PC loopt vast - controle

Eurne · 6 juli 2011

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Databaseversie: 7004

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

6/07/2011 17:10:54

mbam-log-2011-07-06 (17-10-54).txt

Scantype: Volledige scan (C:\|D:\|E:\|F:\|)

Objecten gescand: 400758

Verstreken tijd: 1 uur/uren, 29 minuut/minuten, 59 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 0

Registerwaarden geïnfecteerd: 1

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 6

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MessengerService\Policies\IMWarning (IM.Worm) -> Value: IMWarning -> Quarantined and deleted successfully.

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:

c:\Users\Arnoke\doctorweb\quarantine\my****pic4.scr (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\Users\Arnoke\doctorweb\quarantine\ntldr__0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\Users\Arnoke\doctorweb\quarantine\ntldr__1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\Users\Arnoke\doctorweb\quarantine\tmpp___0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\Windows\System32\launch.vbs (Malware.Trace) -> Quarantined and deleted successfully.

c:\Windows\System32\logstm123.txt (Malware.Trace) -> Quarantined and deleted successfully.

Eurne · 6 juli 2011

ComboFix 11-07-06.02 - Arnoke 06/07/2011 18:18:45.4.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2046.1057 [GMT 2:00]

Gestart vanuit: c:\users\Arnoke\Desktop\ComboFix.exe

AV: Panda Internet Security 2011 *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}

FW: Panda Personal Firewall 2011 *Disabled* {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}

SP: Panda Internet Security 2011 *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

/wow section - STAGE 4

Toegang geweigerd.

.

/wow section - STAGE 6A

Toegang geweigerd.

.

/wow section - STAGE 7

.

/wow section - STAGE 16

Toegang geweigerd.

.

/wow section - STAGE 17

.0.\\. wordt niet herkend als een interne

of externe opdracht, programma of batchbestand.

Toegang geweigerd.

.

/wow section - STAGE 23

Toegang geweigerd.

.

/wow section - STAGE 33

SED: can't read CuRun.dmp: No such file or directory

Toegang geweigerd.

SED: can't read CuRun.dmp: No such file or directory

Toegang geweigerd.

.

/wow section - STAGE 38

Toegang geweigerd.

.

/wow section - STAGE 47

Toegang geweigerd.

.

/wow section - STAGE 50

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\svchost001.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-06-06 to 2011-07-06 ))))))))))))))))))))))))))))))

.

2011-07-06 17:42 . 2011-07-06 17:42 -------- d-----w- c:\users\Public\AppData\Local\temp

2011-07-06 17:42 . 2011-07-06 17:42 -------- d-----w- c:\users\postgress\AppData\Local\temp

2011-07-06 17:42 . 2011-07-06 17:42 -------- d-----w- c:\users\postgres\AppData\Local\temp

2011-07-06 17:42 . 2011-07-06 17:42 -------- d-----w- c:\users\hasabene\AppData\Local\temp

2011-07-06 17:42 . 2011-07-06 17:42 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-07-06 15:47 . 2011-07-06 15:53 -------- d-----w- C:\32788R22FWJFW

2011-07-06 15:13 . 2011-07-06 15:13 54016 ----a-w- c:\windows\system32\drivers\diadl.sys

2011-07-05 08:48 . 2011-06-07 15:55 7074640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{51AA2614-C67A-4DA1-86B8-BE7DDCA6D5EE}\mpengine.dll

2011-07-04 15:50 . 2011-07-04 15:50 -------- d-----w- c:\program files\NirSoft

2011-07-03 01:10 . 2011-07-03 01:10 7692 ----a-w- c:\windows\system32\launch.bat

2011-07-03 01:10 . 2011-07-03 01:10 480 ----a-w- c:\windows\system32\net.vbs

2011-06-29 12:39 . 2011-04-29 15:59 276992 ----a-w- c:\windows\system32\schannel.dll

2011-06-28 16:50 . 2011-06-28 16:50 -------- d-----w- c:\program files\RVG Software

2011-06-28 16:49 . 2011-06-28 17:07 -------- d-----w- c:\program files\PSQLINSTALL

2011-06-26 16:31 . 2011-06-26 16:31 -------- d-----w- c:\program files\PostgreSQL

2011-06-23 16:31 . 2011-06-23 16:31 -------- d-----w- c:\users\Arno

2011-06-23 11:53 . 2011-06-23 11:53 -------- d-----w- c:\users\postgres.PC_van_Arnoke

2011-06-23 11:39 . 2011-06-23 11:39 -------- d-----w- c:\program files\PokerStrategy.com

2011-06-17 11:37 . 2011-06-26 15:10 -------- d-----w- c:\program files\PokerStars

2011-06-16 11:58 . 2011-06-16 11:58 -------- d-----w- c:\program files\Common Files\Java

2011-06-15 19:52 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-15 19:52 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-15 19:52 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-06-15 19:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-06-15 19:34 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys

2011-06-15 19:34 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-06-15 19:34 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-06-15 19:34 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-06-15 19:34 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-06-15 19:34 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-06-15 19:34 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-06-15 19:34 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-06-15 19:34 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-06-13 16:39 . 2011-06-23 11:36 -------- d-----w- c:\program files\Full Tilt Poker

2011-06-13 13:58 . 2011-06-17 07:07 -------- d-----w- c:\programdata\Skype Extras

2011-06-13 13:47 . 2011-06-13 13:47 -------- d-----w- c:\program files\Common Files\Skype

2011-06-13 13:21 . 2011-06-13 13:21 -------- d-----w- c:\windows\DA15D5355E1D4076B5208571346D6238.TMP

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-21 18:11 . 2011-05-29 16:47 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-05-29 07:11 . 2011-04-27 13:25 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-29 07:11 . 2011-04-27 13:25 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-05-24 17:14 . 2009-10-03 13:24 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-05-04 02:52 . 2010-04-20 14:47 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-04-28 19:12 . 2011-04-28 19:12 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-04-28 19:12 . 2011-04-28 19:12 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2011-04-28 19:12 . 2011-04-28 19:12 161792 ----a-w- c:\windows\system32\msls31.dll

2011-04-28 19:12 . 2011-04-28 19:12 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-04-28 19:12 . 2011-04-28 19:12 86528 ----a-w- c:\windows\system32\iesysprep.dll

2011-04-28 19:12 . 2011-04-28 19:12 63488 ----a-w- c:\windows\system32\tdc.ocx

2011-04-28 19:12 . 2011-04-28 19:12 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-04-28 19:12 . 2011-04-28 19:12 367104 ----a-w- c:\windows\system32\html.iec

2011-04-28 19:12 . 2011-04-28 19:12 74752 ----a-w- c:\windows\system32\iesetup.dll

2011-04-28 19:12 . 2011-04-28 19:12 23552 ----a-w- c:\windows\system32\licmgr10.dll

2011-04-28 19:12 . 2011-04-28 19:12 1427456 ----a-w- c:\windows\system32\inetcpl.cpl

2011-04-28 19:12 . 2011-04-28 19:12 152064 ----a-w- c:\windows\system32\wextract.exe

2011-04-28 19:12 . 2011-04-28 19:12 150528 ----a-w- c:\windows\system32\iexpress.exe

2011-04-28 19:12 . 2011-04-28 19:12 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-04-28 19:12 . 2011-04-28 19:12 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2011-04-28 19:12 . 2011-04-28 19:12 35840 ----a-w- c:\windows\system32\imgutil.dll

2011-04-28 19:12 . 2011-04-28 19:12 11776 ----a-w- c:\windows\system32\mshta.exe

2011-04-28 19:12 . 2011-04-28 19:12 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2011-04-28 19:12 . 2011-04-28 19:12 101888 ----a-w- c:\windows\system32\admparse.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2011\APVXDWIN.EXE" [2010-08-26 988480]

"SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2011\Inicio.exe" [2010-06-11 68928]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]

2010-03-24 11:55 55552 ----a-w- c:\windows\System32\avldr.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\APSHook.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk

backup=c:\windows\pss\BTTray.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2011-03-29 19:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-05-27 12:52 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CognizanceTS]

2003-12-22 18:12 17920 ----a-r- c:\progra~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]

2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]

2007-03-12 09:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]

2007-03-01 11:18 472776 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

2007-02-12 14:37 174872 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]

2011-05-29 07:11 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-04-16 21:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2009-10-03 10:40 13826664 ----a-w- c:\windows\System32\nvcpl.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]

2007-02-13 09:38 159744 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]

2007-04-23 16:11 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shockwave Updater]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2011-05-26 19:50 15147400 ----a-r- c:\program files\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]

2006-10-09 20:43 729088 ----a-w- c:\program files\Motorola\SMSERIAL\sm56hlpr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2011-04-08 10:59 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2010-05-27 20:31 1721640 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WAWifiMessage]

2007-01-10 14:12 317128 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-832047836-1340904009-3617835092-1000]

"EnableNotificationsRef"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-10 135664]

R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-10 135664]

R3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\DRIVERS\whfltr2k.sys [2007-01-25 6784]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot.sys [2010-06-22 26696]

S0 ps7akt6c;Cycling Manager 2007 Synchronization Driver (ps7akt6c);c:\windows\system32\drivers\ps7akt6c.sys [2007-09-28 68752]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-08-14 697328]

S1 APPFLT;App Filter Plugin;c:\windows\system32\Drivers\APPFLT.SYS [2010-02-18 76296]

S1 DSAFLT;DSA Filter Plugin;c:\windows\system32\Drivers\DSAFLT.SYS [2009-09-25 53256]

S1 FNETMON;NetMon Filter Plugin;c:\windows\system32\Drivers\fnetmon.SYS [2009-09-25 22024]

S1 IDSFLT;Ids Filter Plugin;c:\windows\system32\Drivers\IDSFLT.SYS [2009-09-25 193800]

S1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\Drivers\NETFLTDI.SYS [2009-09-25 13:54 159112]

S1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys [2009-10-27 37896]

S1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\Drivers\WNMFLT.SYS [2009-09-25 46856]

S2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm8660.sys [2010-05-21 54344]

S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-19 21504]

S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-19 21504]

S2 ComFiltr;Panda Anti-Dialer;c:\windows\system32\DRIVERS\COMFiltr.sys [2010-11-18 13880]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]

S2 PavProc;Panda Process Protection Driver;c:\windows\system32\DRIVERS\PavProc.sys [2009-09-14 163336]

S2 postgresql-9.0;postgresql-9.0 - PostgreSQL Server 9.0;C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N postgresql-9.0 -D C:/Program Files/PostgreSQL/9.0/data -w [x]

S2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Internet Security 2011\PskSvc.exe [2010-08-16 28992]

S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2008-10-02 482176]

S3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]

S3 NETIMFLT01060042;PANDA NDIS IM Filter Miniport v1.6.0.42;c:\windows\system32\DRIVERS\neti1642.sys [2010-02-18 199688]

S3 NETw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]

S3 PavSRK.sys;PavSRK.sys;c:\windows\system32\PavSRK.sys [x]

S3 PavTPK.sys;PavTPK.sys;c:\windows\system32\PavTPK.sys [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

Cognizance REG_MULTI_SZ ASBroker ASChannel

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

getPlusHelper REG_MULTI_SZ getPlusHelper

.

Inhoud van de 'Gedeelde Taken' map

.

2011-07-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-10 10:08]

.

2011-07-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-10 10:08]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

IE: Afbeelding verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Pagina verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: Interfaces\{7553CE3A-F183-497F-9E9E-F4E61E3283E1}: NameServer = 192.168.0.1,192.168.0.2

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-07-06 19:47

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\postgresql-9.0]

"ImagePath"="C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N \"postgresql-9.0\" -D \"C:/Program Files/PostgreSQL/9.0/data\" -w"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\postgresql-9.0]

"ImagePath"="C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N \"postgresql-9.0\" -D \"C:/Program Files/PostgreSQL/9.0/data\" -w"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'lsass.exe'(744)

c:\program files\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll

c:\program files\Bioscrypt\VeriSoft\Bin\ItMsg.dll

.

Voltooingstijd: 2011-07-06 20:30:25

ComboFix-quarantined-files.txt 2011-07-06 18:29

.

Pre-Run: 57.165.791.232 bytes beschikbaar

Post-Run: 57.598.300.160 bytes beschikbaar

.

- - End Of File - - 86AE48A516C0B0F61238EBEA454EF336

kweezie wabbit · 7 juli 2011

Is dit een logje uit normale of veilige modus?

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\DA15D5355E1D4076B5208571346D6238.TMP

Folder::

C:\32788R22FWJFW

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Eurne · 7 juli 2011

Ik heb ze beide in normale modus kunnen laten runnen.

Hier zijn de logjes:

ComboFix 11-07-07.02 - Arnoke 07/07/2011 17:55:17.4.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2046.1001 [GMT 2:00]

Gestart vanuit: c:\users\Arnoke\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Arnoke\Desktop\CFScript.txt

AV: Panda Internet Security 2011 *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}

FW: Panda Personal Firewall 2011 *Disabled* {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}

SP: Panda Internet Security 2011 *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\DA15D5355E1D4076B5208571346D6238.TMP"

.

/wow section - STAGE 4

Toegang geweigerd.

.

/wow section - STAGE 6A

Toegang geweigerd.

.

/wow section - STAGE 7

.

/wow section - STAGE 16

Toegang geweigerd.

.

/wow section - STAGE 17

.0.\\. wordt niet herkend als een interne

of externe opdracht, programma of batchbestand.

Toegang geweigerd.

.

/wow section - STAGE 23

Toegang geweigerd.

.

/wow section - STAGE 32A

SED: can't read CuRun.dmp: No such file or directory

Toegang geweigerd.

.

/wow section - STAGE 33

Toegang geweigerd.

.

/wow section - STAGE 38

Toegang geweigerd.

.

/wow section - STAGE 47

Toegang geweigerd.

.

/wow section - STAGE 50

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-06-07 to 2011-07-07 ))))))))))))))))))))))))))))))

.

2011-07-07 17:13 . 2011-07-07 17:13 -------- d-----w- c:\users\Public\AppData\Local\temp

2011-07-07 17:13 . 2011-07-07 17:13 -------- d-----w- c:\users\postgress\AppData\Local\temp

2011-07-07 17:13 . 2011-07-07 17:13 -------- d-----w- c:\users\postgres\AppData\Local\temp

2011-07-07 17:13 . 2011-07-07 17:13 -------- d-----w- c:\users\hasabene\AppData\Local\temp

2011-07-07 17:13 . 2011-07-07 17:13 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-07-06 15:47 . 2011-07-07 15:33 -------- d-----w- C:\32788R22FWJFW