wupdmgr1.exe - DevNotifySvc.exe - core ServiceShel.exe

HairyHippie · 17 juli 2011

Was het de bedoeling dat ik de inhoud van CuerIt.log ook hier zou plakken?

Ik heb n.l. 1,7 tb aan schijfruimte in gebruik.

CureIt.log is dus 74.572 bytes.

kape · 17 juli 2011

Neen, het volstond om de fouten (de twee bestanden in je vorig bericht) te plaatsen. Begin er sterk aan te twijfelen of - in dit geval - de genoemde 3 bestanden wel degelijk foutief of besmet zouden zijn. Niets wijst er op dat dit het geval is.

HairyHippie · 17 juli 2011

Ja inderdaad, maar waarom is b.v. wupdmgr1.exe niet te vinden met een zoekopdracht en ook niet te verwijderen in de map en niet terug te vinden in de opstart van mijn systeemconfiguratie terwijl het toch resident draait.

De windowsversie heet overigens wupdmgr.exe dus zonder de 1.

De uninstall.exe van DevNotifySvc.exe functioneert ook niet en verbruikt net als CoreServiceShell vanaf het moment van aanzetten van de pc continue veel pcu capaciteit.

Ik kan geen van deze programma's uitschakelen.

kape · 17 juli 2011

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.

2. Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.

3. ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.

**Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.

4. Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

5. Wanneer ComboFix klaar is, zal het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

HairyHippie · 18 juli 2011

Hierbij het resultaat van ComboFix.

ComboFix 11-07-18.01 - Joop 18-07-2011 17:33:52.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1535.987 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Joop\Bureaublad\ComboFix.exe

AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Bezoeker\WINDOWS

c:\documents and settings\Default User\WINDOWS

c:\documents and settings\Joop\WINDOWS

c:\documents and settings\Thea\WINDOWS

c:\windows\AUTOLNCH.REG

c:\windows\IsUn0413.exe

c:\windows\system32\config\systemprofile\WINDOWS

c:\windows\system32\Projects

c:\windows\system32\service

c:\windows\system32\service\10032011_TIS17_SfFniAU.log

c:\windows\system32\service\14052011_TIS17_SfFniAU.log

c:\windows\system32\service\28052010_TIS17_SfFniAU.log

c:\windows\unin0413.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-06-18 to 2011-07-18 ))))))))))))))))))))))))))))))

.

2011-07-18 15:14 . 2011-07-18 15:17 -------- d-----w- C:\Snelkoppelingen

2011-07-15 16:32 . 2011-07-16 08:22 -------- d-----w- c:\documents and settings\Joop\DoctorWeb

2011-07-13 18:58 . 2011-07-13 18:58 -------- d-----w- c:\documents and settings\Joop\Application Data\Malwarebytes

2011-07-13 18:58 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-13 18:58 . 2011-07-13 18:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-07-13 18:58 . 2011-07-16 19:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-07-13 18:58 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-10 18:21 . 2011-07-10 18:30 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-07-10 17:47 . 2011-07-18 15:13 -------- d--h--r- c:\documents and settings\Joop\Onlangs geopend

2011-07-10 17:16 . 2011-07-10 17:16 -------- d-----w- c:\program files\CCleaner

2011-07-10 17:08 . 2011-07-10 17:08 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-07-09 09:55 . 2011-07-09 09:55 53 ----a-w- c:\windows\DelToolbox.bat

2011-06-26 12:15 . 2011-06-26 15:37 -------- d-----w- c:\windows\SxsCaPendDel

2011-06-25 15:00 . 2011-06-25 15:00 -------- d-----w- c:\documents and settings\LocalService\Application Data\Trend Micro

2011-06-25 14:59 . 2011-06-25 14:48 92112 ----a-w- c:\windows\system32\drivers\tmtdi.sys

2011-06-25 14:59 . 2010-12-30 11:39 80464 ----a-w- c:\windows\system32\drivers\tmactmon.sys

2011-06-25 14:59 . 2010-12-30 11:39 64080 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys

2011-06-25 14:59 . 2010-12-30 11:39 190544 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2011-06-25 14:59 . 2011-06-25 14:59 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Trend Micro

2011-06-24 22:01 . 2011-06-24 22:01 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll

2011-06-24 22:01 . 2011-06-24 22:01 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll

2011-06-18 19:22 . 2011-06-18 19:22 -------- d-----w- c:\program files\TagRename

2011-06-18 19:12 . 2011-05-04 02:52 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

2011-06-18 19:12 . 2011-05-04 02:52 472808 ----a-w- c:\windows\system32\deployJava1.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-21 18:38 . 2011-05-15 11:46 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-06 11:35 . 2006-03-10 22:43 1859072 ----a-w- c:\windows\system32\win32k.sys

2011-05-04 00:25 . 2007-06-14 20:06 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-05-02 15:31 . 2006-03-10 22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-04-29 17:25 . 2006-03-10 22:42 151552 ----a-w- c:\windows\system32\schannel.dll

2011-04-29 16:19 . 2006-03-10 22:42 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-04-26 11:07 . 2006-03-10 22:43 293888 ----a-w- c:\windows\system32\winsrv.dll

2011-04-26 11:07 . 2006-03-10 22:40 33280 ----a-w- c:\windows\system32\csrsrv.dll

2011-04-25 16:05 . 2006-03-10 22:43 916480 ----a-w- c:\windows\system32\wininet.dll

2011-04-25 16:05 . 2006-03-10 22:42 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-04-25 16:05 . 2006-03-10 22:41 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-04-25 12:01 . 2006-03-10 15:50 385024 ----a-w- c:\windows\system32\html.iec

2011-04-21 13:37 . 2006-03-10 22:42 105472 ----a-w- c:\windows\system32\drivers\mup.sys

2011-06-24 22:01 . 2011-05-09 17:48 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2002-11-18 4243456]

"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]

"HP Lamp"="c:\program files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hplamp.exe" [2001-04-27 53248]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-07-14 57344]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-02-17 1111568]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"SetDefaultMIDI"="MIDIDEF.EXE" [2002-01-14 61440]

.

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"Data Secure"=c:\apps\DataSecure\PBBckupUI.exe /HIDDEN

"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

"Picasa Media Detector"=c:\program files\Picasa2\PicasaMediaDetector.exe

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe"

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"

"PnPUI Registrator"=c:\program files\Common Files\Sitecom Shared\PnP Universal Installer\PnPUIReg.exe -s

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

"nwiz"=nwiz.exe /install

"USB Storage Toolbox"=c:\program files\USB Disk Win98 Driver\Res.EXE

"WINDVDPatch"=CTHELPER.EXE

"HPDJ Taskbar Utility"=c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Utorrent\\utorrent.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [13-3-2006 22:49 4064]

R2 DevNotifySvc;DevNotifySvc;c:\program files\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe [14-6-2011 20:49 32768]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [13-7-2011 20:58 366640]

R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [25-6-2011 16:59 64080]

R2 wuaumgr;Windows Updates;c:\windows\system32\wupdmgr1.exe -daemon --> c:\windows\system32\wupdmgr1.exe -daemon [?]

R3 EL910;3Com 3CSOHO100B-TX PCI;c:\windows\system32\drivers\EL910N51.sys [11-3-2006 0:49 38400]

R3 hpusbfd;Hewlett-Packard USB Filter Class;c:\windows\system32\drivers\hpusbfd.sys [13-3-2006 23:08 7552]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [13-7-2011 20:58 22712]

S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [25-6-2011 16:57 188272]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10-1-2010 12:59 135664]

S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [10-1-2010 12:59 135664]

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - PAVDRV

*NewlyCreated* - PAVSRV

*Deregistered* - PAVDRV

*Deregistered* - PAVSRV

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-24 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 08:09]

.

2011-06-16 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 10:50]

.

2011-07-18 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-03 14:01]

.

2011-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-10 10:59]

.

2011-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-10 10:59]

.

2011-07-18 c:\windows\Tasks\User_Feed_Synchronization-{33643F96-3646-430A-939C-882F19BB282B}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.soople.nl/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

Trusted Zone: postbank.nl

TCP: DhcpNameServer = 192.168.1.1

Handler: copernicagent - {A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6} - c:\progra~1\COPERN~1\COPERN~1.DLL

Handler: copernicagentcache - {AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D} - c:\progra~1\COPERN~1\COPERN~1.DLL

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\Joop\Application Data\Mozilla\Firefox\Profiles\fn9fdfcb.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.nl/

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 200000

FF - user.js: content.notify.interval - 100000

FF - user.js: content.switch.threshold - 650000

FF - user.js: nglayout.initialpaint.delay - 300

.

- - - - ORPHANS VERWIJDERD - - - -

.

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

AddRemove-Adobe PhotoDeluxe Business Editie 1.0 - c:\windows\UNIN0413.EXE

AddRemove-Adobe Type Manager 4.0 - c:\windows\unin0413.exe

AddRemove-HP PrecisionScan Pro - c:\windows\IsUn0413.exe

AddRemove-Microsoft Interactive Training - c:\windows\IsUn0413.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-07-18 17:40

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-3835882175-825991918-161847939-1006\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

.

Voltooingstijd: 2011-07-18 17:43:31

ComboFix-quarantined-files.txt 2011-07-18 15:43

.

Pre-Run: 77.626.359.808 bytes beschikbaar

Post-Run: 77.951.873.024 bytes beschikbaar

.

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

.

- - End Of File - - D5DF65A25A28AD8ED5766186A3F7F414

kape · 18 juli 2011

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\wupdmgr1.exe

Folder::

c:\documents and settings\Joop\DoctorWeb

Driver::

wuaumgr

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

HairyHippie · 18 juli 2011

ComboFix 11-07-18.04 - Joop 18-07-2011 20:59:14.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1535.1114 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Joop\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Joop\Bureaublad\CFScript.txt

AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}

.

FILE ::

"c:\windows\system32\wupdmgr1.exe"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Joop\DoctorWeb

c:\documents and settings\Joop\DoctorWeb\CureIt.log

c:\windows\system32\Projects

c:\windows\system32\wupdmgr1.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_WUAUMGR

-------\Service_wuaumgr

.