IE popups alhoewel IE niet werd opgestart.

kape · 16 december 2010

Normaal mag McAfee geen probleem geven bij het runnen van ComboFix. Indien dit wel het geval mocht zijn, zal je daar een melding van krijgen. Klik deze gewoon door en zie of ComboFix gewoon doorloopt. Zo ja, dan is je logje van ComboFix perfect bruikbaar.

En wat HijackThis.nl betreft : geen probleem ... alleen proberen we onder collega's te vermijden dat er dubbel werk geleverd wordt. Er is meer dan voldoende vraag naar oplossingen rond virussen & spyware + de verwerking is arbeidsintensief en tijdrovend. En dan is met twee aan hetzelfde probleem werken natuurlijk tijdverlies !

paddepoel · 26 december 2010

Hallo,

sorry voor het late antwoord, maar zoals gevraagd het logje van Combofix. (ter info: alvorens Combofix uit te voeren heb ik een scan met MBAM gedaan. Deze heeft niets gevonden).

ComboFix 10-12-25.02 - pgadebac 26/12/2010 10:00:22.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.32.1043.18.2942.2176 [GMT 1:00]

Gestart vanuit: d:\documents and settings\pgadebac\Bureaublad\ComboFix.exe

AV: McAfee VirusScan Enterprise *Enabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

* Aanwezig AV is actief

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\data

c:\winnt\system32\_000005_.tmp.dll

d:\documents and settings\NetworkService\Application Data\PriceGong

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\1.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\a.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\b.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\c.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\d.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\e.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\f.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\g.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\h.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\i.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\J.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\k.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\l.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\m.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\mru.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\n.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\o.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\p.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\q.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\r.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\s.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\t.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\u.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\v.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\w.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\x.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\y.xml

d:\documents and settings\NetworkService\Application Data\PriceGong\Data\z.xml

d:\documents and settings\pgadebac\Application Data\JuniperExtXP.exe

d:\documents and settings\pgadebac\Application Data\PriceGong

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\1.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\a.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\b.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\c.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\d.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\e.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\f.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\g.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\h.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\i.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\J.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\k.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\l.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\m.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\mru.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\n.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\o.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\p.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\q.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\r.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\s.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\t.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\u.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\v.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\w.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\x.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\y.xml

d:\documents and settings\pgadebac\Application Data\PriceGong\Data\z.xml

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-11-26 to 2010-12-26 ))))))))))))))))))))))))))))))

.

2010-12-25 08:26 . 2010-11-02 15:17 40960 -c----w- c:\winnt\system32\dllcache\ndproxy.sys

2010-12-25 08:25 . 2010-10-11 14:59 45568 -c----w- c:\winnt\system32\dllcache\wab.exe

2010-12-25 08:15 . 2010-12-26 08:45 -------- d--h--r- d:\documents and settings\pgadebac\Onlangs geopend

2010-12-23 11:46 . 2010-12-23 14:03 -------- d-----w- c:\program files\Windows Desktop Search

2010-12-14 18:01 . 2010-12-14 18:01 -------- d-----w- c:\program files\Common Files\Skype

2010-12-11 15:27 . 2010-12-11 15:27 388096 ----a-r- d:\documents and settings\pgadebac\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-12-11 15:27 . 2010-12-11 15:27 -------- d-----w- c:\program files\Trend Micro

2010-12-10 13:08 . 2010-12-10 13:08 -------- d-----w- d:\documents and settings\All Users\Application Data\explauncher

2010-12-10 13:08 . 2010-12-10 13:08 -------- d-----w- d:\documents and settings\All Users\Application Data\launcher

2010-12-10 10:00 . 2010-05-18 10:25 40560 ----a-w- c:\winnt\system32\drivers\hotcore3.sys

2010-12-10 09:59 . 2010-12-10 09:59 -------- d-----w- c:\program files\Paragon_Software

2010-12-08 17:22 . 2010-12-24 11:04 -------- d-----w- C:\PATRICK PRIVE

2010-12-08 11:11 . 2010-12-15 14:02 -------- d-----w- c:\program files\Panda Security

2010-12-07 12:44 . 2010-12-15 14:01 -------- d-----w- c:\program files\Microsoft ActiveSync

2010-12-05 10:30 . 2010-12-05 15:58 -------- d-----w- d:\documents and settings\pgadebac\Application Data\Dropbox

2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\winnt\system32\GPhotos.scr

2010-11-30 17:23 . 2010-11-30 17:23 -------- d-----r- d:\documents and settings\NetworkService\Mijn documenten

2010-11-30 17:22 . 2010-11-30 17:22 -------- d--h--r- d:\documents and settings\NetworkService\Onlangs geopend

2010-11-30 17:04 . 2010-12-15 17:25 -------- d-----w- d:\documents and settings\NetworkService\Bureaublad

2010-11-30 17:04 . 2010-11-30 17:04 0 ----a-w- c:\winnt\system32\ConduitEngine.tmp

2010-11-30 17:03 . 2010-11-30 17:03 -------- d-----w- d:\documents and settings\NetworkService\Local Settings\Application Data\Conduit

2010-11-30 17:03 . 2010-11-30 17:03 -------- d-----w- d:\documents and settings\NetworkService\Local Settings\Application Data\Softonic_Netherlands

2010-11-27 09:04 . 2010-11-27 09:04 -------- d-----w- d:\documents and settings\pgadebac\Local Settings\Application Data\ALK_Technologies

2010-11-27 08:52 . 2010-11-27 08:52 -------- d-----w- d:\documents and settings\pgadebac\Application Data\ALK Technologies

2010-11-27 08:51 . 2010-11-27 08:51 -------- d-----w- c:\program files\ALK Technologies

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-20 17:09 . 2009-02-08 14:16 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys

2010-12-20 17:08 . 2009-02-08 14:16 20952 ----a-w- c:\winnt\system32\drivers\mbam.sys

2010-11-18 18:15 . 2007-03-21 07:25 86016 ----a-w- c:\winnt\system32\isign32.dll

2010-11-06 00:23 . 2004-08-04 12:00 916480 ----a-w- c:\winnt\system32\wininet.dll

2010-11-06 00:23 . 2004-08-04 12:00 43520 ----a-w- c:\winnt\system32\licmgr10.dll

2010-11-06 00:23 . 2004-08-04 12:00 1469440 ------w- c:\winnt\system32\inetcpl.cpl

2010-11-03 12:27 . 2004-08-04 12:00 385024 ----a-w- c:\winnt\system32\html.iec

2010-11-02 15:17 . 2004-08-04 12:00 40960 ----a-w- c:\winnt\system32\drivers\ndproxy.sys

2010-10-28 13:09 . 2004-08-04 12:00 290048 ----a-w- c:\winnt\system32\atmfd.dll

2010-10-26 14:00 . 2004-08-04 12:00 1853440 ----a-w- c:\winnt\system32\win32k.sys

2010-10-06 17:49 . 2008-10-23 09:48 156336 ----a-w- c:\winnt\ai32.dll

2010-10-01 02:03 . 2010-04-30 18:17 398704 ----a-w- c:\winnt\system32\dsNcSmartCardProv.dll

2010-10-01 02:03 . 2009-09-11 18:28 345456 ----a-w- c:\winnt\system32\dsNcCredProv.dll

2010-10-01 02:00 . 2010-10-01 02:00 221184 ----a-w- c:\winnt\system32\dsGinaLoader.dll

2009-10-22 18:07 . 2010-06-18 16:02 23864 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll

.

<pre>
c:\winnt\system32\CCM\Cache\P0100255.2.System\SisterAct2015\SisterAct .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SmartRAM"="c:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" [2010-07-21 198864]

"Copernic Desktop Search - Home"="c:\program files\Copernic Desktop Search - Home\DesktopSearchService.exe" [2010-02-04 1594368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 303104]

"Dell QuickSet"="c:\program files\Dell\QuickSet\Quickset.exe" [2007-02-20 1191936]

"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2009-08-25 136512]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2010-02-05 2056192]

"Logon"="c:\winnt\system32\loglogon.exe" [2008-07-23 199989]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\winnt\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="c:\winnt\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe" [2010-10-12 232912]

d:\documents and settings\pgadebac\Menu Start\Programma's\Opstarten\

Stickies.lnk - c:\program files\Stickies\stickies.exe [2008-8-28 765952]

d:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Taakbalkpictogram van Connected.LNK - c:\program files\Connected\CBSysTray.exe [2008-9-30 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoFileAssociate"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]

"NoAutoUpdate"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2009-10-02 128360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcsinst]

2008-02-20 14:13 49152 ----a-w- c:\winnt\system32\pcsinst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-667808998-3646381641-2365837644-12977\Scripts\Logon\0\0]

"Script"=\\10.20.129.10\backuppc\Installpcbackup.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-667808998-3646381641-2365837644-28925\Scripts\Logon\0\0]

"Script"=\\10.20.129.10\backuppc\Installpcbackup.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-667808998-3646381641-2365837644-6869\Scripts\Logon\0\0]

"Script"=deontologieLaunch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-667808998-3646381641-2365837644-6869\Scripts\Logon\1\0]

"Script"=\\10.20.129.10\backuppc\Installpcbackup.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-667808998-3646381641-2365837644-83173\Scripts\Logon\0\0]

"Script"=\\10.20.129.10\backuppc\Installpcbackup.vbs

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]

@="Service"

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Gamma Loader.lnk]

backup=c:\winnt\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Bluetooth Manager.lnk]

backup=c:\winnt\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Windows Search.lnk]

backup=c:\winnt\pss\Windows Search.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]

2006-12-19 22:12 149024 ----a-w- c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]

2010-08-10 13:10 2349776 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\beid]

2010-02-05 11:29 2056192 ----a-w- c:\program files\Belgium Identity Card\beid35gui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

c:\program files\DAEMON Tools Lite\DTLite.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]

2007-02-20 10:29 1191936 ----a-w- c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2008-12-01 05:12 133104 ----atw- d:\documents and settings\pgadebac\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intoan]

2005-09-29 17:34 4549632 ----a-w- c:\program files\Intoan\Agent\IntoanAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ITSecMng]

%ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobileConnect.EXE]

2007-05-22 11:28 3076096 ----a-w- c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Perfect Memory Optimizer]

c:\program files\Perfect Utilities\ToolMemoryOptimizer.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]

2009-10-22 18:07 124240 ----a-w- c:\program files\McAfee\VirusScan Enterprise\shstat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartRAM]

2010-07-21 13:43 198864 ----a-w- c:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-01-11 14:21 246504 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"d:\\Documents and Settings\\pgadebac\\Mijn documenten\\PATRICK NIOD\\ONDERHOUD PC\\uTorrent.exe"=

"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

"c:\\Program Files\\Cisco Systems\\Cisco IP Communicator\\communicatork9.exe"=

"c:\\WINNT\\system32\\mmc.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\IBM\\Lotus\\Notes\\framework\\rcp\\eclipse\\plugins\\com.ibm.rcp.base_6.2.1.20090925-1604\\win32\\x86\\notes2.exe"=

"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 hotcore3;hc3ServiceName;c:\winnt\system32\drivers\hotcore3.sys [10/12/2010 11:00 40560]

R0 sptd;sptd;c:\winnt\system32\drivers\sptd.sys [26/08/2010 17:37 691696]

R1 HttpDisk;HttpDisk;c:\winnt\system32\drivers\httpdisk.sys [17/07/2008 8:54 14592]

R2 CdpPacket;Cisco Discovery Protocol Packet Driver;c:\winnt\system32\drivers\CdpPacket.sys [24/01/2008 17:47 35692]

R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [19/03/2009 18:10 712048]

R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [19/03/2009 18:10 712048]

R2 ldlcserv6;IBM Enterprise Extender (IPv6);c:\winnt\system32\drivers\ldlcserv6.exe [20/02/2008 15:13 40960]

R2 Lotus Notes Diagnostics;Lotus Notes Diagnostische Service;c:\program files\IBM\Lotus\Notes\nsd.exe [29/09/2009 10:29 3397000]

R2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\EngineServer.exe [22/10/2009 19:07 21256]

R2 mfevtp;McAfee Validation Trust Protection Service;c:\winnt\system32\mfevtps.exe [18/06/2010 17:02 70728]

R2 mvaservice;MVA-Team Service;c:\winnt\system32\srvany.exe [18/04/2003 17:06 8192]

R2 pdlndldl6;IBM Enterprise Extender (HPR/IPv6);c:\winnt\system32\drivers\pdlndldl6.sys [20/02/2008 15:13 70656]

R2 vnccom;vnccom;c:\winnt\system32\drivers\vnccom.SYS [17/07/2008 8:12 6016]

R3 bbcap;bbcap;c:\winnt\system32\drivers\bbcap.sys [15/01/2009 20:11 4096]

S0 crpf;crpf;c:\winnt\system32\drivers\crpf.sys --> c:\winnt\system32\drivers\crpf.sys [?]

S0 csdf;cdsf;c:\winnt\system32\drivers\csdf.sys --> c:\winnt\system32\drivers\csdf.sys [?]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [15/01/2010 6:39 135664]

S2 gupdate1c9c883e3eb492;Google Updateservice (gupdate1c9c883e3eb492);c:\program files\Google\Update\GoogleUpdate.exe [15/01/2010 6:39 135664]

S2 SSPORT;SSPORT;\??\c:\winnt\system32\Drivers\SSPORT.sys --> c:\winnt\system32\Drivers\SSPORT.sys [?]

S3 ACSSCR;ACR38 Smart Card Reader;c:\winnt\system32\drivers\a38usb.sys [29/09/2008 19:55 33536]

S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\DfSdkS.exe [23/07/2010 7:55 406016]

S3 GTUQBUS;GT UQ BUS;c:\winnt\system32\drivers\gtuqbus.sys [13/02/2009 14:32 37120]

S3 hitmanpro3;Hitman Pro 3 Support Driver;\??\c:\winnt\system32\drivers\hitmanpro3.sys --> c:\winnt\system32\drivers\hitmanpro3.sys [?]

S3 hwcdcmdm0;HUAWEI Mobile Connect - 3G Modem;c:\winnt\system32\drivers\ewusbmdm.sys [12/02/2009 13:47 65152]

S3 hwusbapp;HUAWEI Mobile Connect - 3G PC UI Interface;c:\winnt\system32\drivers\ewusbapp.sys [12/02/2009 13:47 65152]

S3 hwusbser;HUAWEI Mobile Connect - 3G Application Interface;c:\winnt\system32\drivers\ewusbser.sys [12/02/2009 13:47 65152]

S3 ImDisk;ImDisk Virtual Disk Driver;c:\winnt\system32\drivers\imdisk.sys [17/03/2008 18:50 19840]

S3 massfilter;ZTE Mass Storage Filter Driver;c:\winnt\system32\drivers\massfilter.sys --> c:\winnt\system32\drivers\massfilter.sys [?]

S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [10/04/2010 17:05 266544]

S3 mferkdet;McAfee Inc. mferkdet;c:\winnt\system32\drivers\mferkdet.sys [18/06/2010 17:02 65448]

S3 Sb2.Printer;Sb2.Printer;c:\winnt\system32\Sb2.Printer.exe [19/12/2006 15:10 77824]

S3 TSClient;Tatara Protocol Driver;c:\winnt\system32\drivers\tsclient.sys --> c:\winnt\system32\drivers\tsclient.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

Inhoud van de 'Gedeelde Taken' map

2010-12-26 c:\winnt\Tasks\GlaryInitialize.job

- c:\program files\Glary Utilities\initialize.exe [2010-11-21 09:47]

2010-12-26 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-15 05:39]

2010-12-26 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-15 05:39]

2010-12-24 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-3712614485-1044013603-244294945-1006Core.job

- d:\documents and settings\debacker\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-10-01 20:08]

2010-12-26 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-3712614485-1044013603-244294945-1006UA.job

- d:\documents and settings\debacker\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-10-01 20:08]

2010-12-24 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-667808998-3646381641-2365837644-6869Core.job

- d:\documents and settings\pgadebac\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-01 05:12]

2010-12-26 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-667808998-3646381641-2365837644-6869UA.job

- d:\documents and settings\pgadebac\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-01 05:12]

2009-09-22 c:\winnt\Tasks\SmartDefrag.job

- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-07-24 07:22]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2603445

uInternet Connection Wizard,ShellNext = hxxp://10.2.31.212/homenl

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

IE: Add to Google Photos Screensa&ver - c:\winnt\system32\GPhotos.scr/200

IE: { - c:\program files\Messenger\msmsgs.exe

Trusted Zone: intranet

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

FF - ProfilePath - d:\documents and settings\pgadebac\Application Data\Mozilla\Firefox\Profiles\mn9m13ub.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/

FF - prefs.js: network.proxy.http - http://intranet/proxy.pac

FF - prefs.js: network.proxy.http_port - 80

FF - prefs.js: network.proxy.type - 4

FF - Ext: Belgium eID: belgiumeid@eid.belgium.be - c:\program files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\winnt\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - user.js: browser.blink_allowed - true

FF - user.js: network.prefetch-next - true

FF - user.js: layout.spellcheckDefault - 1

FF - user.js: browser.urlbar.autoFill - false

FF - user.js: browser.search.openintab - false

FF - user.js: browser.tabs.closeButtons - 1

FF - user.js: browser.tabs.opentabfor.middleclick - true

FF - user.js: browser.tabs.tabMinWidth - 100

FF - user.js: browser.urlbar.hideGoButton - true

.

- - - - ORPHANS VERWIJDERD - - - -

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)

Notify-atmgrtok - atmgrtok.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-12-26 10:17

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, GMER - Rootkit Detector and Remover

Windows 5.1.2600

CreateFile("\\.\PHYSICALDRIVE0"): Het proces heeft geen toegang tot het bestand omdat

het bestand door een ander proces wordt gebruikt.

device: opened successfully

user: error reading MBR

kernel: MBR read successfully

user != kernel MBR !!!

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5d,56,2c,24,e9,d7,d5,43,9c,d4,1b,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5d,56,2c,24,e9,d7,d5,43,9c,d4,1b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]

"3140110900063D11C8EF10054038389C"="C?\\WINNT\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(1100)

c:\winnt\system32\Ati2evxx.dll

c:\program files\IBM\Personal Communications\atmgrtok.dll

c:\program files\IBM\Personal Communications\MILLUTIL.DLL

c:\winnt\system32\pcsinst.dll

- - - - - - - > 'explorer.exe'(4164)

c:\winnt\system32\webcheck.dll

c:\winnt\system32\WPDShServiceObj.dll

c:\program files\Stardock\Fences\FencesMenu.dll

c:\program files\stardock\fences\DesktopDock.dll

c:\winnt\system32\PortableDeviceTypes.dll

c:\winnt\system32\PortableDeviceApi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\winnt\system32\Ati2evxx.exe

c:\winnt\System32\SCardSvr.exe

c:\winnt\system32\Drivers\trcboot.exe

c:\program files\IBM\Personal Communications\PCS_AGNT.EXE

c:\program files\Common Files\Acronis\Schedule2\schedul2.exe

c:\program files\Connected\AgentSrv.EXE

c:\program files\Juniper Networks\Common Files\dsNcService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\IBM\Lotus\Notes\nslsvice.exe

c:\program files\McAfee\Common Framework\FrameworkService.exe

c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\IBM\Lotus\Notes\ntmulti.exe

c:\program files\McAfee\Common Framework\naPrdMgr.exe

c:\program files\Dell\QuickSet\NICCONFIGSVC.exe

c:\winnt\system32\mvaservice.exe

c:\program files\SigmaTel\C-Major Audio\WDM\StacSV.exe

c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

c:\program files\UltraVNC\WinVNC.exe

c:\winnt\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe

c:\winnt\system32\CCM\CcmExec.exe

c:\program files\McAfee\VirusScan Enterprise\Mcshield.exe

c:\winnt\system32\Drivers\ldlcserv.exe

c:\program files\McAfee\VirusScan Enterprise\mfeann.exe

c:\winnt\system32\msiexec.exe

c:\winnt\stsystra.exe

c:\program files\McAfee\Common Framework\McTray.exe

c:\program files\Internet Explorer\IEXPLORE.EXE

.

**************************************************************************

.

Voltooingstijd: 2010-12-26 10:22:51 - machine werd herstart

ComboFix-quarantined-files.txt 2010-12-26 09:22

Pre-Run: 20.375.769.088 bytes beschikbaar

Post-Run: 20.178.726.912 bytes beschikbaar

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINNT

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 993B59C80DF9752DC2029C040437903E

kape · 26 december 2010

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\winnt\system32\ConduitEngine.tmp

c:\winnt\system32\GPhotos.scr

c:\winnt\system32\drivers\hitmanpro3.sys

c:\winnt\system32\drivers\tsclient.sys

Folder::

d:\documents and settings\NetworkService\Local Settings\Application Data\Conduit

Driver::

hitmanpro3

TSClient

Renv::

c:\winnt\system32\CCM\Cache\P0100255.2.System\SisterAct2015\SisterAct .exe

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

paddepoel · 26 december 2010

Hallo,

bedankt voor de supersnelle reactie !

Hierbij de logjes.

COMBOFIX:

ComboFix 10-12-25.02 - pgadebac 26/12/2010 11:19:38.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.32.1043.18.2942.2285 [GMT 1:00]

Gestart vanuit: d:\documents and settings\pgadebac\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: d:\documents and settings\pgadebac\Bureaublad\CFScript.txt

AV: McAfee VirusScan Enterprise *Enabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

* Aanwezig AV is actief

FILE ::

"c:\winnt\system32\ConduitEngine.tmp"

"c:\winnt\system32\drivers\hitmanpro3.sys"

"c:\winnt\system32\drivers\tsclient.sys"

"c:\winnt\system32\GPhotos.scr"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

d:\documents and settings\NetworkService\Local Settings\Application Data\Conduit

d:\documents and settings\NetworkService\Local Settings\Application Data\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_996268_991987_BE.xml

d:\documents and settings\NetworkService\Local Settings\Application Data\Conduit\Community Alerts\LanguagePacks\en.xml

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_HITMANPRO3

-------\Legacy_TSCLIENT

-------\Service_hitmanpro3

-------\Service_TSClient

(((((((((((((((((((( Bestanden Gemaakt van 2010-11-26 to 2010-12-26 ))))))))))))))))))))))))))))))

.

2010-12-25 08:26 . 2010-11-02 15:17 40960 -c----w- c:\winnt\system32\dllcache\ndproxy.sys

2010-12-25 08:25 . 2010-10-11 14:59 45568 -c----w- c:\winnt\system32\dllcache\wab.exe

2010-12-25 08:15 . 2010-12-26 10:16 -------- d--h--r- d:\documents and settings\pgadebac\Onlangs geopend