08 18:46 . 2010-08-20 08:18 27472 ----a-w- c:\windows\system32\sbbd.exe

2010-12-08 18:46 . 2010-03-22 11:11 49752 ----a-w- c:\windows\system32\drivers\sbredrv.sys

2010-12-04 17:17 . 2010-12-04 17:17 -------- d-----w- c:\program files (x86)\ESET

2010-11-29 23:06 . 2010-11-29 23:06 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared

2010-11-28 12:20 . 2010-11-28 13:02 -------- d-----w- c:\programdata\WinZip

2010-11-27 18:08 . 2010-11-28 12:59 -------- d-----w- c:\users\henk\DoctorWeb

2010-11-27 14:17 . 2010-12-13 17:29 -------- d-----w- c:\program files (x86)\Steam

2010-11-24 22:07 . 2010-11-24 22:19 -------- d-----w- c:\users\henk\AppData\Local\Deployment

2010-11-24 22:07 . 2010-11-24 22:07 -------- d-----w- c:\users\henk\AppData\Local\Apps

2010-11-24 13:14 . 2010-11-24 22:29 -------- d-----w- c:\users\henk\AppData\Local\ElevatedDiagnostics

2010-11-24 09:06 . 2010-10-19 08:47 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll

2010-11-24 09:06 . 2010-10-19 08:10 7680 ----a-w- c:\program files (x86)\Internet Explorer\iecompat.dll

2010-11-23 08:23 . 2010-11-23 08:23 -------- d-----w- c:\users\henk\AppData\Roaming\Malwarebytes

2010-11-23 08:23 . 2010-11-23 08:23 -------- d-----w- c:\programdata\Malwarebytes

2010-11-23 08:23 . 2010-04-29 14:39 24664 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-22 17:16 . 2010-11-22 17:16 388096 ----a-r- c:\users\henk\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2010-11-22 17:16 . 2010-11-22 17:16 -------- d-----w- c:\program files (x86)\TrendMicro

2010-11-21 01:21 . 2010-11-21 01:21 -------- d-----w- c:\windows\nl

2010-11-21 01:16 . 2010-11-21 01:16 -------- d-----w- c:\program files\Windows Live

2010-11-21 01:12 . 2009-09-04 16:44 69464 ----a-w- c:\windows\SysWow64\XAPOFX1_3.dll

2010-11-21 01:12 . 2009-09-04 16:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll

2010-11-21 01:12 . 2009-09-04 16:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll

2010-11-21 01:12 . 2009-09-04 16:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll

2010-11-21 01:12 . 2010-11-21 01:12 469256 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\2a2a57521cb891907\InstallManager_WLE_WLE.exe

2010-11-21 01:12 . 2010-11-21 01:12 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\25879c6e1cb891906\DXSETUP.exe

2010-11-21 01:12 . 2010-11-21 01:12 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\25879c6e1cb891906\dsetup32.dll

2010-11-21 01:12 . 2010-11-21 01:12 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\25879c6e1cb891906\DSETUP.dll

2010-11-21 01:12 . 2010-11-21 01:12 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\1f5f02541cb891905\DSETUP.dll

2010-11-21 01:12 . 2010-11-21 01:12 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\1f5f02541cb891905\DXSETUP.exe

2010-11-21 01:12 . 2010-11-21 01:12 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\1f5f02541cb891905\dsetup32.dll

2010-11-19 23:01 . 2010-10-19 09:41 270720 ------w- c:\windows\system32\MpSigStub.exe

2010-11-19 22:48 . 2010-12-13 21:13 -------- d-----w- c:\users\henk\AppData\Local\Windows Live

2010-11-19 22:47 . 2010-05-23 08:35 206848 ----a-w- c:\windows\system32\mfps.dll

2010-11-19 22:47 . 2010-05-23 10:15 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL

2010-11-19 22:47 . 2010-05-23 10:11 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll

2010-11-19 22:47 . 2010-05-23 08:37 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL

2010-11-19 22:47 . 2010-05-23 08:35 257024 ----a-w- c:\windows\system32\mfreadwrite.dll

2010-11-19 22:47 . 2010-05-23 10:11 3181568 ----a-w- c:\windows\SysWow64\mf.dll

2010-11-19 22:47 . 2010-05-23 08:35 4068864 ----a-w- c:\windows\system32\mf.dll

2010-11-19 17:14 . 2010-11-26 17:19 -------- d-----w- c:\users\henk\AppData\Roaming\Azureus

2010-11-15 02:02 . 2010-11-15 02:02 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help

2010-11-14 18:58 . 2010-11-15 02:02 -------- d-----w- c:\program files (x86)\Microsoft Works

2010-11-14 18:54 . 2010-11-14 18:54 -------- d-----w- c:\users\henk\AppData\Local\Microsoft Help

2010-11-14 18:54 . 2010-11-17 02:04 -------- d-----w- c:\programdata\Microsoft Help

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-13 21:28 . 2010-09-16 15:16 9984 ----a-w- c:\windows\system32\drivers\mfeclnk.sys

2010-10-13 21:28 . 2010-01-05 23:04 94864 ----a-w- c:\windows\system32\drivers\mferkdet.sys

2010-10-13 21:28 . 2010-01-05 23:04 75032 ----a-w- c:\windows\system32\drivers\mfenlfk.sys

2010-10-13 21:28 . 2010-01-05 23:04 62800 ----a-w- c:\windows\system32\drivers\cfwids.sys

2010-10-13 21:28 . 2010-01-05 23:04 529128 ----a-w- c:\windows\system32\drivers\mfehidk.sys

2010-10-13 21:28 . 2010-01-05 23:04 441328 ----a-w- c:\windows\system32\drivers\mfefirek.sys

2010-10-13 21:28 . 2010-01-05 23:04 283360 ----a-w- c:\windows\system32\drivers\mfewfpk.sys

2010-10-13 21:28 . 2010-01-05 23:04 190136 ----a-w- c:\windows\system32\drivers\mfeavfk.sys

2010-10-13 21:28 . 2010-01-05 23:04 121248 ----a-w- c:\windows\system32\drivers\mfeapfk.sys

2010-09-22 23:47 . 2010-09-22 23:47 49016 ----a-w- c:\windows\SysWow64\sirenacm.dll

2010-09-21 13:49 . 2010-09-21 13:49 252800 ----a-w- c:\windows\system32\LIVESSP.DLL

2010-09-21 13:03 . 2010-09-21 13:03 208768 ----a-w- c:\windows\SysWow64\LIVESSP.DLL

2010-09-16 17:36 . 2010-09-16 17:36 51712 ----a-w- c:\windows\system32\drivers\usbehci.sys

2010-09-16 17:36 . 2010-09-16 17:36 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys

2010-09-16 17:36 . 2010-09-16 17:36 243712 ----a-w- c:\windows\system32\drivers\ks.sys

2010-09-16 17:36 . 2010-09-16 17:36 184832 ----a-w- c:\windows\system32\drivers\usbvideo.sys

2010-09-16 17:36 . 2010-09-16 17:36 286720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2010-09-16 17:36 . 2010-09-16 17:36 157696 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-09-16 17:36 . 2010-09-16 17:36 125952 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2010-09-16 17:36 . 2010-09-16 17:36 70656 ----a-w- c:\windows\SysWow64\fontsub.dll

2010-09-16 17:36 . 2010-09-16 17:36 46592 ----a-w- c:\windows\system32\msasn1.dll

2010-09-16 17:36 . 2010-09-16 17:36 46080 ----a-w- c:\windows\system32\atmlib.dll

2010-09-16 17:36 . 2010-09-16 17:36 366080 ----a-w- c:\windows\system32\atmfd.dll

2010-09-16 17:36 . 2010-09-16 17:36 34816 ----a-w- c:\windows\SysWow64\msasn1.dll

2010-09-16 17:36 . 2010-09-16 17:36 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2010-09-16 17:36 . 2010-09-16 17:36 293888 ----a-w- c:\windows\SysWow64\atmfd.dll

2010-09-16 17:36 . 2010-09-16 17:36 100864 ----a-w- c:\windows\system32\fontsub.dll

2010-09-16 17:36 . 2010-09-16 17:36 91648 ----a-w- c:\windows\SysWow64\avifil32.dll

2010-09-16 17:36 . 2010-09-16 17:36 84480 ----a-w- c:\windows\SysWow64\mciavi32.dll

2010-09-16 17:36 . 2010-09-16 17:36 7680 ----a-w- c:\windows\SysWow64\instnm.exe

2010-09-16 17:36 . 2010-09-16 17:36 54272 ----a-w- c:\windows\system32\iyuv_32.dll

2010-09-16 17:36 . 2010-09-16 17:36 5120 ----a-w- c:\windows\SysWow64\wow32.dll

2010-09-16 17:36 . 2010-09-16 17:36 50176 ----a-w- c:\windows\SysWow64\iyuv_32.dll

2010-09-16 17:36 . 2010-09-16 17:36 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2010-09-16 17:36 . 2010-09-16 17:36 38912 ----a-w- c:\windows\system32\msvidc32.dll

2010-09-16 17:36 . 2010-09-16 17:36 31744 ----a-w- c:\windows\SysWow64\msvidc32.dll

2010-09-16 17:36 . 2010-09-16 17:36 311808 ----a-w- c:\windows\system32\msv1_0.dll

2010-09-16 17:36 . 2010-09-16 17:36 257024 ----a-w- c:\windows\SysWow64\msv1_0.dll

2010-09-16 17:36 . 2010-09-16 17:36 25600 ----a-w- c:\windows\SysWow64\setup16.exe

2010-09-16 17:36 . 2010-09-16 17:36 25088 ----a-w- c:\windows\system32\msyuv.dll

2010-09-16 17:36 . 2010-09-16 17:36 243200 ----a-w- c:\windows\system32\wow64.dll

2010-09-16 17:36 . 2010-09-16 17:36 22016 ----a-w- c:\windows\SysWow64\msyuv.dll

2010-09-16 17:36 . 2010-09-16 17:36 2048 ----a-w- c:\windows\SysWow64\user.exe

2010-09-16 17:36 . 2010-09-16 17:36 16384 ----a-w- c:\windows\system32\msrle32.dll

2010-09-16 17:36 . 2010-09-16 17:36 1572352 ----a-w- c:\windows\system32\quartz.dll

2010-09-16 17:36 . 2010-09-16 17:36 14848 ----a-w- c:\windows\system32\tsbyuv.dll

2010-09-16 17:36 . 2010-09-16 17:36 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll

2010-09-16 17:36 . 2010-09-16 17:36 13312 ----a-w- c:\windows\SysWow64\msrle32.dll

2010-09-16 17:36 . 2010-09-16 17:36 1328640 ----a-w- c:\windows\SysWow64\quartz.dll

2010-09-16 17:36 . 2010-09-16 17:36 12288 ----a-w- c:\windows\SysWow64\tsbyuv.dll

2010-09-16 17:36 . 2010-09-16 17:36 389632 ----a-w- c:\windows\system32\winlogon.exe

2010-09-16 17:36 . 2010-09-16 17:36 2870272 ----a-w- c:\windows\explorer.exe

2010-09-16 17:36 . 2010-09-16 17:36 2614272 ----a-w- c:\windows\SysWow64\explorer.exe

2010-09-16 17:35 . 2010-09-16 17:35 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2010-09-16 17:35 . 2010-09-16 17:35 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2010-09-16 17:35 . 2010-09-16 17:35 153160 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2010-09-16 17:35 . 2010-09-16 17:35 1446912 ----a-w- c:\windows\system32\lsasrv.dll

2010-09-16 17:35 . 2010-09-16 17:35 613888 ----a-w- c:\windows\system32\psisdecd.dll

2010-09-16 17:35 . 2010-09-16 17:35 612352 ----a-w- c:\windows\system32\vbscript.dll

2010-09-16 17:35 . 2010-09-16 17:35 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll

2010-09-16 17:35 . 2010-09-16 17:35 427520 ----a-w- c:\windows\SysWow64\vbscript.dll

2010-09-16 17:35 . 2010-09-16 17:35 976896 ----a-w- c:\windows\system32\inetcomm.dll

2010-09-16 17:35 . 2010-09-16 17:35 85504 ----a-w- c:\windows\SysWow64\secproc_ssp_isv.dll

2010-09-16 17:35 . 2010-09-16 17:35 85504 ----a-w- c:\windows\SysWow64\secproc_ssp.dll

2010-09-16 17:35 . 2010-09-16 17:35 740864 ----a-w- c:\windows\SysWow64\inetcomm.dll

2010-09-16 17:35 . 2010-09-16 17:35 424960 ----a-w- c:\windows\system32\secproc.dll

2010-09-16 17:35 . 2010-09-16 17:35 422912 ----a-w- c:\windows\system32\secproc_isv.dll

2010-09-16 17:35 . 2010-09-16 17:35 369152 ----a-w- c:\windows\SysWow64\secproc.dll

2010-09-16 17:35 . 2010-09-16 17:35 365568 ----a-w- c:\windows\SysWow64\secproc_isv.dll

2010-09-16 17:35 . 2010-09-16 17:35 357888 ----a-w- c:\windows\system32\RMActivate_isv.exe

2010-09-16 17:35 . 2010-09-16 17:35 356352 ----a-w- c:\windows\system32\RMActivate.exe

2010-09-16 17:35 . 2010-09-16 17:35 324608 ----a-w- c:\windows\SysWow64\RMActivate_isv.exe

2010-09-16 17:35 . 2010-09-16 17:35 320512 ----a-w- c:\windows\SysWow64\RMActivate.exe

2010-09-16 17:35 . 2010-09-16 17:35 306688 ----a-w- c:\windows\system32\RMActivate_ssp.exe

2010-09-16 17:35 . 2010-09-16 17:35 305152 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe

2010-09-16 17:35 . 2010-09-16 17:35 280064 ----a-w- c:\windows\SysWow64\RMActivate_ssp.exe

2010-09-16 17:35 . 2010-09-16 17:35 277504 ----a-w- c:\windows\SysWow64\RMActivate_ssp_isv.exe

2010-09-16 17:35 . 2010-09-16 17:35 121856 ----a-w- c:\windows\system32\secproc_ssp_isv.dll

2010-09-16 17:35 . 2010-09-16 17:35 121856 ----a-w- c:\windows\system32\secproc_ssp.dll

2010-09-16 17:35 . 2010-09-16 17:35 982600 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2010-09-16 17:35 . 2010-09-16 17:35 84992 ----a-w- c:\windows\system32\asycfilt.dll

2010-09-16 17:35 . 2010-09-16 17:35 67584 ----a-w- c:\windows\SysWow64\asycfilt.dll

2010-09-16 17:35 . 2010-09-16 17:35 220672 ----a-w- c:\windows\system32\wintrust.dll

2010-09-16 17:35 . 2010-09-16 17:35 1975296 ----a-w- c:\windows\system32\CertEnroll.dll

2010-09-16 17:35 . 2010-09-16 17:35 172032 ----a-w- c:\windows\SysWow64\wintrust.dll

2010-09-16 17:35 . 2010-09-16 17:35 14336 ----a-w- c:\windows\system32\drivers\sffp_sd.sys

2010-09-16 17:35 . 2010-09-16 17:35 139264 ----a-w- c:\windows\system32\cabview.dll

2010-09-16 17:35 . 2010-09-16 17:35 132608 ----a-w- c:\windows\SysWow64\cabview.dll

2010-09-16 17:35 . 2010-09-16 17:35 1320960 ----a-w- c:\windows\SysWow64\CertEnroll.dll

2010-09-16 17:35 . 2010-09-16 17:35 91648 ----a-w- c:\windows\system32\isoburn.exe

2010-09-16 17:35 . 2010-09-16 17:35 86528 ----a-w- c:\windows\SysWow64\isoburn.exe

2010-09-16 17:35 . 2010-09-16 17:35 78848 ----a-w- c:\windows\system32\WUDFSvc.dll

2010-09-16 17:35 . 2010-09-16 17:35 687616 ----a-w- c:\windows\system32\WUDFx.dll

2010-09-16 17:35 . 2010-09-16 17:35 630272 ----a-w- c:\windows\system32\evr.dll

2010-09-16 17:35 . 2010-09-16 17:35 488448 ----a-w- c:\windows\SysWow64\evr.dll

2010-09-16 17:35 . 2010-09-16 17:35 44544 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

2010-09-16 17:35 . 2010-09-16 17:35 228864 ----a-w- c:\windows\system32\WUDFHost.exe

2010-09-16 17:35 . 2010-09-16 17:35 228352 ----a-w- c:\windows\system32\drivers\1394ohci.sys

2010-09-16 17:35 . 2010-09-16 17:35 183808 ----a-w- c:\windows\system32\WUDFPlatform.dll

2010-09-16 17:35 . 2010-09-16 17:35 172544 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

.

<pre>
c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart .exe
c:\program files (x86)\DivX\DivX Update\DivXUpdate .exe
c:\program files (x86)\Windows Live\Messenger\msnmsgr  .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]

"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-09-22 4240760]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2010-11-27 1242448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1484856]

"dellsupportcenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [N/A]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-07-21 165184]

"DSUpdateLauncher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" [2010-07-21 18240]

c:\users\henk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Schermopname en Snel starten.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-10-13 94864]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-23 1255736]

R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2010-03-10 355440]

S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-10-13 283360]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-08-12 55856]

S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-10-13 75032]

S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2010-03-22 49752]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe [2009-03-02 89600]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-12 202752]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 355440]

S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 355440]

S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2010-03-10 355440]

S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-10-13 245352]

S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2010-10-13 149032]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 13784]

S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Acceler.sys [2009-09-17 23912]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-04-12 6405120]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-04-12 188928]

S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-10-13 62800]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 172704]

S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-10-13 441328]

S3 O2MDGRDR;O2MDGRDR;c:\windows\system32\DRIVERS\o2mdgx64.sys [2009-11-13 74272]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-22 215040]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-04-23 721768]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-04-23 269672]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-04-23 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-04-23 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]

--- Andere Services/Drivers In Geheugen ---

*NewlyCreated* - MFEAPFK01

*Deregistered* - mfeapfk01

*Deregistered* - mfeavfk01

.

Inhoud van de 'Gedeelde Taken' map

.

--------- x86-64 -----------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe" [N/A]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-01-20 487424]

"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]

"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2010-06-09 3216544]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"SBRegRebootCleaner"="c:\program files (x86)\Sunbelt Software\VIPRE\SBRC.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://hyves.nl/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000

.

- - - - ORPHANS VERWIJDERD - - - -

Toolbar-Locked - (no file)

WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)

WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,91,02,75,a6,18,50,49,b0,09,db,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,91,02,75,a6,18,50,49,b0,09,db,\

[HKEY_USERS\S-1-5-21-3246235719-1228998758-3747656504-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

[HKEY_USERS\S-1-5-21-3246235719-1228998758-3747656504-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"

"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"

"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2010-12-14 00:18:21

ComboFix-quarantined-files.txt 2010-12-13 23:18

Pre-Run: 450.419.965.952 bytes beschikbaar

Post-Run: 450.457.137.152 bytes beschikbaar

- - End Of File - - 0E8D3CCBDFD1A34A6FA180BDD380A1D8

kape · 14 december 2010

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Renv::

c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl .exe

c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart .exe

c:\program files (x86)\DivX\DivX Update\DivXUpdate .exe

c:\program files (x86)\Windows Live\Messenger\msnmsgr .exe

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

henkjee · 21 december 2010

ComboFix 10-12-21.01 - henk 21-12-2010 20:45:14.2.8 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.31.1043.18.4084.2896 [GMT 1:00]

Gestart vanuit: c:\users\henk\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\henk\Desktop\CFScript.txt

AV: McAfee Antivirus en antispyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee Antivirus en antispyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\henk\Desktop\Internet Explorer.lnk

c:\windows\hexdump.exe

c:\windows\iexplarer.exe

c:\windows\mdm.exe

c:\windows\system32\csbdll.dll

c:\windows\SysWow64\csbdll.dll

c:\windows\SysWow64\f9ezm7os.dll

c:\windows\SysWow64\mredzo.dll

c:\windows\TEMP\nvsvc32.exe

c:\windows\wininst.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-11-21 to 2010-12-21 ))))))))))))))))))))))))))))))

.

2010-12-21 19:50 . 2010-12-21 19:50 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-12-21 16:52 . 2010-11-16 11:01 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2E6BC947-7E97-4090-9A0D-A9FDFC7C72D2}\mpengine.dll

2010-12-17 20:36 . 2010-12-17 20:36 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%

2010-12-16 08:18 . 2010-11-04 06:37 696592 ----a-w- c:\program files\Internet Explorer\iexplore.exe

2010-12-08 18:48 . 2010-12-08 18:48 -------- d-----w- c:\programdata\Sunbelt

2010-12-08 18:46 . 2010-08-20 08:18 27472 ----a-w- c:\windows\system32\sbbd.exe

2010-12-08 18:46 . 2010-03-22 11:11 49752 ----a-w- c:\windows\system32\drivers\sbredrv.sys

2010-12-04 17:17 . 2010-12-04 17:17 -------- d-----w- c:\program files (x86)\ESET

2010-11-29 23:06 . 2010-11-29 23:06 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared

2010-11-28 12:20 . 2010-11-28 13:02 -------- d-----w- c:\programdata\WinZip

2010-11-27 18:08 . 2010-11-28 12:59 -------- d-----w- c:\users\henk\DoctorWeb

2010-11-27 14:17 . 2010-12-21 19:31 -------- d-----w- c:\program files (x86)\Steam