Internet loopt vast

karla.otten · 30 juli 2009

Het is gelukt, zie hieronder het logbestand van ComboFix;

ComboFix 09-07-29.03 - Eigenaar 30-07-2009 7:26.1.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.503.182 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Eigenaar\Mijn documenten\ComboFix.exe

AV: avast! antivirus 4.8.1335 [VPS 090729-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\Eigenaar\LOCALS~1\Temp\MFPL7014.DLL

c:\documents and settings\Eigenaar\Application Data\Microsoft\Internet Explorer\Quick Launch\avast! Antivirus.lnk

c:\documents and settings\Eigenaar\Local Settings\Temp\MFPL7014.DLL

c:\recycler\S-1-5-21-1488991735-2158848229-675259344-1003

c:\recycler\S-1-5-21-1989122380-656365767-1577453425-1003

c:\recycler\S-1-5-21-3020320528-3280028224-4517257-1003

c:\windows\Installer\104fc2e.msi

c:\windows\Installer\109fef.msi

c:\windows\Installer\11732fc.msi

c:\windows\Installer\11ad43a.msp

c:\windows\Installer\11ad44a.msp

c:\windows\Installer\12454c.msp

c:\windows\Installer\12455c.msp

c:\windows\Installer\12456c.msp

c:\windows\Installer\1278236.msp

c:\windows\Installer\12828c.msi

c:\windows\Installer\12ec81a.msi

c:\windows\Installer\1396a4.msp

c:\windows\Installer\1396b4.msp

c:\windows\Installer\1396c4.msp

c:\windows\Installer\13c68d0.msi

c:\windows\Installer\13fab9.msp

c:\windows\Installer\13fc15.msp

c:\windows\Installer\13fc25.msp

c:\windows\Installer\140ee0.msp

c:\windows\Installer\1425b94.msi

c:\windows\Installer\150875c.msp

c:\windows\Installer\1541bae.msi

c:\windows\Installer\15f4e1c.msp

c:\windows\Installer\1601f9.msi

c:\windows\Installer\1639f7.msi

c:\windows\Installer\1771024.msi

c:\windows\Installer\17909.msi

c:\windows\Installer\17bbfd0.msi

c:\windows\Installer\18b6d.msi

c:\windows\Installer\18b73.msi

c:\windows\Installer\18b7b.msi

c:\windows\Installer\18b89.msi

c:\windows\Installer\18b92.msi

c:\windows\Installer\18b9b.msi

c:\windows\Installer\18ba1.msi

c:\windows\Installer\18baa.msi

c:\windows\Installer\18bb3.msi

c:\windows\Installer\18bbc.msi

c:\windows\Installer\18bc5.msi

c:\windows\Installer\18d0f5.msp

c:\windows\Installer\18d105.msp

c:\windows\Installer\18e066.msp

c:\windows\Installer\18e3d4.msp

c:\windows\Installer\194839.msp

c:\windows\Installer\19f5f37.msi

c:\windows\Installer\1a10f8a.msi

c:\windows\Installer\1aa81b9.msp

c:\windows\Installer\1aa81dd.msp

c:\windows\Installer\1b3b416.msp

c:\windows\Installer\1bb81.msi

c:\windows\Installer\1bba1.msi

c:\windows\Installer\1cc9896.msp

c:\windows\Installer\1cdb5.msi

c:\windows\Installer\1d7a7.msi

c:\windows\Installer\1ebcbc.msi

c:\windows\Installer\1ebcdb.msi

c:\windows\Installer\1ecf7d8.msi

c:\windows\Installer\1f3605.msi

c:\windows\Installer\1fbd83.msi

c:\windows\Installer\21cf72c.msp

c:\windows\Installer\21cf73c.msp

c:\windows\Installer\22f2b4.msi

c:\windows\Installer\22f2be.msi

c:\windows\Installer\22f2c8.msi

c:\windows\Installer\23a28.msi

c:\windows\Installer\23a82.msi

c:\windows\Installer\23a96.msi

c:\windows\Installer\23fc130.msi

c:\windows\Installer\2547104.msi

c:\windows\Installer\25f1f0b.msi

c:\windows\Installer\2811455.msi

c:\windows\Installer\28e81.msp

c:\windows\Installer\2966584.msp

c:\windows\Installer\2966594.msp

c:\windows\Installer\2966595.msp

c:\windows\Installer\296659e.msp

c:\windows\Installer\2ba1fa.msp

c:\windows\Installer\2c557.msi

c:\windows\Installer\2c560.msi

c:\windows\Installer\2c569.msi

c:\windows\Installer\2c56f.msi

c:\windows\Installer\2c578.msi

c:\windows\Installer\2c582.msi

c:\windows\Installer\2cc0c.msp

c:\windows\Installer\2d5f12.msi

c:\windows\Installer\2fafc8.msi

c:\windows\Installer\31e570.msp

c:\windows\Installer\32668.msp

c:\windows\Installer\32677.msp

c:\windows\Installer\32687.msp

c:\windows\Installer\33f5577.msp

c:\windows\Installer\33f5587.msp

c:\windows\Installer\3599550.msp

c:\windows\Installer\35c6820.msi

c:\windows\Installer\371f83.msi

c:\windows\Installer\371f90.msi

c:\windows\Installer\371f9d.msi

c:\windows\Installer\371fed.msi

c:\windows\Installer\3cb017.msi

c:\windows\Installer\3e54027.msi

c:\windows\Installer\3e932b.msi

c:\windows\Installer\3e9386.msi

c:\windows\Installer\3e93e5.msi

c:\windows\Installer\45f11.msp

c:\windows\Installer\45f21.msp

c:\windows\Installer\49b25.msi

c:\windows\Installer\49b2c.msi

c:\windows\Installer\49bab.msp

c:\windows\Installer\4a9494.msi

c:\windows\Installer\4a949d.msi

c:\windows\Installer\4a94a6.msi

c:\windows\Installer\4a94ac.msi

c:\windows\Installer\4a94b5.msi

c:\windows\Installer\4a94bf.msi

c:\windows\Installer\4a94c9.msi

c:\windows\Installer\4a94d2.msi

c:\windows\Installer\4eaaa.msi

c:\windows\Installer\4ef603.msi

c:\windows\Installer\4f26a9.msi

c:\windows\Installer\511e0.msi

c:\windows\Installer\51200.msi

c:\windows\Installer\5270e6.msp

c:\windows\Installer\52711c.msp

c:\windows\Installer\53d340.msp

c:\windows\Installer\55da04.msp

c:\windows\Installer\55da14.msp

c:\windows\Installer\59420.msp

c:\windows\Installer\5a44de.msp

c:\windows\Installer\63bfb.msi

c:\windows\Installer\642af.msi

c:\windows\Installer\649c9a8.msp

c:\windows\Installer\664a57.msi

c:\windows\Installer\664a5c.msi

c:\windows\Installer\69d98d.msi

c:\windows\Installer\69d993.msi

c:\windows\Installer\69d999.msi

c:\windows\Installer\69d99f.msi

c:\windows\Installer\69d9a5.msi

c:\windows\Installer\69d9ab.msi

c:\windows\Installer\69d9b1.msi

c:\windows\Installer\69d9b7.msi

c:\windows\Installer\69d9bd.msi

c:\windows\Installer\69d9c4.msi

c:\windows\Installer\69d9ca.msi

c:\windows\Installer\69d9d0.msi

c:\windows\Installer\69d9d6.msi

c:\windows\Installer\69d9dd.msi

c:\windows\Installer\69d9e4.msi

c:\windows\Installer\69d9fe.msi

c:\windows\Installer\69da04.msi

c:\windows\Installer\69e6e.msp

c:\windows\Installer\69edd.msp

c:\windows\Installer\6d9b6.msp

c:\windows\Installer\6eb9f.msi

c:\windows\Installer\716b5.msp

c:\windows\Installer\71707.msp

c:\windows\Installer\76c22e.msi

c:\windows\Installer\7a4e9.msi

c:\windows\Installer\7a4f0.msi

c:\windows\Installer\856e6.msi

c:\windows\Installer\8cca69.msi

c:\windows\Installer\93cd3.msi

c:\windows\Installer\94484.msi

c:\windows\Installer\945590.msp

c:\windows\Installer\9455a0.msp

c:\windows\Installer\95173.msi

c:\windows\Installer\999a3.msp

c:\windows\Installer\999b2.msp

c:\windows\Installer\999c3.msp

c:\windows\Installer\999cd.msp

c:\windows\Installer\999ee.msp

c:\windows\Installer\999ef.msp

c:\windows\Installer\999f0.msp

c:\windows\Installer\999f1.msp

c:\windows\Installer\99a03.msp

c:\windows\Installer\99a14.msp

c:\windows\Installer\99a24.msp

c:\windows\Installer\99a34.msp

c:\windows\Installer\99a45.msp

c:\windows\Installer\99a54.msp

c:\windows\Installer\9cb787.msp

c:\windows\Installer\9cb790.msp

c:\windows\Installer\a6c7ec.msi

c:\windows\Installer\ac18a.msi

c:\windows\Installer\aef6c2.msp

c:\windows\Installer\ba4b18.msp

c:\windows\Installer\ba4b27.msp

c:\windows\Installer\ba4b49.msp

c:\windows\Installer\ba4b4a.msp

c:\windows\Installer\ba4b4b.msp

c:\windows\Installer\ba4b4c.msp

c:\windows\Installer\ba4b5f.msp

c:\windows\Installer\ba4b70.msp

c:\windows\Installer\ba4b80.msp

c:\windows\Installer\ba4b95.msp

c:\windows\Installer\bcad2a.msi

c:\windows\Installer\bf006d.msi

c:\windows\Installer\bfebf3.msp

c:\windows\Installer\bfec04.msp

c:\windows\Installer\bfec14.msp

c:\windows\Installer\c3a95.msp

c:\windows\Installer\c3aa8.msp

c:\windows\Installer\c3ab8.msp

c:\windows\Installer\cbdad.msi

c:\windows\Installer\cf8746.msp

c:\windows\Installer\d19ff.msp

c:\windows\Installer\d1a0f.msp

c:\windows\Installer\d36ce.msp

c:\windows\Installer\e51f4.msi

c:\windows\Installer\edf3e.msp

c:\windows\Installer\edf4e.msp

c:\windows\Installer\f9a81.msi

c:\windows\Installer\fa3ee.msi

c:\windows\system32\iAlmcoin.dll

D:\Autorun.inf

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-06-28 to 2009-07-30 ))))))))))))))))))))))))))))))

.

2009-07-28 19:28 . 2009-07-28 19:28 -------- d--h--r- c:\documents and settings\Eigenaar\Onlangs geopend

2009-07-28 18:59 . 2009-07-28 18:59 -------- d-----w- c:\windows\system32\wbem\Repository

2009-07-28 18:56 . 2009-07-28 18:56 -------- d-----w- c:\program files\Photo Viewer

2009-07-27 13:41 . 2009-07-27 13:41 -------- d-----w- c:\documents and settings\Eigenaar\Application Data\OpenOffice.org

2009-07-27 13:36 . 2009-07-27 13:36 -------- d-----w- c:\program files\OpenOffice.org 3

2009-07-26 08:23 . 2009-07-26 08:23 -------- d-----w- C:\MSOCache

2009-07-25 19:37 . 2009-07-28 18:39 -------- d-----w- c:\documents and settings\Eigenaar\Application Data\Reg Tool

2009-07-25 14:08 . 2009-07-28 18:50 -------- d-----w- c:\program files\Recovery for PowerPoint(2)

2009-07-02 11:49 . 2009-07-02 11:49 -------- d-----w- c:\program files\AH

2009-07-02 11:36 . 2009-07-28 18:56 -------- d-----w- c:\program files\Microsoft Windows Vista Upgrade Advisor

2009-07-02 11:32 . 2009-07-02 11:32 -------- d-----w- c:\documents and settings\Eigenaar\IECompatCache

2009-07-02 11:30 . 2009-07-02 11:30 -------- d-----w- c:\documents and settings\Eigenaar\PrivacIE

2009-07-02 11:28 . 2009-07-02 11:28 -------- d-----w- c:\documents and settings\Eigenaar\IETldCache

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-30 04:00 . 2004-12-12 09:07 -------- d-----w- c:\documents and settings\Eigenaar\Application Data\Image Zone Express

2009-07-28 18:58 . 2009-04-24 18:31 -------- d-----w- c:\documents and settings\Eigenaar\Application Data\CameraWindowDC

2009-07-28 18:55 . 2009-05-06 18:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-07-28 18:49 . 2006-12-20 16:58 -------- d-----w- c:\documents and settings\Eigenaar\Application Data\OfficeUpdate12

2009-07-28 18:39 . 2008-10-25 16:13 -------- d-----w- c:\program files\Microsoft Silverlight

2009-07-27 13:27 . 2003-08-01 20:13 -------- d-----w- c:\program files\Java

2009-07-25 19:47 . 2009-04-26 06:53 -------- d-----w- c:\program files\Free Window Registry Repair

2009-07-25 19:18 . 2003-08-01 19:55 73824 -c--a-w- c:\documents and settings\Eigenaar\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-25 18:51 . 2004-07-31 10:08 5058 -c--a-w- c:\windows\Help\hhcolreg.dat

2009-07-25 18:44 . 2003-08-01 17:04 -------- d-----w- c:\program files\microsoft frontpage

2009-07-25 10:21 . 2008-02-12 12:15 -------- d-----w- c:\program files\MSECACHE

2009-07-25 09:24 . 2007-02-14 07:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-07-07 16:49 . 2009-04-24 18:32 -------- d-----w- c:\documents and settings\Eigenaar\Application Data\ZoomBrowser EX

2009-06-29 16:01 . 2006-06-23 11:29 827392 ----a-w- c:\windows\system32\wininet.dll

2009-06-29 16:01 . 2008-10-11 20:36 78336 ------w- c:\windows\system32\ieencode.dll

2009-06-29 16:01 . 2003-08-27 23:43 17408 ----a-w- c:\windows\system32\corpol.dll

2009-06-16 14:40 . 2003-08-27 23:49 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-16 14:40 . 2003-08-27 23:44 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-03 19:11 . 2002-12-12 12:14 1295360 ------w- c:\windows\system32\quartz.dll

2009-05-28 16:40 . 2009-05-28 16:40 3371383 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-05-26 11:20 . 2009-05-06 18:19 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-26 11:19 . 2009-05-06 18:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-05-07 15:34 . 2003-08-27 23:46 347136 ----a-w- c:\windows\system32\localspl.dll

2009-05-06 17:48 . 2009-04-26 12:15 162 ----a-w- c:\windows\system32\pinf.sys

2009-05-06 16:54 . 2009-05-06 16:55 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-05-06 07:52 . 2009-04-26 11:34 321 --sh--w- c:\windows\system32\3366530866.sys

2009-05-05 18:08 . 2003-08-02 01:50 93888 ----a-w- c:\windows\system32\perfc013.dat

2009-05-05 18:08 . 2003-08-02 01:50 515922 ----a-w- c:\windows\system32\perfh013.dat

2009-05-04 20:16 . 2009-05-04 20:16 164 ----a-w- C:\install.dat

2007-07-22 07:42 . 2007-07-22 07:42 32 -csha-w- c:\windows\{3D1EBD19-DBE8-4EFA-9959-C72430ACE4DF}.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-30 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

c:\documents and settings\Administrator\Menu Start\Programma's\Opstarten\

AutoTBar.exe [2003-6-21 53248]

mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]

c:\documents and settings\Default User\Menu Start\Programma's\Opstarten\

AutoTBar.exe [2003-6-21 53248]

mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^hp psc 1000 series.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\hp psc 1000 series.lnk

backup=c:\windows\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^hpoddt01.exe.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\hpoddt01.exe.lnk

backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

"Reminder"="c:\windows\Creator\Remind_XP.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImSc.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\IncrediMail\\bin\\ImLc.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [6-5-2009 19:39 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6-5-2009 19:39 20560]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3-11-2006 19:19 13592]

S3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [18-9-2008 12:09 111112]

S3 hitmanpro3;Hitman Pro 3 Support Driver; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bdx REG_MULTI_SZ scan

.

Inhoud van de 'Gedeelde Taken' map

2009-07-27 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8159687822.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]

2009-07-27 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8223796896.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]

2009-07-30 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

2009-07-23 c:\windows\Tasks\Schedule Task Weekly.job

- c:\program files\Registry Easy\RE.exe [2008-08-21 13:49]

2009-07-30 c:\windows\Tasks\User_Feed_Synchronization-{6DB5F3E4-9353-491F-97A5-DB05F7DEE07A}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 16:36]

.

- - - - ORPHANS VERWIJDERD - - - -

WebBrowser-{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - (no file)

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://mystart.incredimail.com/

mStart Page = hxxp://mystart.incredimail.com/dutch/

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-07-30 07:42

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\EN]

@DACL=(02 0000)

"OnLineServicesDirName"="Online Services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\FR]

@DACL=(02 0000)

"OnLineServicesDirName"="Services en ligne"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\MX]

@DACL=(02 0000)

"OnLineServicesDirName"="Servicios en línea"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\NL]

@DACL=(02 0000)

"OnLineServicesDirName"="Online Services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\NW]

@DACL=(02 0000)

"OnLineServicesDirName"="Online tjenster"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\SP]

@DACL=(02 0000)

"OnLineServicesDirName"="Servicios en línea"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\SW]

@DACL=(02 0000)

"OnLineServicesDirName"="Online tjänster"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\UK]

@DACL=(02 0000)

"OnLineServicesDirName"="Online services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\US]

@DACL=(02 0000)

"OnLineServicesDirName"="Online Services"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(3048)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\HPZipm12.exe

c:\program files\Canon\CAL\CALMAIN.exe

c:\program files\Alwil Software\Avast4\ashMaiSv.exe

c:\program files\Alwil Software\Avast4\ashWebSv.exe

.

**************************************************************************

.

Voltooingstijd: 2009-07-30 7:52 - machine werd herstart

ComboFix-quarantined-files.txt 2009-07-30 05:52

Pre-Run: 34.705.178.624 bytes beschikbaar

Post-Run: 34.554.032.128 bytes beschikbaar

422 --- E O F --- 2009-07-28 20:26

kape · 30 juli 2009

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\3366530866.sys

c:\documents and settings\Administrator\Menu Start\Programma's\Opstarten\

AutoTBar.exe

c:\documents and settings\Default User\Menu Start\Programma's\Opstarten\

AutoTBar.exe

c:\windows\Tasks\Schedule Task Weekly.job

Driver::

hitmanpro3

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

karla.otten · 30 juli 2009

Hieronder de twee gevraagde logjes.

ComboFix 09-07-29.03 - Eigenaar 30-07-2009 9:16.2.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.503.165 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Eigenaar\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Eigenaar\Bureaublad\CFScript.text..txt

AV: avast! antivirus 4.8.1335 [VPS 090729-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

FILE ::

"c:\documents and settings\Administrator\Menu Start\Programma's\Opstarten\"

"c:\windows\system32\3366530866.sys"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\Eigenaar\LOCALS~1\Temp\MFPL7014.DLL

c:\documents and settings\Eigenaar\Local Settings\Temp\MFPL7014.DLL

c:\windows\system32\3366530866.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_HITMANPRO3

-------\Service_hitmanpro3

(((((((((((((((((((( Bestanden Gemaakt van 2009-06-28 to 2009-07-30 ))))))))))))))))))))))))))))))

.

2009-07-28 19:28 . 2009-07-30 07:12 -------- d--h--r- c:\documents and settings\Eigenaar\Onlangs geopend