[OPGELOST] SystemSecurity virus, veilige modus onbereikbaar

Marien-B · 20 juli 2009

Hallo,

Sinds een uurtje geleden heb ik ook dit virus op mn laptop. Ik heb al het een en ander rondgezocht op internet, ook op dit forum, en heb al verschillende aanpakken gelezen.

Het probleem is echter: Al deze manieren gaan via de veilige modus.. en die kom ik niet in..

Ik heb een MSI Wind laptop, en als ik hem aanzet, kan ik alleen op F3 klikken om de hele laptop te resetten oid.. daar wil ik nog niet aankomen, dus ik heb F8 geprobeerd, maar het enige resultaat is dat hij blijft hangen op het zwarte scherm, voor het windows scherm, waar F3 staat.. Als ik F8 loslaat dan start windows op..

Eenmaal in windows sluit Systemsecurity alles af, kan niks opstarten, dus ook 'uitvoeren' en boot.ini aanpassen gaat niet.

Ook als ik boot.ini op mn schijf gevonden heb, kan ik hem niet openen, omdat kladblok niet werkt.

Ik hoop dat iemand me hier kan helpen.. :s

kape · 20 juli 2009

Probeer eens of je de - in de andere topics aangeboden - tooltjes (HiJackThis, Malwarebytes, Combofix) via een andere PC kan downloaden op een USB-stick ... en dan via deze stick de programma's starten op de besmette PC ?

Marien-B · 20 juli 2009

Ah chill, ik kom via F11 in een menutje. Zit nu in veilige modus en heb die 3 progjes op n stick erbij. Ik ga er ff mee aan de gang

---------- Post toegevoegd om 20:01 ---------- Vorige post was om 19:56 ----------

Dit is mn Hijack-logje:

Scan saved at 21:57:48, on 20-7-2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msi.com.tw

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msi.com.tw

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe

O4 - HKLM\..\Run: [iTSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

O4 - HKLM\..\Run: [12457184] C:\Documents and Settings\All Users\Application Data\12457184\12457184.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Bluetooth Manager.lnk = ?

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.msi.com.tw

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{443BF7F4-DBCB-486F-A486-91E162D5D912}: NameServer = 62.177.144.11,82.204.127.40

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Micro Star SCM - Unknown owner - C:\Program Files\System Control Manager\MSIService.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--

End of file - 5075 bytes

Kun jij zien of er foute dingen instaan Kape??

Alvast bedankt!

kape · 20 juli 2009

Kun jij zien of er foute dingen instaan Kape??
Alvast bedankt!

Zeker en vast foute boel in log :s

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [12457184] C:\Documents and Settings\All Users\Application Data\12457184\12457184.exe

Klik op 'Fix checked' om de items te verwijderen.

Probeer dan als volgende eerst Malwarebytes !

Marien-B · 20 juli 2009

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Dat is net zoiets als de RTHDCPL die erboven staat..

Agics - Wat is ALCMTR.EXE (Realtek Event Monitor) en wat doet het ?

Toch wel verwijderen??

Marien-B · 20 juli 2009

Heb de Hijackdingen verwijderd met, toen kon ik gelukkig weer normaal opstarten, daarna Malware eroverheen gedraait en een stuk of 10 'fake trojans' oid verwijderd.

Toen Combofix geinstalleerd, Nod32 uitgezet en toen kreeg ik een melding van 'rootkit activiteit'. Ik heb wat dingen op moeten schrijven (.dll en .dat in system32), hij moest opnieuw opstarten en dit is de uitkomst van het combofix:

omboFix 09-07-20.01 - Marien 20-07-2009 23:05.1.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1013.731 [GMT 2:00]

Gestart vanuit: I:\ComboFix.exe

AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Aanwezig AV is actief

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\ALLUSE~1\APPLIC~1\12457184

c:\docume~1\ALLUSE~1\APPLIC~1\12457184\12457184

c:\docume~1\ALLUSE~1\APPLIC~1\12457184\12457184.exe

c:\docume~1\ALLUSE~1\APPLIC~1\Microsoft\Network\Downloader\qmgr0.dat

c:\docume~1\ALLUSE~1\APPLIC~1\Microsoft\Network\Downloader\qmgr1.dat

c:\windows\Installer\2440e.msp

c:\windows\Installer\3017d1.msi

c:\windows\system32\drivers\geyekrrgrxdorg.sys

c:\windows\system32\geyekriltbbrox.dll

c:\windows\system32\geyekrjxcevrwo.dat

c:\windows\system32\geyekrrsqtqwuh.dll

c:\windows\system32\geyekrsvpxuwqi.dat

----- BITS: Mogelijk geïnfecteerde sites -----

hxxp://binuser.fileave.com

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_geyekrtfubqakl

(((((((((((((((((((( Bestanden Gemaakt van 2009-06-20 to 2009-07-20 ))))))))))))))))))))))))))))))

.

2009-07-20 20:49 . 2009-07-20 20:49 -------- d-sh--w- c:\documents and settings\Marien\Onlangs geopend

2009-07-20 20:26 . 2009-07-20 20:26 -------- d-----w- c:\documents and settings\Marien\Application Data\Malwarebytes

2009-07-20 20:12 . 2009-07-20 20:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-07-20 20:11 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-20 20:11 . 2009-07-20 20:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-07-20 20:11 . 2009-07-20 20:11 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes

2009-07-20 20:11 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-07-20 19:57 . 2009-07-20 19:57 -------- d-----w- c:\program files\Trend Micro

2009-07-20 18:12 . 2009-07-20 18:13 8192 ----a-w- C:\qlhbde.exe

2009-07-20 18:10 . 2009-07-20 18:10 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET

2009-07-20 17:35 . 2009-07-20 17:35 -------- d-----w- c:\program files\Elaborate Bytes

2009-07-20 17:30 . 2009-07-20 17:30 -------- d-----w- c:\documents and settings\Marien\Application Data\ArcSoft

2009-07-20 17:12 . 2009-07-20 17:46 -------- d-----w- c:\windows\ehome

2009-07-20 17:09 . 2009-07-20 17:09 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\ArcSoft

2009-07-20 17:09 . 2009-07-20 17:45 -------- d-----w- c:\program files\ArcSoft

2009-07-20 17:08 . 2009-07-20 17:08 -------- d-----w- c:\windows\Downloaded Installations

2009-07-20 16:47 . 2009-07-20 16:47 -------- d-----w- c:\documents and settings\Marien\Local Settings\Application Data\Cyberlink

2009-07-20 16:45 . 2009-07-20 16:45 -------- d-----w- c:\program files\Common Files\CyberLink

2009-07-20 16:42 . 2009-07-20 16:41 29480 ----a-w- c:\windows\system32\msxml3a.dll

2009-07-20 16:42 . 2009-07-20 16:41 353576 ----a-w- c:\windows\system32\msvcr71.dll

2009-07-20 16:41 . 2009-07-20 16:41 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Temp

2009-07-20 16:26 . 2009-07-20 16:26 -------- d-----w- c:\documents and settings\Marien\Application Data\dvdcss

2009-07-06 12:54 . 2008-03-21 11:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll

2009-07-06 10:37 . 2009-07-06 10:36 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys

2009-07-06 10:37 . 2009-07-06 10:36 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys

2009-07-06 10:37 . 2009-07-06 10:36 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll

2009-07-06 10:33 . 2009-07-06 10:33 -------- d-----w- c:\program files\Sony Ericsson

2009-06-22 20:44 . 2009-06-23 15:49 -------- d-----w- c:\documents and settings\Marien\Local Settings\Application Data\ApplicationHistory

2009-06-22 20:44 . 2009-06-22 20:44 129 ----a-w- c:\documents and settings\Marien\Local Settings\Application Data\fusioncache.dat

2009-06-22 20:38 . 2009-06-22 20:38 -------- d-----w- c:\program files\Common Files\SpellEx

2009-06-22 20:38 . 2004-02-04 08:27 49536 ----a-w- c:\windows\system32\drivers\tiehdusb.sys

2009-06-22 20:38 . 2004-01-28 13:03 21456 ----a-w- c:\windows\system32\drivers\SilvrLnk.sys

2009-06-22 20:37 . 2009-06-22 20:37 -------- d-----w- c:\program files\Common Files\TI Shared

2009-06-22 20:37 . 2009-06-22 20:38 -------- d-----w- c:\program files\TI Education

2009-06-22 20:34 . 2009-06-22 20:34 -------- d-----w- c:\windows\system32\URTTEMP

2009-06-22 20:30 . 2009-06-22 20:36 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-20 18:11 . 2008-08-26 11:01 -------- d-----w- c:\program files\Common Files\InstallShield

2009-07-20 17:45 . 2008-08-26 11:01 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-07-20 16:47 . 2008-10-24 20:21 -------- d-----w- c:\documents and settings\Marien\Application Data\CyberLink

2009-07-20 16:47 . 2008-10-24 19:25 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\CyberLink

2009-07-20 16:41 . 2007-12-12 14:41 505128 ----a-w- c:\windows\system32\msvcp71.dll

2009-07-20 15:01 . 2008-10-20 18:45 -------- d-----w- c:\documents and settings\Marien\Application Data\GrabIt

2009-07-06 12:54 . 2009-07-06 12:54 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf

2009-07-06 12:54 . 2009-07-06 12:54 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf

2009-06-23 09:11 . 2008-08-26 15:25 82680 ----a-w- c:\windows\system32\perfc013.dat

2009-06-23 09:11 . 2008-08-26 15:25 468780 ----a-w- c:\windows\system32\perfh013.dat

2009-06-22 20:41 . 2008-10-20 15:39 71912 ----a-w- c:\documents and settings\Marien\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-06-17 17:20 . 2009-06-16 21:43 -------- d-----w- c:\program files\Pinnacle

2009-06-16 21:40 . 2009-06-16 21:40 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Pinnacle

2009-06-16 14:40 . 2008-08-26 15:25 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-16 14:40 . 2008-08-26 15:25 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-03 21:02 . 2009-02-20 16:10 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\pdf995

2009-06-03 21:02 . 2009-02-20 16:10 59 ----a-w- c:\windows\wpd99.drv

2009-06-03 19:11 . 2008-08-26 15:25 1295360 ----a-w- c:\windows\system32\quartz.dll

2009-06-03 17:08 . 2009-06-03 17:07 -------- d-----w- c:\program files\iTunes

2009-06-03 17:08 . 2009-06-03 17:07 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

2009-06-03 17:07 . 2009-06-03 17:07 -------- d-----w- c:\program files\iPod

2009-06-03 17:07 . 2008-10-20 18:52 -------- d-----w- c:\program files\Common Files\Apple

2009-06-03 17:03 . 2009-06-03 17:02 -------- d-----w- c:\program files\QuickTime

2009-06-01 11:42 . 2009-06-01 11:42 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Advanced Chemistry Development

2009-06-01 11:42 . 2009-06-01 11:40 -------- d-----w- c:\documents and settings\Marien\Application Data\Advanced Chemistry Development

2009-06-01 11:42 . 2009-06-01 11:41 -------- d-----w- c:\program files\ACDFREE12

2009-05-25 12:16 . 2009-05-25 12:16 134312 ----a-w- c:\windows\system32\ElbyVCD.dll

2009-05-25 12:01 . 2009-05-25 12:01 89256 ----a-w- c:\windows\system32\ElbyCDIO.dll

2009-05-22 23:08 . 2009-05-22 23:08 29696 ----a-w- c:\windows\system32\drivers\VClone.sys

2009-05-22 18:32 . 2009-03-20 18:12 73728 ----a-w- c:\windows\system32\MMCEDT3.exe

2009-05-22 13:49 . 2009-02-19 12:22 91392 ----a-w- c:\windows\system32\drivers\ArcHlp.sys

2009-05-15 18:19 . 2008-10-21 14:47 721904 ----a-w- c:\windows\system32\drivers\sptd.sys

2009-05-07 15:34 . 2008-08-26 15:25 347136 ----a-w- c:\windows\system32\localspl.dll

2009-04-29 04:46 . 2008-08-26 15:25 669696 ----a-w- c:\windows\system32\wininet.dll

2009-04-29 04:46 . 2008-08-26 15:25 81920 ----a-w- c:\windows\system32\ieencode.dll

2009-06-14 21:22 . 2008-10-20 16:36 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll

.

------- Sigcheck -------

[-] 2008-04-15 12:00 979456 0667A612D847BD87667F3CB1FC4C0D6C c:\windows\explorer.exe

[-] 2008-04-15 12:00 979456 0667A612D847BD87667F3CB1FC4C0D6C c:\windows\system32\dllcache\explorer.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]

"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2008-07-29 684032]

"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 1443072]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]

"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-08 16862208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\documents and settings\Marien\Menu Start\Programma's\Opstarten\

RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]

c:\docume~1\ALLUSE~1\MENUST~1\PROGRA~1\OPSTAR~1\

Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-2-22 2938184]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R1 archlp;archlp;c:\windows\system32\drivers\ArcHlp.sys [19-2-2009 14:22 91392]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [13-3-2008 17:52 33800]

R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [13-3-2008 17:49 472320]

R2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [26-8-2008 13:13 159744]

R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [26-8-2008 13:07 156160]

R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [20-10-2008 23:29 625792]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [6-7-2009 12:37 13224]

S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [22-10-2008 15:49 13225]

S3 rtl8187Se;Realtek RTL8187SE Wireless LAN PCIE Network Adapter;c:\windows\system32\drivers\rtl8187Se.sys [26-8-2008 13:09 306176]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.msi.com.tw

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {443BF7F4-DBCB-486F-A486-91E162D5D912} = 62.177.144.11,82.204.127.40

FF - ProfilePath - c:\docume~1\Marien\APPLIC~1\Mozilla\Firefox\Profiles\qibidabu.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.symbaloo.com/

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-07-20 23:10

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"