ComboFix 09-10-10.02 - Olivier Merlevede 11-10-2009 16:30.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.3326.2585 [GMT 2:00]
Gestart vanuit: c:\documents and settings\Olivier Merlevede\Bureaublad\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Nieuw herstelpunt werd aangemaakt
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-1709038832-2204918661-3347436298-1000
c:\$recycle.bin\S-1-5-21-3722319419-4292258345-3787718693-1000
c:\$recycle.bin\S-1-5-21-876391816-386196763-1472918176-1000
c:\recycler\S-1-5-21-4383366035-1404192142-746670393-7741
c:\recycler\S-1-5-21-4383366035-1404192142-746670393-7741\Desktop.ini
c:\recycler\S-1-5-21-4383366035-1404192142-746670393-7741\twain_x86.exe
c:\windows\Installer\128c8af.msi
c:\windows\Installer\156954b.msp
c:\windows\Installer\156954c.msp
c:\windows\Installer\248370.msp
c:\windows\Installer\2fb14a.msi
c:\windows\Installer\75ff0.msi
c:\windows\msa.exe
c:\windows\msb.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_NPF
(((((((((((((((((((( Bestanden Gemaakt van 2009-09-11 to 2009-10-11 ))))))))))))))))))))))))))))))
.
2009-10-04 09:32 . 2009-10-04 09:35 -------- d-----w- c:\program files\AltBinz
2009-10-03 14:59 . 2009-10-03 14:59 -------- d-----w- c:\program files\Smart Projects
2009-10-03 09:59 . 2009-10-03 09:59 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-10-03 09:59 . 2009-10-03 09:59 -------- d-----w- c:\program files\UltraISO
2009-09-20 13:04 . 2009-09-20 13:04 -------- d-----w- c:\program files\Microsoft.NET
2009-09-20 13:02 . 2009-09-20 13:02 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-09-20 13:01 . 2009-09-20 13:01 -------- d-----r- C:\MSOCache
2009-09-17 07:52 . 2009-09-17 07:52 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-09-16 18:20 . 2009-09-16 18:20 -------- d-----w- c:\program files\AGEIA Technologies
2009-09-16 18:20 . 2009-09-16 18:20 -------- d-----w- c:\windows\system32\AGEIA
2009-09-16 18:07 . 2009-08-16 22:57 485920 ----a-w- c:\windows\system32\nvudisp.exe
2009-09-16 18:07 . 2009-08-11 10:35 485920 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-09-16 18:07 . 2009-08-16 22:57 7729568 -c--a-w- c:\windows\system32\dllcache\nv4_mini.sys
2009-09-16 18:07 . 2009-08-16 22:57 7729568 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-09-16 18:07 . 2009-08-16 22:57 2189856 ----a-w- c:\windows\system32\nvcuvid.dll
2009-09-16 18:07 . 2009-08-16 22:57 1706528 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-09-16 18:07 . 2009-08-16 22:57 10457088 ----a-w- c:\windows\system32\nvoglnt.dll
2009-09-16 18:06 . 2009-08-16 22:57 868352 ----a-w- c:\windows\system32\nvapi.dll
2009-09-16 18:06 . 2009-08-16 22:57 2002944 ----a-w- c:\windows\system32\nvcuda.dll
2009-09-16 18:06 . 2009-08-16 22:57 155648 ----a-w- c:\windows\system32\nvcodins.dll
2009-09-16 18:06 . 2009-08-16 22:57 155648 ----a-w- c:\windows\system32\nvcod.dll
2009-09-16 18:06 . 2009-08-16 22:57 5845760 ----a-w- c:\windows\system32\nv4_disp.dll
2009-09-16 18:06 . 2009-08-16 22:57 1597690 ----a-w- c:\windows\system32\nvdata.bin
2009-09-16 18:06 . 2009-09-16 18:06 -------- d-----w- C:\NVIDIA
2009-09-16 17:15 . 2009-09-25 16:08 -------- d-----w- c:\program files\NFR
2009-09-12 12:41 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-12 12:41 . 2009-09-12 12:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-12 12:41 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-10 11:29 . 2009-01-20 12:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Test Drive Unlimited
2009-10-04 11:28 . 2007-01-15 16:00 -------- d-----w- c:\documents and settings\Olivier Merlevede\Application Data\Newsbin
2009-09-27 07:49 . 2006-12-16 13:34 78952 ----a-w- c:\documents and settings\Olivier Merlevede\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-25 16:49 . 2006-12-24 08:53 -------- d-----w- c:\documents and settings\Olivier Merlevede\Application Data\Azureus
2009-09-20 13:05 . 2006-12-16 09:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-16 18:20 . 2008-03-09 09:52 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-14 08:42 . 2009-09-01 08:18 -------- d-----w- c:\program files\TViXiE
2009-09-06 07:58 . 2009-09-06 07:58 -------- d-----w- c:\program files\Garmin
2009-09-06 07:58 . 2009-09-06 07:58 -------- d-----w- c:\program files\DIFX
2009-09-04 12:48 . 2009-08-03 18:01 -------- d-----w- c:\program files\Project64 1.6
2009-08-31 07:20 . 2006-12-15 21:13 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-30 12:17 . 2009-08-30 12:17 -------- d-----w- c:\program files\Farming-Simulator 2009
2009-08-27 16:16 . 2009-08-27 16:16 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-27 08:20 . 2008-12-22 10:45 -------- d-----w- c:\program files\ESET
2009-08-27 08:13 . 2008-09-02 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-26 09:42 . 2009-08-26 09:42 -------- d-----w- c:\documents and settings\Olivier Merlevede\Application Data\AVG8
2009-08-19 15:37 . 2009-08-17 08:51 -------- d-----w- c:\program files\CAPCOM
2009-08-17 01:03 . 2009-08-17 01:03 3674112 ----a-w- c:\windows\system32\nvwssr.dll
2009-08-17 01:02 . 2009-08-17 01:02 229376 ----a-w- c:\windows\system32\nvmccs.dll
2009-08-14 11:36 . 2009-08-14 11:36 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
2009-08-05 09:01 . 2004-08-04 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 08:31 . 2006-12-23 21:24 1984 ----a-w- c:\windows\system32\d3d9caps.dat
2009-07-25 03:23 . 2009-01-19 17:39 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:04 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-08-04 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2007-08-20 08:11 . 2007-08-20 08:11 48 --sha-w- c:\windows\S920C1634.tmp
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EVEREST AutoStart"="c:\program files\Lavalys\EVEREST Ultimate Edition\everest.exe" [2009-05-24 2389600]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2006-08-02 9134080]
"SetDefPrt"="c:\program files\Brother\Brmfl05a\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-05-17 933888]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.24\RivaTuner.exe" [2009-02-25 2781184]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-03-19 2029640]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-02-27 38768]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-02-27 640376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-01-21 92168]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-12 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Olivier Merlevede\Menu Start\Programma's\Opstarten\
everest.lnk - c:\program files\Lavalys\EVEREST Ultimate Edition\everest.exe [2009-4-10 2389600]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\acaptuser32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\\Games\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"=
"c:\\Program Files\\Portable CambridgeSoftware ChemBioOffice Ultra 2008 v11\\CBO_2008_by_PP\\Virtual\\STUBEXE\\@PROGRAMFILES@\\CambridgeSoft\\ChemOffice2008\\ChemDraw\\ChemDraw.exe"=
"c:\\Program Files\\CambridgeSoft\\ChemOffice2008\\ChemDraw\\ChemDraw.exe"=
"c:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
R0 stmtpm;STM TPM Service;c:\windows\system32\drivers\stm_tpm.sys [16-12-2006 21:51 21504]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [19-3-2009 11:44 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21-12-2007 9:21 93848]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [19-3-2009 11:44 731840]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12-9-2009 14:41 269648]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [10-2-2007 14:00 2368]
R3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter;c:\windows\system32\drivers\rt2500usb.sys [15-12-2006 23:05 140416]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [10-4-2009 15:59 26736]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [10-9-2008 19:50 33792]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12-9-2009 14:41 19160]
S1 ntiomin;ntiomin; [x]
S2 Belkin 54g Wireless USB Network Adapter Service;Belkin 54g Wireless USB Network Adapter;c:\program files\Belkin\Belkin Wireless Network Utility\WLService.exe [15-12-2006 23:05 49152]
S3 bfastfao;bfastfao;\??\c:\docume~1\OLIVIE~1\LOCALS~1\Temp\bfastfao.sys --> c:\docume~1\OLIVIE~1\LOCALS~1\Temp\bfastfao.sys [?]
S3 cpuz126;cpuz126;\??\c:\docume~1\OLIVIE~1\LOCALS~1\Temp\cpuz.sys --> c:\docume~1\OLIVIE~1\LOCALS~1\Temp\cpuz.sys [?]
S3 EfiVariable;Efi Variable Service;c:\windows\system32\drivers\variable.sys [13-12-2008 20:28 7680]
S3 PciCon;PciCon;\??\f:\pcicon.sys --> f:\PciCon.sys [?]
S3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [23-1-2004 16:33 13952]
S3 PPortJoystick;Parallel Port Joystick device driver;c:\windows\system32\drivers\PPortJoy.sys [23-1-2004 16:32 28800]
S3 USRSp50;USRSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\USRSp50.sys --> c:\windows\system32\Drivers\USRSp50.sys [?]
--- Andere Services/Drivers In Geheugen ---
*NewlyCreated* - EVERESTDRIVER
*NewlyCreated* - GTNDIS5
.
Inhoud van de 'Gedeelde Taken' map
2009-06-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:57]
2009-09-12 c:\windows\Tasks\Malwarebytes' Scheduled Update for Olivier Merlevede.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-12 12:53]
2009-06-10 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 15:04]
2009-10-11 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 15:04]
2009-10-10 c:\windows\Tasks\User_Feed_Synchronization-{06B608F7-A90F-4E3A-A41A-23A36F05ACA7}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:58]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 130.75.87.84:3124
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
FF - ProfilePath - c:\documents and settings\Olivier Merlevede\Application Data\Mozilla\Firefox\Profiles\kgyduvxn.default\
FF - plugin: c:\program files\CambridgeSoft\ChemOffice2008\Chem3D\npChem3DPlugin.dll
FF - plugin: c:\program files\CambridgeSoft\ChemOffice2008\ChemDraw\NPCDP32.DLL
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll
.
- - - - ORPHANS VERWIJDERD - - - -
AddRemove-Mafia - d:\games\Mafia\Mafia\patch.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-11 16:37
Windows 5.1.2600 Service Pack 3 NTFS
scannen van verborgen processen ...
scannen van verborgen autostart items ...
scannen van verborgen bestanden ...
Scan succesvol afgerond
verborgen bestanden: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
[HKEY_USERS\S-1-5-21-790525478-1078145449-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:34,7f,31,db,43,96,0a,2e,a8,e0,99,f5,2c,43,78,a3,57,54,34,97,49,c7,a1,
ae,e2,d0,9d,6b,5b,12,20,88,af,c2,72,73,06,1f,61,bd,bc,e8,7b,31,10,1c,c6,a5,\
"??"=hex:c5,9d,ad,e9,60,2b,2b,33,71,67,5f,19,77,6d,49,ad
[HKEY_USERS\S-1-5-21-790525478-1078145449-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:59,cc,67,9e,1c,6b,db,24,73,93,77,d5,eb,1c,d1,dd,d3,48,42,8d,ac,
b8,1c,8e,3a,6c,2f,6c,0f,d1,09,b5,30,43,98,22,fb,85,0a,a8,4d,07,a7,57,70,36,\
"rkeysecu"=hex:cc,ed,fa,f3,5a,21,05,1e,34,c4,d1,e1,ba,ff,ef,54
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
- - - - - - - > 'explorer.exe'(1100)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\brss01a.exe
c:\windows\system32\Crypserv.exe
c:\program files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\libusbd-nt.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Voltooingstijd: 2009-10-11 16:44 - machine werd herstart
ComboFix-quarantined-files.txt 2009-10-11 14:44
Pre-Run: 13.653.635.072 bytes beschikbaar
Post-Run: 14.917.578.752 bytes beschikbaar
240 --- E O F --- 2009-08-16 20:28
