Archief - Browser blijft vensters openen

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:30:38, on 5/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5153 bytes

Klik om te vergroten...

ComboFix 09-11-04.05 - Gebruiker 05/11/2009 17:41.1.2 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1014.827 [GMT 1:00]
Gestart vanuit: c:\documents and settings\Gebruiker\Bureaublad\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((( Bestanden Gemaakt van 2009-10-05 to 2009-11-05 ))))))))))))))))))))))))))))))
.

2009-11-05 16:10 . 2009-11-05 16:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky SDK
2009-11-05 16:05 . 2009-11-05 16:05 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\MailFrontier
2009-11-05 15:59 . 2009-11-05 16:09 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-11-05 15:59 . 2009-10-17 00:39 72584 ----a-w- c:\windows\zllsputility.exe
2009-11-05 15:59 . 2009-10-12 17:15 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-11-05 15:58 . 2009-10-17 00:39 69000 ----a-w- c:\windows\system32\zlcomm.dll
2009-11-05 15:58 . 2009-10-17 00:39 103816 ----a-w- c:\windows\system32\zlcommdb.dll
2009-11-05 15:58 . 2009-10-17 00:39 1238408 ----a-w- c:\windows\system32\zpeng25.dll
2009-11-05 15:58 . 2009-11-05 15:59 -------- d-----w- c:\windows\system32\ZoneLabs
2009-11-05 15:58 . 2009-11-05 15:58 -------- d-----w- c:\program files\Zone Labs
2009-11-05 15:57 . 2009-11-05 16:28 -------- d-----w- c:\windows\Internet Logs
2009-11-05 13:41 . 2009-11-05 13:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-11-04 19:41 . 2009-11-04 19:41 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\Malwarebytes
2009-11-04 19:41 . 2009-11-04 19:41 -------- d-----w- c:\program files\Trend Micro
2009-11-04 19:41 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-04 19:41 . 2009-11-04 19:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-04 19:41 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-04 19:41 . 2009-11-04 19:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-04 18:49 . 2009-11-05 14:11 -------- d--h--r- c:\documents and settings\Gebruiker\Onlangs geopend
2009-11-04 18:35 . 2009-09-03 09:17 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-11-04 15:06 . 2009-09-23 12:55 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-04 15:05 . 2009-11-04 15:05 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-04 15:05 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2009-11-04 15:04 . 2009-11-04 15:04 -------- d-----w- c:\program files\Lavasoft
2009-11-03 16:34 . 2009-11-03 16:36 -------- d-----w- c:\documents and settings\Gebruiker\Local Settings\Application Data\Google
2009-11-03 16:27 . 2009-11-03 16:27 -------- d-----w- c:\documents and settings\Gebruiker\Local Settings\Application Data\Deployment
2009-11-03 15:59 . 2009-11-03 15:59 -------- d-----w- c:\program files\ESET
2009-11-03 15:59 . 2009-11-03 15:59 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-11-03 15:30 . 2009-11-04 18:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-03 15:30 . 2009-11-03 15:31 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-03 15:20 . 2009-11-03 15:20 -------- d-----w- c:\program files\CCleaner
2009-11-03 15:20 . 2009-11-03 15:20 -------- d-----w- c:\program files\Eusing Free Registry Cleaner
2009-11-01 16:22 . 2009-11-01 16:22 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-10-22 17:55 . 2009-10-22 17:55 -------- d-----w- c:\windows\Sun
2009-10-22 17:52 . 2009-10-22 17:52 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-22 17:52 . 2009-10-22 17:52 -------- d-----w- c:\program files\Java
2009-10-22 17:51 . 2009-10-22 17:51 152576 ----a-w- c:\documents and settings\Gebruiker\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-09 09:47 . 2009-10-09 09:47 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\MathWorks
2009-10-09 09:35 . 2009-10-09 09:44 -------- d-----w- c:\program files\MATLAB71

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-05 16:18 . 2009-11-05 16:19 824320 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2009-11-04 20:47 . 2009-05-04 18:21 -------- d-----w- c:\program files\DivX
2009-11-04 19:52 . 2009-04-21 07:08 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-04 15:04 . 2009-04-19 11:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-01 16:20 . 2009-04-16 10:13 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\WinEdt
2009-10-28 22:23 . 2009-10-06 08:14 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\vlc
2009-10-25 19:55 . 2009-09-28 14:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-25 07:33 . 2008-04-15 12:00 86424 ----a-w- c:\windows\system32\perfc013.dat
2009-10-25 07:33 . 2008-04-15 12:00 499480 ----a-w- c:\windows\system32\perfh013.dat
2009-10-24 21:32 . 2009-10-06 08:14 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\dvdcss
2009-10-06 08:12 . 2009-10-06 08:12 -------- d-----w- c:\program files\VideoLAN
2009-10-05 11:08 . 2009-10-05 11:08 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\CoreCodec
2009-10-05 11:07 . 2009-10-05 11:07 -------- d-----w- c:\program files\Haali
2009-10-05 11:07 . 2009-10-05 11:07 -------- d-----w- c:\program files\CoreCodec
2009-10-05 10:32 . 2009-10-05 09:51 -------- d-----w- c:\program files\Easy DVD Player
2009-10-04 21:22 . 2009-10-04 21:22 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\Canneverbe_Limited
2009-10-01 12:20 . 2009-04-14 07:05 36296 ----a-w- c:\documents and settings\Gebruiker\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-29 12:05 . 2009-09-29 12:05 96408 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2009-09-29 12:02 . 2009-09-29 12:02 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-09-29 11:56 . 2009-09-29 11:56 116008 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-09-28 14:28 . 2009-09-28 14:28 -------- d-----w- c:\program files\Microsoft Works
2009-09-28 14:27 . 2009-09-28 14:27 -------- d-----w- c:\program files\Microsoft.NET
2009-09-25 05:37 . 2008-04-15 12:00 670208 ----a-w- c:\windows\system32\wininet.dll
2009-09-25 05:37 . 2008-04-15 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-11 14:20 . 2008-04-15 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:05 . 2008-04-15 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-26 08:02 . 2008-04-15 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-04-11 08:58 . 2009-04-11 08:58 44 --sha-w- c:\windows\cmdrhk.dat
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2005-12-28 569413]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2007-05-29 520192]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1037192]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-1-17 618557]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Maple 12\\jre\\bin\\maple.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/11/2009 16:06 64288]
S1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29/09/2009 13:02 108792]
S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [29/09/2009 13:05 96408]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [29/09/2009 13:03 735960]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 12:17 1169232]

--- Andere Services/Drivers In Geheugen ---

*NewlyCreated* - MBR
*NewlyCreated* - MDMXSDK
*Deregistered* - mbr
.
Inhoud van de 'Gedeelde Taken' map

2009-11-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 13:06]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.be/
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Gebruiker\Application Data\Mozilla\Firefox\Profiles\d4rda337.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-11-05 18:01
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(1728)
c:\program files\Haali\MatroskaSplitter\mmfinfo.dll
c:\program files\Haali\MatroskaSplitter\mkunicode.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.NLD
.
Voltooingstijd: 2009-11-05 18:04
ComboFix-quarantined-files.txt 2009-11-05 17:04

Pre-Run: 5.572.775.936 bytes beschikbaar
Post-Run: 6.010.511.360 bytes beschikbaar

Klik om te vergroten...