ComboFix 10-12-09.08 - Admin 11-12-2010 12:04:47.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.2046.1290 [GMT 1:00]
Gestart vanuit: c:\documents and settings\Admin\Bureaublad\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Fonts\BOD_BLAI.TTF
c:\windows\Fonts\BOD_I.TTF
c:\windows\Fonts\GARA.TTF
c:\windows\Fonts\GARABD.TTF
c:\windows\Fonts\GARAIT.TTF
c:\windows\pthreadGC2.dll
.
(((((((((((((((((((( Bestanden Gemaakt van 2010-11-11 to 2010-12-11 ))))))))))))))))))))))))))))))
.
2010-12-10 15:48 . 2009-07-01 10:55 701440 ----a-w- c:\windows\system32\cohelper.dll
2010-12-10 15:48 . 2009-06-30 03:48 6136 ----a-w- c:\windows\system32\drivers\nvphy.bin
2010-12-10 15:48 . 2009-06-30 23:42 485920 ----a-w- c:\windows\system32\nvunrm.exe
2010-12-10 15:15 . 2010-12-10 15:15 388096 ----a-r- c:\documents and settings\Admin\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-06 18:06 . 2010-12-06 18:06 -------- d-----w- c:\program files\YouTube Downloader
2010-12-04 23:27 . 2010-12-04 23:27 -------- d-----w- c:\documents and settings\Admin\Local Settings\Application Data\Activision
2010-12-04 23:21 . 2010-06-14 13:26 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2010-11-28 16:00 . 2010-11-28 16:00 -------- d-----w- c:\documents and settings\LocalService\Menu Start
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-08 16:09 . 2010-02-09 07:43 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-11-28 16:00 . 2010-02-09 07:43 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-09-19 15:02 . 2010-09-05 18:09 234576 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-09-19 14:56 . 2010-09-05 15:27 138608 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-09-19 14:56 . 2010-09-05 15:27 234576 ----a-w- c:\windows\system32\PnkBstrB.exe
2008-08-16 15:42 . 2008-08-16 15:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 15:42 . 2008-08-16 15:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 15:42 . 2008-08-16 15:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 15:42 . 2008-08-16 15:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 15:43 . 2008-08-16 15:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 15:42 . 2008-08-16 15:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 15:42 . 2008-08-16 15:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 06:41 . 2008-05-21 06:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 06:41 . 2008-05-21 06:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 06:41 . 2008-05-21 06:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 11:58 . 2008-06-05 11:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 15:42 . 2008-08-16 15:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"JMB36X Configure"="c:\windows\System32\JMRaidSetup.exe" [2006-10-30 1953792]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 16270848]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-12-19 196608]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-08 13762560]
"nwiz"="nwiz.exe" [2009-07-08 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-08 86016]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\I:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SoulseekNS\\slsk.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9-2-2010 9:34 691696]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [9-2-2010 8:43 135336]
--- Andere Services/Drivers In Geheugen ---
*NewlyCreated* - NVATA
.
.
------- Bijkomende Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll
TCP: {67807F4A-1EF9-493C-8C72-F73E97A07F99} = 195.238.2.21 195.238.2.22
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\myzirojl.default\
FF - prefs.js: browser.startup.homepage - hxxp://mail.live.com/default.aspx?wa=wsignin1.0|
Bienvenue sur Facebook
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\myzirojl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Extension: Remove It Permanently: {1dbc4a33-ea62-4330-966c-7bdad3455322} - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\myzirojl.default\extensions\{1dbc4a33-ea62-4330-966c-7bdad3455322}
FF - Extension: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\myzirojl.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Extension: Dictionnaire français «Moderne»:
[email protected] - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\myzirojl.default\extensions\
[email protected]
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2010-12-11 12:08
Windows 5.1.2600 Service Pack 3 NTFS
scannen van verborgen processen ...
scannen van verborgen autostart items ...
scannen van verborgen bestanden ...
Scan succesvol afgerond
verborgen bestanden: 0
**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
[HKEY_USERS\S-1-5-21-1454471165-2111687655-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3a,6f,fd,c3,9a,cc,1e,44,c0,62,0f,12,c7,ed,4f,91,04,72,1b,cb,99,28,aa,
45,61,a7,ae,ee,02,7b,60,e1,96,c3,83,45,89,9e,c8,5c,c5,3b,1a,e3,d5,40,8f,7b,\
"??"=hex:6a,98,4e,5e,c8,2f,bc,be,e8,44,52,b7,0e,e4,7d,50
[HKEY_USERS\S-1-5-21-1454471165-2111687655-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:80,0c,88,ac,60,ba,b6,b9,43,06,94,8d,4f,4d,bb,e6,73,96,46,8d,09,
ab,e2,cb,5e,2b,a8,9b,ab,6e,5c,de,2c,3f,7e,98,12,55,ec,b1,74,6b,42,35,78,91,\
"rkeysecu"=hex:d5,07,12,7c,48,b7,23,22,0f,7d,c1,bb,2f,9a,38,30
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
- - - - - - - > 'lsass.exe'(788)
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll
.
Voltooingstijd: 2010-12-11 12:09:41
ComboFix-quarantined-files.txt 2010-12-11 11:09
Pre-Run: 21.553.766.400 bytes beschikbaar
Post-Run: 23.666.221.056 bytes beschikbaar
- - End Of File - - 19B5E38283CA4C26576DB6939B30A0CF
