Ga naar inhoud

Conhost.exe 2


Aanbevolen berichten

TDSS is prima verlopen, bij Combofix is er iets misgegaan.

Dit mag je nog eens herdoen :

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Firefox::

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\6pac91jj.default\

FF - prefs.js: browser.search.defaulturl –

FF - prefs.js: browser.search.selectedEngine –

FF - prefs.js: keyword.URL –

Sla dit bestand op je bureaublad op als CFScript.txt.

Bedoeling is dat je dit scriptje (CFScript.txt) IN de rode snelkoppeling van Combofix sleept en dan begint de verwerking van deze opdracht. Wil je dat nog eens herhalen en daarna een nieuw logje van Combofix plaatsen.

Link naar reactie
Delen op andere sites

Hopelijk is deze ok.

ComboFix 11-08-30.01 - HP_Administrator 30/08/2011 15:22:00.3.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1015.380 [GMT 2:00]

Gestart vanuit: c:\documents and settings\HP_Administrator\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\HP_Administrator\Bureaublad\CFScript.txt

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-07-28 to 2011-08-30 ))))))))))))))))))))))))))))))

.

.

2011-08-29 20:24 . 2011-08-29 20:24 -------- d-----w- C:\$AVG8.VAULT$

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes

2011-08-29 18:52 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-08-29 18:52 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-28 20:12 . 2011-08-29 18:49 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Sammsoft

2011-08-28 11:29 . 2011-08-28 11:29 388096 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-08-28 11:29 . 2011-08-28 11:29 -------- d-----w- c:\program files\Trend Micro

2011-08-28 10:43 . 2011-08-28 10:43 1152 ----a-w- c:\windows\system32\windrv.sys

2011-08-28 10:43 . 2011-08-28 11:58 -------- d-----w- c:\program files\SpyNoMore

2011-08-28 10:35 . 2011-08-28 10:42 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\GetRightToGo

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-08-27 06:19 . 2011-06-03 05:04 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-15 13:29 . 2009-01-12 06:27 456320 ------w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 2009-01-12 06:27 10496 ------w- c:\windows\system32\drivers\ndistapi.sys

2011-06-28 17:37 . 2011-02-15 16:54 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-06-28 17:37 . 2011-02-15 16:54 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys

2011-06-24 14:10 . 2009-01-21 06:39 139656 ------w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:31 . 2009-01-12 06:27 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:31 . 2009-01-12 06:27 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:31 . 2009-01-12 06:27 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:05 . 2009-01-12 06:27 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44 . 2009-01-12 06:27 293888 ----a-w- c:\windows\system32\winsrv.dll

2011-06-06 11:35 . 2009-01-12 06:27 1859072 ----a-w- c:\windows\system32\win32k.sys

2011-08-27 09:20 . 2011-07-17 14:30 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((( SnapShot@2011-08-30_05.59.28 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-08-30 11:58 . 2011-08-30 11:58 16384 c:\windows\Temp\Perflib_Perfdata_55c.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 91118 c:\windows\system32\perfc013.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 71478 c:\windows\system32\perfc009.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 509046 c:\windows\system32\perfh013.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 441160 c:\windows\system32\perfh009.dat

+ 2011-08-30 07:52 . 2011-08-30 07:52 807936 c:\windows\Installer\2590525.msi

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2011-03-18 06:11 2471240 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-10-26 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-10-26 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-10-26 137752]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2009-06-04 2056192]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]

"FLMOFFICE4DMOUSE"="c:\program files\Labtec\Desktop\V5.1\moffice.exe" [2009-06-30 958464]

"OFFICEKB"="c:\program files\Labtec\Desktop\V5.1\kbdap32a.exe" [2009-06-30 387584]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-17 2048352]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]

"RTHDCPL"="RTHDCPL.EXE" [2008-10-26 17021440]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]

"SNM"="c:\program files\SpyNoMore\SNM.exe" [2010-07-12 1067984]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

.

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-12 110592]

HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2008-6-5 479232]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqcopy2.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqsudi.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqpsapp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqpse.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgplgtupl.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgpc01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgm.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgh.exe"=

"c:\\Program Files\\Hp\\HP Software Update\\hpwucli.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=

"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=

"c:\\wamp\\bin\\apache\\Apache2.2.17\\bin\\httpd.exe"=

"c:\\Program Files\\GIMPshop\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=

.

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13/09/2009 8:25 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13/09/2009 8:25 108552]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15/02/2011 18:54 136360]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [13/09/2009 8:25 297752]

R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [20/01/2009 8:56 712704]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20/01/2011 14:44 136176]

S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\drivers\a38usb.sys [24/03/2006 19:14 33536]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe [5/11/2010 10:48 947528]

S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [20/01/2011 14:44 136176]

S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 13:37 517096]

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - 59942266

*Deregistered* - 59942266

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-25 c:\windows\Tasks\AdobeAAMUpdater-1.0-UW-3223ECC21047-HP_Administrator.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-06-25 15:42]

.

2011-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 12:44]

.

2011-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 12:44]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://decopains.be/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

Trusted Zone: taxonweb.be

TCP: DhcpNameServer = 192.168.1.1 192.168.123.254

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\6pac91jj.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - prefs.js: browser.search.selectedEngine - SweetIM Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2603445&q=

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-08-30 15:35

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,22,02,91,99,7c,1d,9c,47,8e,16,97,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,22,02,91,99,7c,1d,9c,47,8e,16,97,\

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'winlogon.exe'(756)

c:\windows\system32\CLBCATQ.DLL

c:\windows\system32\igfxdev.dll

.

- - - - - - - > 'explorer.exe'(3084)

c:\program files\SmartFTP Client\en-US\sfShellTools.dll.mui

c:\windows\system32\webcheck.dll

.

Voltooingstijd: 2011-08-30 15:46:37

ComboFix-quarantined-files.txt 2011-08-30 13:46

ComboFix2.txt 2011-08-30 12:27

ComboFix3.txt 2011-08-30 06:07

.

Pre-Run: 28.013.846.528 bytes beschikbaar

Post-Run: 28.005.797.888 bytes beschikbaar

.

- - End Of File - - 49FA8FA8CC200CB48A1DEFCAB09F4A17

Link naar reactie
Delen op andere sites

De uitvoering is OK, maar mogelijk is de reactie op het gekopieerde scriptje niet helemaal in orde (de items zijn nog steeds aanwezig). Nog even opnieuw maar nu met dit (het verschil tussen de vorige opdracht en deze is zo klein dat je ze vermoedelijk zelfs niet zal zien, maar het is er wel) :

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Firefox::

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\6pac91jj.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: browser.search.selectedEngine -

FF - prefs.js: keyword.URL -

Sla dit bestand op je bureaublad op als CFScript.txt en dan verder zoals eerder aangegeven.

Even duimen dat het nu wél lukt ...

Link naar reactie
Delen op andere sites

Terug,hieronder het logje van combofix.

En heb nog eens een scan met TDSS gedaan eveneens.

ComboFix 11-08-30.02 - HP_Administrator 31/08/2011 9:52.5.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1015.477 [GMT 2:00]

Gestart vanuit: c:\documents and settings\HP_Administrator\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\HP_Administrator\Bureaublad\CFScript.txt

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

* Nieuw herstelpunt werd aangemaakt

.

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-07-28 to 2011-08-31 ))))))))))))))))))))))))))))))

.

.

2011-08-29 20:24 . 2011-08-29 20:24 -------- d-----w- C:\$AVG8.VAULT$

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes

2011-08-29 18:52 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-08-29 18:52 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-28 20:12 . 2011-08-29 18:49 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Sammsoft

2011-08-28 11:29 . 2011-08-28 11:29 388096 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-08-28 11:29 . 2011-08-28 11:29 -------- d-----w- c:\program files\Trend Micro

2011-08-28 10:43 . 2011-08-28 10:43 1152 ----a-w- c:\windows\system32\windrv.sys

2011-08-28 10:43 . 2011-08-28 11:58 -------- d-----w- c:\program files\SpyNoMore

2011-08-28 10:35 . 2011-08-28 10:42 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\GetRightToGo

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-08-27 06:19 . 2011-06-03 05:04 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-15 13:29 . 2009-01-12 06:27 456320 ------w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 2009-01-12 06:27 10496 ------w- c:\windows\system32\drivers\ndistapi.sys

2011-06-28 17:37 . 2011-02-15 16:54 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-06-28 17:37 . 2011-02-15 16:54 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys

2011-06-24 14:10 . 2009-01-21 06:39 139656 ------w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:31 . 2009-01-12 06:27 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:31 . 2009-01-12 06:27 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:31 . 2009-01-12 06:27 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:05 . 2009-01-12 06:27 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44 . 2009-01-12 06:27 293888 ----a-w- c:\windows\system32\winsrv.dll

2011-06-06 11:35 . 2009-01-12 06:27 1859072 ----a-w- c:\windows\system32\win32k.sys

2011-08-27 09:20 . 2011-07-17 14:30 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((( SnapShot@2011-08-30_05.59.28 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-08-31 07:37 . 2011-08-31 07:37 16384 c:\windows\Temp\Perflib_Perfdata_490.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 91118 c:\windows\system32\perfc013.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 71478 c:\windows\system32\perfc009.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 509046 c:\windows\system32\perfh013.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 441160 c:\windows\system32\perfh009.dat

+ 2011-08-30 07:52 . 2011-08-30 07:52 807936 c:\windows\Installer\2590525.msi

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2011-03-18 06:11 2471240 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-10-26 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-10-26 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-10-26 137752]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2009-06-04 2056192]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]

"FLMOFFICE4DMOUSE"="c:\program files\Labtec\Desktop\V5.1\moffice.exe" [2009-06-30 958464]

"OFFICEKB"="c:\program files\Labtec\Desktop\V5.1\kbdap32a.exe" [2009-06-30 387584]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-17 2048352]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]

"RTHDCPL"="RTHDCPL.EXE" [2008-10-26 17021440]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]

"SNM"="c:\program files\SpyNoMore\SNM.exe" [2010-07-12 1067984]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

.

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-12 110592]

HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2008-6-5 479232]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqcopy2.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqsudi.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqpsapp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqpse.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgplgtupl.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgpc01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgm.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgh.exe"=

"c:\\Program Files\\Hp\\HP Software Update\\hpwucli.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=

"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=

"c:\\wamp\\bin\\apache\\Apache2.2.17\\bin\\httpd.exe"=

"c:\\Program Files\\GIMPshop\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=

.

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13/09/2009 8:25 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13/09/2009 8:25 108552]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15/02/2011 18:54 136360]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [13/09/2009 8:25 297752]

R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [20/01/2009 8:56 712704]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20/01/2011 14:44 136176]

S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\drivers\a38usb.sys [24/03/2006 19:14 33536]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe [5/11/2010 10:48 947528]

S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [20/01/2011 14:44 136176]

S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 13:37 517096]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-25 c:\windows\Tasks\AdobeAAMUpdater-1.0-UW-3223ECC21047-HP_Administrator.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-06-25 15:42]

.

2011-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 12:44]

.

2011-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 12:44]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://decopains.be/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

Trusted Zone: taxonweb.be

TCP: DhcpNameServer = 192.168.1.1 192.168.123.254

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\6pac91jj.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-08-31 10:06

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,22,02,91,99,7c,1d,9c,47,8e,16,97,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,22,02,91,99,7c,1d,9c,47,8e,16,97,\

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'winlogon.exe'(756)

c:\windows\system32\igfxdev.dll

.

- - - - - - - > 'explorer.exe'(3104)

c:\program files\SmartFTP Client\en-US\sfShellTools.dll.mui

c:\windows\system32\webcheck.dll

.

Voltooingstijd: 2011-08-31 10:17:07

ComboFix-quarantined-files.txt 2011-08-31 08:16

ComboFix2.txt 2011-08-30 16:52

ComboFix3.txt 2011-08-30 13:46

ComboFix4.txt 2011-08-30 12:27

ComboFix5.txt 2011-08-31 07:49

.

Pre-Run: 27.917.856.768 bytes beschikbaar

Post-Run: 27.970.703.360 bytes beschikbaar

.

- - End Of File - - 98752A7BB30FA1DB4A49C024A803B7FF

2011/08/31 10:39:04.0250 1696 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57

2011/08/31 10:39:04.0609 1696 ================================================================================

2011/08/31 10:39:04.0609 1696 SystemInfo:

2011/08/31 10:39:04.0609 1696

2011/08/31 10:39:04.0609 1696 OS Version: 5.1.2600 ServicePack: 3.0

2011/08/31 10:39:04.0609 1696 Product type: Workstation

2011/08/31 10:39:04.0609 1696 ComputerName: UW-3223ECC21047

2011/08/31 10:39:04.0609 1696 UserName: HP_Administrator

2011/08/31 10:39:04.0609 1696 Windows directory: C:\windows

2011/08/31 10:39:04.0609 1696 System windows directory: C:\windows

2011/08/31 10:39:04.0609 1696 Processor architecture: Intel x86

2011/08/31 10:39:04.0609 1696 Number of processors: 2

2011/08/31 10:39:04.0609 1696 Page size: 0x1000

2011/08/31 10:39:04.0609 1696 Boot type: Normal boot

2011/08/31 10:39:04.0609 1696 ================================================================================

2011/08/31 10:39:06.0375 1696 Initialize success

2011/08/31 10:39:08.0937 2784 ================================================================================

2011/08/31 10:39:08.0937 2784 Scan started

2011/08/31 10:39:08.0937 2784 Mode: Manual;

2011/08/31 10:39:08.0937 2784 ================================================================================

2011/08/31 10:39:10.0906 2784 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\windows\system32\drivers\abp480n5.sys

2011/08/31 10:39:10.0984 2784 ACPI (02273a448ba21a7d447daeb47810d40c) C:\windows\system32\DRIVERS\ACPI.sys

2011/08/31 10:39:11.0109 2784 ACPIEC (63f517b1a87dabf3f5acb8a7952fc1d1) C:\windows\system32\drivers\ACPIEC.sys

2011/08/31 10:39:11.0296 2784 ACSSCR (b6a0f723a54884e77fce0f69083f90c9) C:\windows\system32\DRIVERS\a38usb.sys

2011/08/31 10:39:11.0359 2784 adpu160m (9a11864873da202c996558b2106b0bbc) C:\windows\system32\drivers\adpu160m.sys

2011/08/31 10:39:11.0406 2784 aec (8bed39e3c35d6a489438b8141717a557) C:\windows\system32\drivers\aec.sys

2011/08/31 10:39:11.0484 2784 AFD (355556d9e580915118cd7ef736653a89) C:\windows\System32\drivers\afd.sys

2011/08/31 10:39:11.0531 2784 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\windows\system32\drivers\Aha154x.sys

2011/08/31 10:39:11.0578 2784 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\windows\system32\drivers\aic78u2.sys

2011/08/31 10:39:11.0625 2784 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\windows\system32\drivers\aic78xx.sys

2011/08/31 10:39:11.0671 2784 AliIde (1140ab9938809700b46bb88e46d72a96) C:\windows\system32\drivers\AliIde.sys

2011/08/31 10:39:11.0734 2784 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\windows\system32\drivers\amsint.sys

2011/08/31 10:39:11.0812 2784 asc (62d318e9a0c8fc9b780008e724283707) C:\windows\system32\drivers\asc.sys

2011/08/31 10:39:11.0859 2784 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\windows\system32\drivers\asc3350p.sys

2011/08/31 10:39:11.0906 2784 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\windows\system32\drivers\asc3550.sys

2011/08/31 10:39:12.0000 2784 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\windows\system32\DRIVERS\asyncmac.sys

2011/08/31 10:39:12.0062 2784 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\windows\system32\DRIVERS\atapi.sys

2011/08/31 10:39:12.0140 2784 Atmarpc (9916c1225104ba14794209cfa8012159) C:\windows\system32\DRIVERS\atmarpc.sys

2011/08/31 10:39:12.0187 2784 audstub (d9f724aa26c010a217c97606b160ed68) C:\windows\system32\DRIVERS\audstub.sys

2011/08/31 10:39:12.0343 2784 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys

2011/08/31 10:39:12.0406 2784 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\windows\System32\Drivers\avgldx86.sys

2011/08/31 10:39:12.0453 2784 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\windows\System32\Drivers\avgmfx86.sys

2011/08/31 10:39:12.0500 2784 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\windows\system32\DRIVERS\avgntflt.sys

2011/08/31 10:39:12.0562 2784 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\windows\System32\Drivers\avgtdix.sys

2011/08/31 10:39:12.0609 2784 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\windows\system32\DRIVERS\avipbb.sys

2011/08/31 10:39:12.0671 2784 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\windows\system32\drivers\Beep.sys

2011/08/31 10:39:12.0906 2784 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\windows\system32\drivers\cbidf2k.sys

2011/08/31 10:39:12.0953 2784 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\windows\system32\drivers\cd20xrnt.sys

2011/08/31 10:39:13.0000 2784 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\windows\system32\drivers\Cdaudio.sys

2011/08/31 10:39:13.0062 2784 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\windows\system32\drivers\Cdfs.sys

2011/08/31 10:39:13.0125 2784 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\windows\system32\DRIVERS\cdrom.sys

2011/08/31 10:39:13.0187 2784 Changer (2a5815ca6fff24b688c01f828b96819c) C:\windows\system32\drivers\Changer.sys

2011/08/31 10:39:13.0265 2784 CmdIde (026ba1f2d9c9f742ec3823d0214cd67c) C:\windows\system32\drivers\CmdIde.sys

2011/08/31 10:39:13.0359 2784 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\windows\system32\drivers\Cpqarray.sys

2011/08/31 10:39:13.0421 2784 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\windows\system32\drivers\dac2w2k.sys

2011/08/31 10:39:13.0468 2784 dac960nt (683789caa3864eb46125ae86ff677d34) C:\windows\system32\drivers\dac960nt.sys

2011/08/31 10:39:13.0546 2784 Disk (044452051f3e02e7963599fc8f4f3e25) C:\windows\system32\DRIVERS\disk.sys

2011/08/31 10:39:13.0656 2784 dmboot (dec123e0c75971d0cc7a6c6a75e28429) C:\windows\system32\drivers\dmboot.sys

2011/08/31 10:39:13.0718 2784 dmio (7268e66259722f6228c730685b201092) C:\windows\system32\drivers\dmio.sys

2011/08/31 10:39:13.0765 2784 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\windows\system32\drivers\dmload.sys

2011/08/31 10:39:13.0812 2784 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\windows\system32\drivers\DMusic.sys

2011/08/31 10:39:13.0890 2784 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\windows\system32\drivers\dpti2o.sys

2011/08/31 10:39:13.0937 2784 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\windows\system32\drivers\drmkaud.sys

2011/08/31 10:39:14.0046 2784 Fastfat (38d332a6d56af32635675f132548343e) C:\windows\system32\drivers\Fastfat.sys

2011/08/31 10:39:14.0125 2784 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\windows\system32\drivers\Fdc.sys

2011/08/31 10:39:14.0156 2784 Fips (8bfffb5ac954e19dfdb96d56512aa518) C:\windows\system32\drivers\Fips.sys

2011/08/31 10:39:14.0218 2784 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\windows\system32\drivers\Flpydisk.sys

2011/08/31 10:39:14.0281 2784 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\windows\system32\DRIVERS\fltMgr.sys

2011/08/31 10:39:14.0375 2784 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\windows\system32\drivers\Fs_Rec.sys

2011/08/31 10:39:14.0453 2784 Ftdisk (fa8ca22e70245c81ff29c36af56292fc) C:\windows\system32\DRIVERS\ftdisk.sys

2011/08/31 10:39:14.0531 2784 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\windows\system32\DRIVERS\msgpc.sys

2011/08/31 10:39:14.0656 2784 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\windows\system32\DRIVERS\HDAudBus.sys

2011/08/31 10:39:14.0750 2784 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\windows\system32\DRIVERS\hidusb.sys

2011/08/31 10:39:14.0828 2784 hpn (b028377dea0546a5fcfba928a8aefae0) C:\windows\system32\drivers\hpn.sys

2011/08/31 10:39:14.0906 2784 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\windows\system32\DRIVERS\HPZid412.sys

2011/08/31 10:39:14.0953 2784 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\windows\system32\DRIVERS\HPZipr12.sys

2011/08/31 10:39:15.0015 2784 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\windows\system32\DRIVERS\HPZius12.sys

2011/08/31 10:39:15.0468 2784 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\windows\system32\Drivers\HTTP.sys

2011/08/31 10:39:15.0703 2784 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\windows\system32\drivers\i2omgmt.sys

2011/08/31 10:39:15.0828 2784 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\windows\system32\drivers\i2omp.sys

2011/08/31 10:39:16.0156 2784 i8042prt (c43372d0682f8e32e4ec21117e089ec0) C:\windows\system32\DRIVERS\i8042prt.sys

2011/08/31 10:39:17.0109 2784 ialm (48846b31be5a4fa662ccfde7a1ba86b9) C:\windows\system32\DRIVERS\igxpmp32.sys

2011/08/31 10:39:17.0687 2784 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\windows\system32\DRIVERS\imapi.sys

2011/08/31 10:39:17.0765 2784 ini910u (4a40e045faee58631fd8d91afc620719) C:\windows\system32\drivers\ini910u.sys

2011/08/31 10:39:17.0937 2784 IntcAzAudAddService (bd4d6e6f708aa8503653e2be9d53459b) C:\windows\system32\drivers\RtkHDAud.sys

2011/08/31 10:39:18.0140 2784 IntelIde (72c63ad984d427d34bd5b9db838d88eb) C:\windows\system32\drivers\IntelIde.sys

2011/08/31 10:39:18.0171 2784 intelppm (2d2254fac267e6b1c7865e8ebef60c6d) C:\windows\system32\DRIVERS\intelppm.sys

2011/08/31 10:39:18.0218 2784 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\windows\system32\DRIVERS\Ip6Fw.sys

2011/08/31 10:39:18.0250 2784 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\windows\system32\DRIVERS\ipfltdrv.sys

2011/08/31 10:39:18.0281 2784 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\windows\system32\DRIVERS\ipinip.sys

2011/08/31 10:39:18.0328 2784 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\windows\system32\DRIVERS\ipnat.sys

2011/08/31 10:39:18.0390 2784 IPSec (23c74d75e36e7158768dd63d92789a91) C:\windows\system32\DRIVERS\ipsec.sys

2011/08/31 10:39:18.0437 2784 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\windows\system32\DRIVERS\irenum.sys

2011/08/31 10:39:18.0500 2784 isapnp (0b78e1a31340e1fb1e389d5633f7c3a0) C:\windows\system32\DRIVERS\isapnp.sys

2011/08/31 10:39:18.0578 2784 Jukebox3 (6c24d3878f44c271d94ea6cab1acd739) C:\windows\system32\DRIVERS\ctpdusb.sys

2011/08/31 10:39:18.0625 2784 Kbdclass (380397621e94b32c744e7b2cc1330390) C:\windows\system32\DRIVERS\kbdclass.sys

2011/08/31 10:39:18.0687 2784 kbdhid (b833b70fe639f01fb36cedabe57ef031) C:\windows\system32\DRIVERS\kbdhid.sys

2011/08/31 10:39:18.0734 2784 kmixer (692bcf44383d056aed41b045a323d378) C:\windows\system32\drivers\kmixer.sys

2011/08/31 10:39:18.0781 2784 KSecDD (b467646c54cc746128904e1654c750c1) C:\windows\system32\drivers\KSecDD.sys

2011/08/31 10:39:18.0843 2784 lbrtfdc (406598827a1b5f77954de11dde115ced) C:\windows\system32\drivers\lbrtfdc.sys

2011/08/31 10:39:18.0953 2784 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\windows\system32\drivers\mnmdd.sys

2011/08/31 10:39:19.0078 2784 Modem (8114eeac353f549331ab73e9af4219ed) C:\windows\system32\drivers\Modem.sys

2011/08/31 10:39:19.0125 2784 Mouclass (1a4e2214dd63e4a876463d3427ee8261) C:\windows\system32\DRIVERS\mouclass.sys

2011/08/31 10:39:19.0187 2784 mouhid (18017899254e01371e1a39754d6bf98c) C:\windows\system32\DRIVERS\mouhid.sys

2011/08/31 10:39:19.0234 2784 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\windows\system32\drivers\MountMgr.sys

2011/08/31 10:39:19.0281 2784 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\windows\system32\drivers\mraid35x.sys

2011/08/31 10:39:19.0328 2784 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\windows\system32\DRIVERS\mrxdav.sys

2011/08/31 10:39:19.0390 2784 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\windows\system32\DRIVERS\mrxsmb.sys

2011/08/31 10:39:19.0484 2784 Msfs (c941ea2454ba8350021d774daf0f1027) C:\windows\system32\drivers\Msfs.sys

2011/08/31 10:39:19.0531 2784 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\windows\system32\drivers\MSKSSRV.sys

2011/08/31 10:39:19.0578 2784 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\windows\system32\drivers\MSPCLOCK.sys

2011/08/31 10:39:19.0625 2784 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\windows\system32\drivers\MSPQM.sys

2011/08/31 10:39:19.0671 2784 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\windows\system32\DRIVERS\mssmbios.sys

2011/08/31 10:39:19.0718 2784 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\windows\system32\drivers\Mup.sys

2011/08/31 10:39:19.0796 2784 NDIS (1df7f42665c94b825322fae71721130d) C:\windows\system32\drivers\NDIS.sys

2011/08/31 10:39:19.0843 2784 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\windows\system32\DRIVERS\ndistapi.sys

2011/08/31 10:39:19.0906 2784 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\windows\system32\DRIVERS\ndisuio.sys

2011/08/31 10:39:19.0968 2784 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\windows\system32\DRIVERS\ndiswan.sys

2011/08/31 10:39:20.0015 2784 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\windows\system32\drivers\NDProxy.sys

2011/08/31 10:39:20.0140 2784 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\windows\system32\DRIVERS\netbios.sys

2011/08/31 10:39:20.0203 2784 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\windows\system32\DRIVERS\netbt.sys

2011/08/31 10:39:20.0296 2784 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\windows\system32\drivers\Npfs.sys

2011/08/31 10:39:20.0359 2784 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\windows\system32\drivers\Ntfs.sys

2011/08/31 10:39:20.0437 2784 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\windows\system32\drivers\Null.sys

2011/08/31 10:39:20.0484 2784 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\windows\system32\DRIVERS\nwlnkflt.sys

2011/08/31 10:39:20.0531 2784 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\windows\system32\DRIVERS\nwlnkfwd.sys

2011/08/31 10:39:20.0593 2784 Parport (e3934ccc20a4d24f1924e13d36d2a5bd) C:\windows\system32\drivers\Parport.sys

2011/08/31 10:39:20.0625 2784 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\windows\system32\drivers\PartMgr.sys

2011/08/31 10:39:20.0671 2784 ParVdm (1eade28746a64c21e0a808bb12a63326) C:\windows\system32\drivers\ParVdm.sys

2011/08/31 10:39:20.0734 2784 PCI (3b166f9f753c21aedaa9a6bd76b49655) C:\windows\system32\DRIVERS\pci.sys

2011/08/31 10:39:20.0812 2784 PCIIde (b31edeba4da28283f6b8dc4756fb9585) C:\windows\system32\DRIVERS\pciide.sys

2011/08/31 10:39:20.0859 2784 Pcmcia (2137ffd65f8e609a3a5acd487c56cce0) C:\windows\system32\drivers\Pcmcia.sys

2011/08/31 10:39:21.0015 2784 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\windows\system32\drivers\perc2.sys

2011/08/31 10:39:21.0062 2784 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\windows\system32\drivers\perc2hib.sys

2011/08/31 10:39:21.0218 2784 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\windows\system32\DRIVERS\raspptp.sys

2011/08/31 10:39:21.0250 2784 PSched (09298ec810b07e5d582cb3a3f9255424) C:\windows\system32\DRIVERS\psched.sys

2011/08/31 10:39:21.0312 2784 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\windows\system32\DRIVERS\ptilink.sys

2011/08/31 10:39:21.0375 2784 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\windows\system32\Drivers\PxHelp20.sys

2011/08/31 10:39:21.0437 2784 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\windows\system32\drivers\ql1080.sys

2011/08/31 10:39:21.0484 2784 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\windows\system32\drivers\Ql10wnt.sys

2011/08/31 10:39:21.0531 2784 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\windows\system32\drivers\ql12160.sys

2011/08/31 10:39:21.0578 2784 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\windows\system32\drivers\ql1240.sys

2011/08/31 10:39:21.0625 2784 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\windows\system32\drivers\ql1280.sys

2011/08/31 10:39:21.0671 2784 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\windows\system32\DRIVERS\rasacd.sys

2011/08/31 10:39:21.0734 2784 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\windows\system32\DRIVERS\rasl2tp.sys

2011/08/31 10:39:21.0796 2784 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\windows\system32\DRIVERS\raspppoe.sys

2011/08/31 10:39:21.0859 2784 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\windows\system32\DRIVERS\raspti.sys

2011/08/31 10:39:21.0906 2784 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\windows\system32\DRIVERS\rdbss.sys

2011/08/31 10:39:21.0953 2784 RDPCDD (4912d5b403614ce99c28420f75353332) C:\windows\system32\DRIVERS\RDPCDD.sys

2011/08/31 10:39:22.0031 2784 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\windows\system32\drivers\RDPWD.sys

2011/08/31 10:39:22.0078 2784 redbook (4173bc66e485fd77a03c4819f60bd0da) C:\windows\system32\DRIVERS\redbook.sys

2011/08/31 10:39:22.0234 2784 RT80x86 (ed36e76a08971e133c3c5e2440bfbe84) C:\windows\system32\DRIVERS\RT2860.sys

2011/08/31 10:39:22.0281 2784 RTLE8023xp (f0a21c62b9b835e1c96268eaae31d239) C:\windows\system32\DRIVERS\Rtenicxp.sys

2011/08/31 10:39:22.0375 2784 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\DRIVERS\secdrv.sys

2011/08/31 10:39:22.0437 2784 Serial (92c21762653bb2ce51147eb8a9aa654f) C:\windows\system32\drivers\Serial.sys

2011/08/31 10:39:22.0500 2784 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\windows\system32\drivers\Sfloppy.sys

2011/08/31 10:39:22.0625 2784 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\windows\system32\drivers\Sparrow.sys

2011/08/31 10:39:22.0671 2784 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\windows\system32\drivers\splitter.sys

2011/08/31 10:39:22.0734 2784 sr (64d2a7640e0767ecd3bcb38d3200e7ce) C:\windows\system32\DRIVERS\sr.sys

2011/08/31 10:39:22.0812 2784 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\windows\system32\DRIVERS\srv.sys

2011/08/31 10:39:22.0875 2784 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\windows\system32\DRIVERS\ssmdrv.sys

2011/08/31 10:39:22.0906 2784 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\windows\system32\DRIVERS\swenum.sys

2011/08/31 10:39:22.0984 2784 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\windows\system32\drivers\swmidi.sys

2011/08/31 10:39:23.0046 2784 symc810 (1ff3217614018630d0a6758630fc698c) C:\windows\system32\drivers\symc810.sys

2011/08/31 10:39:23.0093 2784 symc8xx (070e001d95cf725186ef8b20335f933c) C:\windows\system32\drivers\symc8xx.sys

2011/08/31 10:39:23.0140 2784 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\windows\system32\drivers\sym_hi.sys

2011/08/31 10:39:23.0203 2784 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\windows\system32\drivers\sym_u3.sys

2011/08/31 10:39:23.0296 2784 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\windows\system32\drivers\sysaudio.sys

2011/08/31 10:39:23.0375 2784 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\windows\system32\DRIVERS\tcpip.sys

2011/08/31 10:39:23.0437 2784 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\windows\system32\drivers\TDPIPE.sys

2011/08/31 10:39:23.0468 2784 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\windows\system32\drivers\TDTCP.sys

2011/08/31 10:39:23.0531 2784 TermDD (88155247177638048422893737429d9e) C:\windows\system32\DRIVERS\termdd.sys

2011/08/31 10:39:23.0625 2784 TosIde (5bc2144ab4f6090f12e49e9648b5a702) C:\windows\system32\drivers\TosIde.sys

2011/08/31 10:39:23.0703 2784 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\windows\system32\drivers\Udfs.sys

2011/08/31 10:39:23.0750 2784 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\windows\system32\drivers\ultra.sys

2011/08/31 10:39:23.0812 2784 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\windows\system32\DRIVERS\update.sys

2011/08/31 10:39:23.0906 2784 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\windows\system32\DRIVERS\usbccgp.sys

2011/08/31 10:39:23.0968 2784 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\windows\system32\DRIVERS\usbehci.sys

2011/08/31 10:39:24.0031 2784 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\windows\system32\DRIVERS\usbhub.sys

2011/08/31 10:39:24.0078 2784 usbprint (a717c8721046828520c9edf31288fc00) C:\windows\system32\DRIVERS\usbprint.sys

2011/08/31 10:39:24.0125 2784 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\windows\system32\DRIVERS\usbscan.sys

2011/08/31 10:39:24.0171 2784 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\windows\system32\DRIVERS\usbser.sys

2011/08/31 10:39:24.0234 2784 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\windows\system32\DRIVERS\USBSTOR.SYS

2011/08/31 10:39:24.0312 2784 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\windows\system32\DRIVERS\usbuhci.sys

2011/08/31 10:39:24.0359 2784 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\windows\System32\drivers\vga.sys

2011/08/31 10:39:24.0406 2784 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\windows\system32\drivers\ViaIde.sys

2011/08/31 10:39:24.0453 2784 VolSnap (8ab662b3c4691e6ddf61c96bb5b7d103) C:\windows\system32\drivers\VolSnap.sys

2011/08/31 10:39:24.0578 2784 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\windows\system32\DRIVERS\wanarp.sys

2011/08/31 10:39:24.0640 2784 wdmaud (6768acf64b18196494413695f0c3a00f) C:\windows\system32\drivers\wdmaud.sys

2011/08/31 10:39:24.0875 2784 MBR (0x1B8) (326b1b82aff839009448e346f5d9ac45) \Device\Harddisk0\DR0

2011/08/31 10:39:25.0515 2784 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR3

2011/08/31 10:39:25.0562 2784 Boot (0x1200) (7f95df88909490bb0600e5854c337a93) \Device\Harddisk0\DR0\Partition0

2011/08/31 10:39:25.0625 2784 Boot (0x1200) (0202d0a0837c799bff628e1f9e740a55) \Device\Harddisk0\DR0\Partition1

2011/08/31 10:39:25.0640 2784 Boot (0x1200) (d9494b52412302b6d824720c6f3a432d) \Device\Harddisk1\DR3\Partition0

2011/08/31 10:39:25.0671 2784 ================================================================================

2011/08/31 10:39:25.0671 2784 Scan finished

2011/08/31 10:39:25.0671 2784 ================================================================================

2011/08/31 10:39:25.0703 4092 Detected object count: 0

2011/08/31 10:39:25.0703 4092 Actual detected object count: 0

Link naar reactie
Delen op andere sites

Problemen van de baan, dan is het tijd voor de “grote schoonmaak” : verwijderen van gebruikte programma’s, een cleaning en het verwijderen van de besmette herstelpunten.

Verwijder del.bat, TDSS-killer en HijackThis.

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht en typ: ComboFix /Uninstall

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Download CCleaner.

Klik op “Download Latest Version” en dan start de download van CCleaner automatisch en gratis op.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Wil je dit uitgebreid in beeld bekijken, klik dan hier voor de handleiding.

Het is aangewezen om de bestaande herstelpunten te verwijderen (daar zitten besmette herstelpunten tussen die je eventueel zou kunnen terugzetten) door systeemherstel tijdelijk uit te schakelen. Doe dit via Start -> Configuratiescherm -> Prestaties en Onderhoud -> Systeem -> Systeemherstel -> "Systeemherstel op alle stations uitschakelen" aanvinken. Toepassen en OK. PC herstarten en het vinkje terug weg halen.

Als dit allemaal probleemloos verlopen is, mag je hieronder op "opgelost" tokkelen ;-)

Link naar reactie
Delen op andere sites

×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.