Spanningen te hoog? of iets anders?

kweezie wabbit · 2 januari 2012

Dit is inderdaad mooi opgeruimd.

Nu gaan we verder met de volgende stap om zeker te zijn dat alle malware verwijderd is.

Download ComboFix van één van deze locaties:

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:
Klik hier
Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.
Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.
**Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.
Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Indien je problemen hebt bij het uitvoeren van ComboFix, gelieve dit te melden.

TonyKe1988 · 2 januari 2012

ComboFix 12-01-02.01 - Tony 02/01/2012 13:27:16.1.4 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.32.1033.18.3647.2528 [GMT 1:00]

Gestart vanuit: c:\users\Tony\Desktop\ComboFix.exe

AV: avast! Internet Security *Disabled/Outdated* {C37D8F93-0602-E43C-40AA-47DAD597F308}

FW: avast! Internet Security *Disabled* {FB460EB6-4C6D-E564-6BF5-EEEF2B44B473}

SP: avast! Internet Security *Disabled/Outdated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\CFLog

c:\cflog\CrashLog_20110508.txt

c:\cflog\CrashLog_20110514.txt

c:\cflog\CrashLog_20110709.txt

c:\users\Tony\AppData\Roaming\chrtmp

c:\users\Tony\AppData\Roaming\tSsLxTdZQY.txt

c:\windows\iun6002.exe

c:\windows\pkunzip.pif

c:\windows\pkzip.pif

c:\windows\RazorDOX

c:\windows\RazorDOX\RazorDOX.dll

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\system32\tmp689E.tmp

c:\windows\system32\tmp68AE.tmp

c:\windows\system32\User

c:\windows\system32\User\ShaderCache\dx9-GM4E01-ps.cache

c:\windows\system32\User\ShaderCache\dx9-GM4E01-vs.cache

c:\windows\system32\User\Wii\shared2\sys\SYSCONF

c:\windows\system32\User\Wii\sys\uid.sys

J:\install.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-02 to 2012-01-02 ))))))))))))))))))))))))))))))

.

2012-01-02 11:32 . 2012-01-02 11:32 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{58591AD2-5579-41BB-AFAC-5F72D26853FA}\offreg.dll

2012-01-01 00:56 . 2012-01-01 00:56 388096 ----a-r- c:\users\Tony\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-12-31 23:00 . 2011-12-31 23:00 -------- d-----w- c:\program files\Temp

2011-12-31 13:34 . 2011-12-31 13:45 -------- d-----w- c:\users\Tony\AppData\Roaming\Origin

2011-12-31 13:33 . 2011-12-31 13:33 -------- d-----w- c:\users\Tony\AppData\Local\Origin

2011-12-31 13:33 . 2011-12-31 13:50 -------- d-----w- c:\program files\Origin Games

2011-12-31 13:33 . 2011-12-31 13:45 -------- d-----w- c:\programdata\Origin

2011-12-31 12:39 . 2011-07-07 23:21 26216 ----a-w- c:\windows\system32\nvhdap32.dll

2011-12-31 12:39 . 2011-07-07 23:21 139880 ----a-w- c:\windows\system32\drivers\nvhda32v.sys

2011-12-31 12:39 . 2011-07-07 23:21 876136 ----a-w- c:\windows\system32\nvhdagenco3220102.dll

2011-12-30 14:21 . 2011-12-30 14:21 -------- d-----w- c:\program files\ASUS

2011-12-30 14:21 . 2011-12-30 14:21 -------- d-----w- c:\windows\B9DB4C7601A446D58910F7AA6376DBAF.TMP

2011-12-30 14:20 . 2011-03-03 15:59 837224 ----a-w- c:\windows\system32\nvhdagenco322040.dll

2011-12-30 14:08 . 2011-03-21 00:31 944232 ----a-w- c:\windows\system32\nvdispco3220140.dll

2011-12-30 14:08 . 2011-03-21 00:31 855656 ----a-w- c:\windows\system32\nvgenco322060.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-01 12:45 . 2011-03-22 18:45 139128 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2012-01-01 12:44 . 2011-03-22 18:44 215128 ----a-w- c:\windows\system32\PnkBstrB.xtr

2012-01-01 12:44 . 2011-03-22 18:44 215128 ----a-w- c:\windows\system32\PnkBstrB.ex0

2012-01-01 12:44 . 2011-03-22 18:44 215128 ----a-w- c:\windows\system32\PnkBstrB.exe

2011-12-10 14:24 . 2011-08-07 21:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-20 22:53 . 2011-04-07 18:49 138056 ----a-w- c:\users\Tony\AppData\Roaming\PnkBstrK.sys

2011-11-20 22:53 . 2011-03-22 18:43 75136 ----a-w- c:\windows\system32\PnkBstrA.exe

2011-11-18 17:54 . 2011-03-27 11:21 3140 --sha-w- c:\programdata\KGyGaAvL.sys

2011-11-18 16:31 . 2011-05-19 15:27 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-11 15:39 . 2011-11-11 15:39 86528 ----a-w- c:\windows\system32\iesysprep.dll

2011-11-11 15:39 . 2011-11-11 15:39 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-11-11 15:39 . 2011-11-11 15:39 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2011-11-11 15:39 . 2011-11-11 15:39 74752 ----a-w- c:\windows\system32\iesetup.dll

2011-11-11 15:39 . 2011-11-11 15:39 63488 ----a-w- c:\windows\system32\tdc.ocx

2011-11-11 15:39 . 2011-11-11 15:39 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-11-11 15:39 . 2011-11-11 15:39 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-11-11 15:39 . 2011-11-11 15:39 367104 ----a-w- c:\windows\system32\html.iec

2011-11-11 15:39 . 2011-11-11 15:39 35840 ----a-w- c:\windows\system32\imgutil.dll

2011-11-11 15:39 . 2011-11-11 15:39 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-11-11 15:39 . 2011-11-11 15:39 23552 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-11 15:39 . 2011-11-11 15:39 1798144 ----a-w- c:\windows\system32\jscript9.dll

2011-11-11 15:39 . 2011-11-11 15:39 161792 ----a-w- c:\windows\system32\msls31.dll

2011-11-11 15:39 . 2011-11-11 15:39 152064 ----a-w- c:\windows\system32\wextract.exe

2011-11-11 15:39 . 2011-11-11 15:39 150528 ----a-w- c:\windows\system32\iexpress.exe

2011-11-11 15:39 . 2011-11-11 15:39 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2011-11-11 15:39 . 2011-11-11 15:39 1427456 ----a-w- c:\windows\system32\inetcpl.cpl

2011-11-11 15:39 . 2011-11-11 15:39 11776 ----a-w- c:\windows\system32\mshta.exe

2011-11-11 15:39 . 2011-11-11 15:39 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-11-11 15:39 . 2011-11-11 15:39 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2011-11-11 15:39 . 2011-11-11 15:39 101888 ----a-w- c:\windows\system32\admparse.dll

2011-10-15 08:53 . 2011-10-09 11:21 919872 ----a-w- c:\windows\system32\nvdispco32.dll

2011-10-15 08:53 . 2011-10-09 11:21 877376 ----a-w- c:\windows\system32\nvgenco32.dll

2011-10-15 08:53 . 2010-07-09 15:37 123712 ----a-w- c:\windows\system32\nvshext.dll

2011-10-14 23:54 . 2011-10-14 23:54 321856 ----a-w- c:\windows\system32\nvStreaming.exe

2011-10-11 23:17 . 2011-08-15 13:31 445016 ----a-w- c:\windows\system32\wrap_oal.dll

2011-10-11 23:17 . 2011-08-15 13:31 109144 ----a-w- c:\windows\system32\OpenAL32.dll

2011-10-07 03:48 . 2011-11-18 16:32 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{58591AD2-5579-41BB-AFAC-5F72D26853FA}\mpengine.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-01-29 20:26 120712 ----a-w- f:\avast software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISPMonitor"="f:\isp monitor\isp.exe" [2010-07-18 418304]

"DAEMON Tools Lite"="f:\daemon tools lite\DTLite.exe" [2011-01-20 1305408]

"Messenger (Yahoo!)"="f:\yahoo!\MESSEN~1\YahooMessenger.exe" [2011-08-22 6276408]

"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-10-17 3077528]

"Akamai NetSession Interface"="c:\users\Tony\AppData\Local\Akamai\netsession_win.exe" [2011-11-17 3303000]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast"="f:\avast software\Avast\avastUI.exe" [2011-01-29 3427024]

"RemoteControl10"="f:\cyberlink\PowerDVD10\PowerDVD10\PDVD10Serv.exe" [2010-02-02 87336]

"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2011-03-01 75048]

"Cmiboot"="c:\windows\cmiboot.exe" [2007-02-12 65536]

"Adobe Reader Speed Launcher"="f:\adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]

"Malwarebytes' Anti-Malware"="f:\malwarebytes' anti-malware\mbamgui.exe" [2011-12-24 460872]

"B2C_AGENT"="c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2011-09-28 404568]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

GamersFirst LIVE!.lnk - c:\program files\GamersFirst\LIVE!\Live.exe [2011-8-15 2589808]

SMCWPCI-G 54Mbps Wireless PCI adapter.lnk - c:\program files\SMC\SMCWPCI-G 54Mbps Wireless PCI adapter\Monitor.exe [2005-6-7 430080]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 avast! Firewall;avast! Firewall;f:\avast software\Avast\afwServ.exe [2011-01-29 119200]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;i:\seppe\New Folder\hamachi-2.exe [x]

R3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;f:\bitcomet\tools\BitCometService.exe [2010-12-28 1296728]

R3 CMISTOR;CMIUCR.SYS CM320/CM220 Card Reader Driver;c:\windows\system32\DRIVERS\cmiucr.SYS [2007-09-10 95616]

R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]

R3 FlashUSB;FlashUSB;c:\windows\system32\DRIVERS\FlashUSB.sys [2010-05-12 16896]

R3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNt.sys [2009-10-13 133632]

R3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [2009-07-13 79360]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2011-05-03 4092408]

R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 507136]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-05-16 111280]

R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]

R3 VBoxUSB;VirtualBox USB;c:\windows\system32\Drivers\VBoxUSB.sys [2011-05-16 33072]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 XDva385;XDva385;c:\windows\system32\XDva385.sys [x]

R3 XDva386;XDva386;c:\windows\system32\XDva386.sys [x]

R3 XDva387;XDva387;c:\windows\system32\XDva387.sys [x]

R3 XDva389;XDva389;c:\windows\system32\XDva389.sys [x]

R3 XDva390;XDva390;c:\windows\system32\XDva390.sys [x]

R3 XDva391;XDva391;c:\windows\system32\XDva391.sys [x]

S0 aswNdis2;avast! Firewall Core Firewall Service; [x]

S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S1 aswFW;avast! TDI Firewall driver; [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-05-14 218688]

S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2011/03/21 19:31];f:\cyberlink\PowerDVD10\PowerDVD10\NavFilter\000.fcl [2011-03-01 09:57 87536]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-01-29 51280]

S2 ISPMonitorSrv;ISP Monitor;f:\isp monitor\ISPMonitorSrv.exe [2008-06-09 36864]

S2 MBAMService;MBAMService;f:\malwarebytes' anti-malware\mbamservice.exe [2011-12-24 652872]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-03-21 2218600]

S2 OS Selector;Acronis OS Selector activator;f:\acronis\OSS\reinstall_svc.exe [2010-05-25 2139400]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]

S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys [2009-09-29 12160]

S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [2009-09-29 10496]

S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys [2009-09-29 12928]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2011-07-07 139880]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]

S3 SMCWPCIG;SMCWPCI-G 54Mbps Wireless PCI adapter Service;c:\windows\system32\DRIVERS\SMCWPCIG.sys [2005-04-21 458208]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

------- Bijkomende Scan -------

.

IE: &D&ownload &with BitComet - f:\bitcomet\BitComet.exe/AddLink.htm

IE: &D&ownload all with BitComet - f:\bitcomet\BitComet.exe/AddAllLink.htm

IE: Free YouTube to Mp3 Converter - c:\users\Tony\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\a2xns76l.default\

FF - prefs.js: browser.startup.homepage - about:home

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

- - - - ORPHANS VERWIJDERD - - - -

.

WebBrowser-{6D8D66F3-14FC-4736-A096-FAC0EA66289C} - (no file)

AddRemove-ISPMonitor - c:\windows\iun6002.exe

AddRemove-Project Blackout - e:\project blackout\uninst.exe

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_d768ebc.dll"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]

"ImagePath"="\??\f:\cyberlink\PowerDVD10\PowerDVD10\NavFilter\000.fcl"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-741460715-508906756-2143620539-1000\Software\SecuROM\License information*]

"datasecu"=hex:c6,04,21,6e,23,37,51,f3,70,f9,ad,38,90,e8,f1,ed,e9,c4,e0,45,9d,

0d,ae,eb,2f,b4,19,42,47,d3,bb,7a,f3,2b,eb,4f,00,16,28,a2,15,be,cb,6c,6b,ef,\

"rkeysecu"=hex:a6,e2,e0,05,ad,1e,7c,81,86,ea,59,66,9f,88,01,2a

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2012-01-02 13:35:08

ComboFix-quarantined-files.txt 2012-01-02 12:35

.

Pre-Run: 86.255.575.040 bytes free

Post-Run: 86.658.211.840 bytes free

.

- - End Of File - - 573D2A972E5EFA2489848D86B61C1D23

zo

kape · 2 januari 2012

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\B9DB4C7601A446D58910F7AA6376DBAF.TMP

c:\windows\system32\XDva385.sys

c:\windows\system32\XDva386.sys

c:\windows\system32\XDva387.sys

c:\windows\system32\XDva389.sys

c:\windows\system32\XDva390.sys

c:\windows\system32\XDva391.sys

Driver::

XDva385

XDva386

XDva387

XDva389

XDva390

XDva391

Sla dit bestand op je bureaublad op als CFScript.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

TonyKe1988 · 2 januari 2012

ComboFix 12-01-02.01 - Tony 02/01/2012 14:11:34.3.4 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.32.1033.18.3647.2546 [GMT 1:00]

Gestart vanuit: c:\users\Tony\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Tony\Desktop\CFScript.txt

AV: avast! Internet Security *Disabled/Outdated* {C37D8F93-0602-E43C-40AA-47DAD597F308}

FW: avast! Internet Security *Disabled* {FB460EB6-4C6D-E564-6BF5-EEEF2B44B473}

SP: avast! Internet Security *Disabled/Outdated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\B9DB4C7601A446D58910F7AA6376DBAF.TMP"

"c:\windows\system32\XDva385.sys"

"c:\windows\system32\XDva386.sys"

"c:\windows\system32\XDva387.sys"

"c:\windows\system32\XDva389.sys"

"c:\windows\system32\XDva390.sys"

"c:\windows\system32\XDva391.sys"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_XDVA385

-------\Legacy_XDVA386

-------\Legacy_XDVA387

-------\Legacy_XDVA389

-------\Legacy_XDVA390

-------\Legacy_XDVA391

-------\Service_XDva385

-------\Service_XDva386

-------\Service_XDva387

-------\Service_XDva389

-------\Service_XDva390

-------\Service_XDva391

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-02 to 2012-01-02 ))))))))))))))))))))))))))))))

.

2012-01-02 13:16 . 2012-01-02 13:16 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp