Babylon toolbar

kweezie wabbit · 24 november 2011

Ik zie sporen van een keygenarator in dit logje.

Een keygenarator wordt gebruikt om een sleutelcode te genereren als je illegale software wil installeren.

Dit is echter niet zonder gevaar.

Ik had graag een eerlijk antwoord gehad op de vraag: heb je een keygenarator gebruikt om illegale software te installeren?

Doppie57 · 24 november 2011

ja, sinds gisteravond heb ik een illegale microsoft office geinstalleerd, nadat ik je mailde dat ik vandaag alles zou uitproberen, was voorheen dus niet.

kweezie wabbit · 25 november 2011

En die keygenerator heeft je vermoedelijk weer met die babylon toolbar opgezadeld.

Verwijder de keygenerator, ruim het register op met CCleaner en maak dan een nieuw logje met combofix.

Doppie57 · 26 november 2011

En die keygenerator heeft je vermoedelijk weer met die babylon toolbar opgezadeld.
Verwijder de keygenerator, ruim het register op met CCleaner en maak dan een nieuw logje met combofix.

ComboFix 11-11-26.04 - Yolanda 26-11-2011 22:26:51.7.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.6120.4452 [GMT 1:00]

Gestart vanuit: c:\users\Yolanda\Desktop\ComboFix.exe

AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}

SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-10-26 to 2011-11-26 ))))))))))))))))))))))))))))))

.

2011-11-26 21:29 . 2011-11-26 21:29 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-23 19:04 . 2011-11-24 13:51 -------- d-----w- c:\windows\AutoKMS

2011-11-23 19:02 . 2011-11-24 13:57 151552 ----a-w- c:\windows\KMSEmulator.exe

2011-11-23 18:12 . 2011-11-23 18:12 -------- d-----w- C:\$AVG

2011-11-23 17:07 . 2011-11-23 17:07 -------- d-----w- c:\users\Yolanda\AppData\Roaming\AVG2012

2011-11-23 17:07 . 2011-11-23 17:07 -------- d-----w- c:\windows\SysWow64\drivers\AVG

2011-11-23 17:06 . 2011-11-26 16:28 -------- d-----w- c:\windows\system32\drivers\AVG

2011-11-23 17:06 . 2011-11-23 17:51 -------- d-----w- c:\programdata\AVG2012

2011-11-23 17:05 . 2011-11-23 17:05 -------- d-----w- c:\program files (x86)\AVG

2011-11-23 17:03 . 2011-11-23 17:03 -------- d--h--w- c:\programdata\Common Files

2011-11-23 17:03 . 2011-11-26 16:28 -------- d-----w- c:\programdata\MFAData

2011-11-22 19:10 . 2011-10-07 04:16 8570192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1C737744-0A23-457C-98B6-236D9C7D5BBD}\mpengine.dll

2011-11-22 18:40 . 2011-11-23 17:41 -------- d-----w- C:\Backups

2011-11-22 18:39 . 2011-11-22 18:39 -------- d-----w- C:\Microsoft.NET

2011-11-21 05:39 . 2011-11-21 05:39 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll

2011-11-19 14:36 . 2011-11-19 14:36 388096 ----a-r- c:\users\Yolanda\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-11-19 14:36 . 2011-11-19 14:36 -------- d-----w- c:\program files (x86)\Trend Micro

2011-11-17 22:55 . 2011-11-17 22:55 -------- d-----w- c:\users\Yolanda\AppData\Local\MetaGeek,_LLC

2011-11-16 22:01 . 2011-11-16 22:02 -------- d-----w- c:\users\Gast

2011-11-11 13:08 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll

2011-11-11 13:08 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll

2011-11-11 13:08 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-11 13:08 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys

2011-11-06 14:44 . 2009-12-30 10:21 31800 ----a-w- c:\windows\system32\drivers\revoflt.sys

2011-11-06 14:44 . 2011-11-06 14:44 -------- d-----w- c:\program files\VS Revo Group

2011-11-06 14:21 . 2011-11-06 14:21 -------- d-----w- c:\users\Yolanda\AppData\Local\MAGIX

2011-11-06 14:21 . 2011-11-06 14:21 -------- d-----w- c:\users\Yolanda\AppData\Local\Xara

2011-11-06 14:19 . 2011-11-12 18:14 -------- d-----w- c:\users\Yolanda\AppData\Roaming\MAGIX

2011-11-06 14:19 . 2011-11-06 14:19 -------- d-----w- c:\program files (x86)\MAGIX

2011-11-06 14:18 . 2011-11-06 14:19 -------- d-----w- c:\programdata\MAGIX

2011-11-06 14:18 . 2011-11-06 14:18 -------- d-----w- c:\program files (x86)\Common Files\MAGIX Services

2011-11-06 14:18 . 2011-11-06 14:18 -------- d-----w- c:\program files\WMV9_VCM

2011-11-04 18:11 . 2011-11-04 18:11 -------- d-----w- c:\program files (x86)\RAR Password Recovery Magic

2011-10-29 10:00 . 2011-10-29 10:00 106488 ----a-w- c:\windows\system32\drivers\GRD.sys

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-21 05:39 . 2011-06-08 11:32 882496 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2011-11-13 08:46 . 2011-06-16 03:58 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-10-25 06:54 . 2011-07-26 16:38 59256 ----a-w- c:\windows\system32\drivers\PktIcpt.sys

2011-10-25 06:52 . 2011-07-26 16:38 50552 ----a-w- c:\windows\system32\drivers\GDBehave.sys

2011-10-25 06:52 . 2011-07-26 16:37 110968 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys

2011-10-25 06:52 . 2011-07-26 16:37 65912 ----a-w- c:\windows\system32\drivers\gdwfpcd64.sys

2011-10-22 11:19 . 2011-07-26 16:48 106648 ----a-w- c:\windows\SysWow64\drivers\GRD.sys

2011-10-07 05:23 . 2011-10-07 05:23 283728 ----a-w- c:\windows\system32\drivers\avgldx64.sys

2011-09-22 06:36 . 2011-10-25 06:52 2056200 ----a-w- c:\windows\SysWow64\GdScrSv.scr

2011-09-13 05:30 . 2011-09-13 05:30 37456 ----a-w- c:\windows\system32\drivers\avgrkx64.sys

2011-09-01 05:24 . 2011-10-13 17:36 2309120 ----a-w- c:\windows\system32\jscript9.dll

2011-09-01 05:17 . 2011-10-13 17:36 1389056 ----a-w- c:\windows\system32\wininet.dll

2011-09-01 05:12 . 2011-10-13 17:36 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-09-01 02:35 . 2011-10-13 17:36 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-09-01 02:28 . 2011-10-13 17:36 1126912 ----a-w- c:\windows\SysWow64\wininet.dll

2011-09-01 02:22 . 2011-10-13 17:36 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-08-31 16:00 . 2011-06-08 13:37 25416 ----a-w- c:\windows\system32\drivers\mbam.sys

.

((((((((((((((((((((((((((((( SnapShot_2011-11-26_17.45.46 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-07-14 05:10 . 2011-11-26 18:46 55412 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2011-06-08 09:58 . 2011-11-26 18:46 16398 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1857204031-1705504168-1630511281-1000_UserData.bin

+ 2009-07-14 04:46 . 2011-11-26 18:47 93320 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat

- 2011-11-26 10:24 . 2011-11-26 10:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2011-11-26 18:43 . 2011-11-26 18:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2011-11-26 18:43 . 2011-11-26 18:43 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2011-11-26 10:24 . 2011-11-26 10:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2009-07-14 04:45 . 2011-11-26 18:44 489760 c:\windows\system32\FNTCACHE.DAT

+ 2009-07-14 05:01 . 2011-11-26 18:42 433076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 04:45 . 2011-11-26 18:46 7191458 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat

- 2009-07-14 04:45 . 2011-11-23 18:36 7191458 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat

- 2011-04-18 22:17 . 2011-11-25 23:06 2711392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

+ 2011-04-18 22:17 . 2011-11-26 18:42 2711392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

+ 2011-06-08 13:47 . 2011-11-26 18:42 32205692 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1857204031-1705504168-1630511281-1000-8192.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

"ccleaner"="c:\program files\CCleaner\CCleaner64.exe" [2011-10-21 4499264]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-27 336384]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2011-10-24 2415456]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux3"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]

R2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2012\avgfws.exe [2011-10-24 2398512]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Updateservice (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-08 136176]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-08 136176]

R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x]

S1 ArcSec;ArcSec;c:\windows\system32\drivers\ArcSec.sys [2010-09-21 312184]

S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys [x]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x]

S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-03-11 2656280]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]

S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]

S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]

S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

iissvcs REG_MULTI_SZ w3svc was

apphost REG_MULTI_SZ apphostsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-11-26 c:\windows\Tasks\AutoKMS.job

- c:\windows\AutoKMS\AutoKMS.exe [2011-11-23 19:04]

.

2011-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-08 09:54]

.

2011-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-08 09:54]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-13 11774568]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-24 2726728]

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: &Verzenden naar OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Yolanda\AppData\Roaming\Mozilla\Firefox\Profiles\p8ibyy1w.default\

FF - prefs.js: browser.search.defaulturl - Google

FF - prefs.js: browser.search.selectedEngine - iLivid Web Search

FF - prefs.js: browser.startup.homepage - hxxp://www.zeelandnet.nl

FF - prefs.js: keyword.URL - hxxp://www.google.nl

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-10 - (no file)

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.alb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FotoManager10Deluxe.8.alb"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2011-11-26 22:30:53

ComboFix-quarantined-files.txt 2011-11-26 21:30

ComboFix2.txt 2011-11-26 18:53

ComboFix3.txt 2011-11-26 17:46

ComboFix4.txt 2011-11-24 13:55

ComboFix5.txt 2011-11-26 21:26

.

Pre-Run: 1.386.972.082.176 bytes beschikbaar

Post-Run: 1.386.684.411.904 bytes beschikbaar

.

- - End Of File - - F81181E01EBE446D0C505E0688D01180

27 november 2011 aangepast door kweezie wabbit

kweezie wabbit · 27 november 2011

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\windows\AutoKMS

File::

c:\windows\KMSEmulator.exe

c:\windows\system32\drivers\GRD.sys

c:\windows\system32\drivers\GDBehave.sys

c:\windows\system32\drivers\gdwfpcd64.sys

c:\windows\SysWow64\drivers\GRD.sys

c:\windows\SysWow64\GdScrSv.scr

c:\windows\Tasks\AutoKMS.job

Sla dit bestand op je bureaublad op als CFScript

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Doppie57 · 27 november 2011

Open een kladblokbestand.
Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\windows\AutoKMS

File::

c:\windows\KMSEmulator.exe

c:\windows\system32\drivers\GRD.sys

c:\windows\system32\drivers\GDBehave.sys

c:\windows\system32\drivers\gdwfpcd64.sys

c:\windows\SysWow64\drivers\GRD.sys

c:\windows\SysWow64\GdScrSv.scr

c:\windows\Tasks\AutoKMS.job

Sla dit bestand op je bureaublad op als CFScript

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

ComboFix 11-11-26.04 - Yolanda 27-11-2011 11:10:55.8.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.6120.4659 [GMT 1:00]

Gestart vanuit: c:\users\Yolanda\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Yolanda\Desktop\CFScript.txt

AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}

SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

FILE ::

"c:\windows\KMSEmulator.exe"

"c:\windows\system32\drivers\GDBehave.sys"

"c:\windows\system32\drivers\gdwfpcd64.sys"

"c:\windows\system32\drivers\GRD.sys"

"c:\windows\SysWow64\drivers\GRD.sys"

"c:\windows\SysWow64\GdScrSv.scr"

"c:\windows\Tasks\AutoKMS.job"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\AutoKMS

c:\windows\AutoKMS\AutoKMS.exe

c:\windows\AutoKMS\AutoKMS.ini

c:\windows\AutoKMS\AutoKMS.log

c:\windows\KMSEmulator.exe

c:\windows\system32\drivers\GDBehave.sys

c:\windows\system32\drivers\gdwfpcd64.sys

c:\windows\system32\drivers\GRD.sys

c:\windows\SysWow64\drivers\GRD.sys

c:\windows\SysWow64\GdScrSv.scr

c:\windows\Tasks\AutoKMS.job

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-10-27 to 2011-11-27 ))))))))))))))))))))))))))))))

.

2011-11-27 10:13 . 2011-11-27 10:13 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-23 18:12 . 2011-11-23 18:12 -------- d-----w- C:\$AVG

2011-11-23 17:07 . 2011-11-23 17:07 -------- d-----w- c:\users\Yolanda\AppData\Roaming\AVG2012

2011-11-23 17:07 . 2011-11-23 17:07 -------- d-----w- c:\windows\SysWow64\drivers\AVG

2011-11-23 17:06 . 2011-11-27 08:22 -------- d-----w- c:\windows\system32\drivers\AVG

2011-11-23 17:06 . 2011-11-23 17:51 -------- d-----w- c:\programdata\AVG2012

2011-11-23 17:05 . 2011-11-23 17:05 -------- d-----w- c:\program files (x86)\AVG

2011-11-23 17:03 . 2011-11-23 17:03 -------- d--h--w- c:\programdata\Common Files

2011-11-23 17:03 . 2011-11-27 08:22 -------- d-----w- c:\programdata\MFAData