Archief - Remote Procedure Call Exploit

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
B

Bloob

Legacy Member
rpc.jpg


Sinds Gisteren.
btw, ik zie dat de meeste mensen dit hebben met SP3, maar ik heb SP2 op XP

hi jack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:01:03, on 28/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\RTHDCPL.EXE
H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
H:\Documents and Settings\Bram\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
H:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe
H:\Program Files\Common Files\Teleca Shared\Generic.exe
H:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
H:\WINDOWS\system32\iwinapp.exe
H:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
H:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\winser.exe
H:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
H:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
H:\WINDOWS\system32\wscntfy.exe
H:\Program Files\Windows Live\Messenger\usnsvc.exe
H:\Program Files\mIRC\mirc.exe
H:\Program Files\FlashGet\FlashGet.exe
H:\WINDOWS\system32\cmd.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\system32\notepad.exe
H:\WINDOWS\explorer.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.leeman-automatisering.nl/startpagina
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - H:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - H:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - H:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - H:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Flashget] "H:\Program Files\FlashGet\FlashGet.exe" /min
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NeroFilterCheck] H:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "H:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "H:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "H:\Documents and Settings\Bram\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "H:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [NVIDIA nTune] "H:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKUS\S-1-5-21-839522115-220523388-2146800195-1003\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-839522115-220523388-2146800195-1003\..\Run: [MsnMsgr] "H:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User '?')
O4 - HKUS\S-1-5-21-839522115-220523388-2146800195-1003\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" (User '?')
O4 - HKUS\S-1-5-21-839522115-220523388-2146800195-1003\..\Run: [Google Update] "H:\Documents and Settings\Bram\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (User '?')
O4 - HKUS\S-1-5-21-839522115-220523388-2146800195-1003\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun (User '?')
O4 - HKUS\S-1-5-21-839522115-220523388-2146800195-1003\..\Run: [Yahoo! Pager] "H:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User '?')
O4 - HKUS\S-1-5-21-839522115-220523388-2146800195-1003\..\Run: [NVIDIA nTune] "H:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear (User '?')
O4 - Global Startup: PHOTOfunSTUDIO -viewer-.lnk = H:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe
O8 - Extra context menu item: &Download All with FlashGet - H:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - H:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - H:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - H:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - H:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - H:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IWin service - Unknown owner - H:\WINDOWS\system32\iwinapp.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - H:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - H:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - H:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Win PPPe - Unknown owner - H:\WINDOWS\system32\winser.exe

--
End of file - 8452 bytes


ComboFix Log


ComboFix 08-09-27.05 - Bram 2008-09-28 19:03:32.2 - NTFSx86

Running from: H:\Documents and Settings\Bram\Desktop\ComboFix.exe
Command switches used :: H:\Documents and Settings\Bram\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe
.

((((((((((((((((((((((((( Files Created from 2008-08-28 to 2008-09-28 )))))))))))))))))))))))))))))))
.

2008-09-28 19:00 . 2008-09-28 19:00 <DIR> d-------- H:\Program Files\Trend Micro
2008-09-27 19:53 . 2008-09-27 19:53 <DIR> d-------- H:\WINDOWS\system32\Futuremark
2008-09-27 19:53 . 2008-09-27 19:53 <DIR> d-------- H:\Program Files\Common Files\Futuremark Shared
2008-09-27 19:53 . 2008-05-29 12:33 27,672 -ra------ H:\WINDOWS\system32\drivers\Entech.sys
2008-09-21 04:29 . 2008-09-21 04:29 <DIR> d-------- H:\Program Files\NVIDIA Corporation
2008-09-21 04:16 . 2008-09-21 04:18 <DIR> d-------- H:\Program Files\ATITool
2008-09-19 19:19 . 2008-09-28 18:53 110,592 --a------ H:\WINDOWS\system32\sprint.dll
2008-09-19 18:33 . 2008-09-19 18:33 <DIR> d--h-c--- H:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-09-19 18:24 . 2008-09-19 18:24 2,730 --a------ H:\WINDOWS\system32\ealregsnapshot1.reg
2008-09-18 19:36 . 2008-09-18 19:36 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\Disney Interactive Studios
2008-09-18 17:39 . 2008-09-18 17:39 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\Leadertech
2008-09-18 17:35 . 2008-09-18 17:35 <DIR> d-------- H:\Program Files\DAMN NFO Viewer
2008-09-18 17:33 . 2008-09-18 18:00 948 --a------ H:\WINDOWS\disney.ini
2008-09-15 21:22 . 2008-09-15 21:22 268 --ah----- H:\sqmdata01.sqm
2008-09-15 21:22 . 2008-09-15 21:22 244 --ah----- H:\sqmnoopt01.sqm
2008-09-15 19:24 . 2008-09-15 19:24 <DIR> d-------- H:\Program Files\Qtpfsgui
2008-09-14 02:52 . 2008-09-14 02:52 <DIR> d-------- H:\Documents and Settings\All Users\Application Data\ArcSoft
2008-09-14 02:52 . 2008-09-14 02:52 26 --a------ H:\UpdaterforApp.ini
2008-09-14 02:42 . 2008-09-14 02:42 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\Apple Computer
2008-09-14 02:36 . 2008-09-14 02:36 <DIR> d-------- H:\Program Files\QuickTime
2008-09-14 02:36 . 2008-09-14 02:36 <DIR> d-------- H:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-14 02:33 . 2008-09-14 02:33 <DIR> d-------- H:\Program Files\ISL
2008-09-14 02:33 . 2008-09-14 02:33 <DIR> d-------- H:\Program Files\Apple Software Update
2008-09-14 02:33 . 2008-09-14 02:33 <DIR> d-------- H:\Documents and Settings\All Users\Application Data\Apple
2008-09-14 02:30 . 2008-09-17 19:19 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\ArcSoft
2008-09-14 02:29 . 2008-09-14 02:29 0 --a------ H:\WINDOWS\PhEdit.INI
2008-09-14 02:27 . 2008-09-14 02:27 <DIR> d-------- H:\WINDOWS\system32\MediaImpression Slideshow
2008-09-14 02:27 . 2008-09-14 02:29 <DIR> d-------- H:\Program Files\Common Files\ArcSoft
2008-09-14 02:27 . 2008-09-14 02:27 <DIR> d-------- H:\Program Files\ArcSoft
2008-09-14 02:27 . 2008-09-14 02:27 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\Panasonic
2008-09-14 02:27 . 2005-04-27 16:36 245,408 --a------ H:\WINDOWS\system32\unicows.dll
2008-09-14 02:27 . 2007-02-13 11:22 126,976 --a------ H:\WINDOWS\system32\MediaImpression Slideshow.scr
2008-09-14 02:27 . 2005-02-23 14:58 11,776 --a------ H:\WINDOWS\system32\drivers\afc.sys
2008-09-14 02:26 . 2008-09-14 02:26 <DIR> d-------- H:\Program Files\Panasonic
2008-09-14 02:25 . 2008-09-14 02:25 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\InstallShield
2008-09-13 20:27 . 2008-09-23 19:00 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\U3
2008-09-13 00:27 . 2008-09-13 00:27 <DIR> d-------- H:\Program Files\EA Sports
2008-09-13 00:27 . 2008-03-05 15:56 3,786,760 --a------ H:\WINDOWS\system32\D3DX9_37.dll
2008-09-10 19:23 . 2008-09-10 19:24 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\Microgaming
2008-09-10 19:22 . 2008-09-10 19:22 <DIR> d-------- H:\Microgaming
2008-09-07 11:54 . 2008-09-07 11:54 <DIR> d-------- H:\Documents and Settings\All Users\Application Data\Last.fm
2008-09-07 11:53 . 2008-09-07 11:53 <DIR> d-------- H:\Program Files\Last.fm
2008-09-07 01:58 . 2008-09-07 10:40 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\Yahoo!
2008-09-07 01:58 . 2008-09-07 01:58 <DIR> d-------- H:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-09-07 01:31 . 2008-09-07 01:36 <DIR> d-------- H:\Program Files\PhotomatixPro3
2008-09-07 01:30 . 2008-09-07 01:30 <DIR> d-------- H:\WINDOWS\system32\URTTemp
2008-09-07 01:14 . 2008-09-07 01:14 <DIR> d-------- H:\Program Files\Yahoo!
2008-09-07 01:14 . 2008-09-07 01:14 <DIR> d-------- H:\Documents and Settings\All Users\Application Data\Yahoo!
2008-09-05 08:15 . 2008-09-05 08:15 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\LightZone
2008-09-05 08:14 . 2008-09-05 08:14 <DIR> d-------- H:\Program Files\Common Files\eSellerate
2008-09-05 08:13 . 2008-09-05 08:14 <DIR> d-------- H:\Program Files\LightZone 3
2008-09-05 07:01 . 2008-09-05 07:02 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\SPORE
2008-09-05 06:48 . 2008-09-19 18:25 <DIR> d-------- H:\Program Files\Electronic Arts
2008-09-05 06:45 . 2008-09-18 19:35 <DIR> d-------- H:\Program Files\DAEMON Tools Lite
2008-09-05 06:43 . 2008-09-05 06:43 <DIR> d-------- H:\Documents and Settings\Bram\Application Data\DAEMON Tools
2008-09-05 06:43 . 2008-09-05 06:43 717,296 --a------ H:\WINDOWS\system32\drivers\sptd.sys
2008-09-01 19:35 . 2008-09-01 19:35 268 --ah----- H:\sqmdata00.sqm
2008-09-01 19:35 . 2008-09-01 19:35 244 --ah----- H:\sqmnoopt00.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-28 17:04 --------- d-----w H:\Documents and Settings\Bram\Application Data\NoNameScript
2008-09-28 17:02 --------- d-----w H:\Program Files\FlashGet
2008-09-28 15:54 --------- d-----w H:\Program Files\mIRC
2008-09-27 17:53 --------- d--h--w H:\Program Files\InstallShield Installation Information
2008-09-24 18:28 --------- d-----w H:\Documents and Settings\Bram\Application Data\HLSW
2008-09-18 15:41 107,888 ----a-w H:\WINDOWS\system32\CmdLineExt.dll
2008-09-14 00:52 --------- d-----w H:\Program Files\Common Files\InstallShield
2008-08-18 01:11 --------- d-----w H:\Program Files\PKR
2008-08-17 20:24 --------- d-----w H:\Documents and Settings\All Users\Application Data\TrackMania
2008-08-17 01:54 --------- d-----w H:\Program Files\SmartFTP Client 3.0 Setup Files
2008-08-17 01:54 --------- d-----w H:\Program Files\SmartFTP Client
2008-08-17 01:54 --------- d-----w H:\Documents and Settings\Bram\Application Data\SmartFTP
2008-08-07 22:44 --------- d-----w H:\Program Files\VirtualDJ
2008-08-07 18:08 --------- d-----w H:\Documents and Settings\Bram\Application Data\Nero
2008-08-07 18:07 --------- d-----w H:\Program Files\Common Files\Nero
2008-08-07 18:06 --------- d-----w H:\Program Files\Nero
2008-08-07 18:06 --------- d-----w H:\Documents and Settings\All Users\Application Data\Nero
2008-08-07 18:01 --------- d-----w H:\Program Files\Common Files\Ahead
2008-08-07 18:00 135,168 ----a-w H:\WINDOWS\system32\winser.exe
2008-08-07 18:00 135,168 ----a-w H:\WINDOWS\system32\iwinapp.exe
2008-07-31 08:41 68,616 ----a-w H:\WINDOWS\system32\XAPOFX1_1.dll
2008-07-31 08:41 238,088 ----a-w H:\WINDOWS\system32\xactengine3_2.dll
2008-07-31 08:40 509,448 ----a-w H:\WINDOWS\system32\XAudio2_2.dll
2008-07-28 16:31 --------- d-----w H:\Program Files\Foxit Software
2008-07-12 06:18 467,984 ----a-w H:\WINDOWS\system32\d3dx10_39.dll
2008-07-12 06:18 3,851,784 ----a-w H:\WINDOWS\system32\D3DX9_39.dll
2008-07-12 06:18 1,493,528 ----a-w H:\WINDOWS\system32\D3DCompiler_39.dll
.

------- Sigcheck -------

2004-08-04 01:14 359040 9f4b36614a0fc234525ba224957de55c H:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-04 01:14 359040 6a603809f598332dbedd535bdbce313e H:\WINDOWS\system32\drivers\tcpip.sys

2004-08-04 02:56 57856 fcc2f93413476ab45bd3b1bb98f77265 H:\WINDOWS\system32\spoolsv.exe
2004-08-04 02:56 57856 7435b108b935e42ea92ca94f59c8e717 H:\WINDOWS\system32\dllcache\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="H:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="H:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="H:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"Google Update"="H:\Documents and Settings\Bram\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]
"DAEMON Tools Lite"="H:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"Yahoo! Pager"="H:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"NVIDIA nTune"="H:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="H:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="H:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
"SunJavaUpdateSched"="H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Flashget"="H:\Program Files\FlashGet\FlashGet.exe" [2007-09-25 2007088]
"Sony Ericsson PC Suite"="H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384]
"NeroFilterCheck"="H:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="H:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"ArcSoft Connection Service"="H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-07-04 109056]
"QuickTime Task"="H:\Program Files\QuickTime\qttask.exe" [2008-03-28 413696]
"nwiz"="nwiz.exe" [2008-05-16 H:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 H:\WINDOWS\RTHDCPL.exe]

H:\Documents and Settings\All Users\Start Menu\Programs\Startup\
PHOTOfunSTUDIO -viewer-.lnk - H:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe [2008-09-14 40960]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"H:\\Program Files\\Messenger\\msmsgs.exe"=
"H:\\Program Files\\FlashGet\\flashget.exe"=
"H:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"H:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"H:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"H:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"H:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6602f1d2-6890-11dd-8200-0018f3318917}]
\Shell\Auto\command - Start.exe
\Shell\AutoRun\command - H:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9a03ca16-81c1-11dd-8226-0018f3318917}]
\Shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6774ca8-84d0-11dd-822c-0018f3318917}]
\Shell\AutoRun\command - fppg1.exe
\Shell\explore\Command - fppg1.exe
\Shell\open\Command - fppg1.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - H:\Documents and Settings\Bram\Application Data\Mozilla\Firefox\Profiles\zqrncj5u.default\
FF -: plugin - H:\Documents and Settings\Bram\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - H:\Program Files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-28 19:03:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-28 19:04:20
ComboFix-quarantined-files.txt 2008-09-28 17:04:16
ComboFix2.txt 2008-09-28 16:56:27

Pre-Run: 84.724.772.864 bytes free
Post-Run: 84,702,429,184 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(2)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(2)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

183
J

Juisterr

Legacy Member
Download OTMoveIt (by OldTimer) naar je Bureaublad.

  • * Dubbelklik op OTMoveIt.exe om de tool te starten.
    * Kopieer (selecteren en druk Ctrl-C) alle onderstaande, vetgedrukte, blauwe tekst :


    • C:\WINDOWS\System32\winser.exe

      * Plak de gekopieerde tekst (druk Ctrl-V) in het "Paste List of Files/Folders to be moved" venster
      * Klik op de rode MoveIt! knop
      * Kopieer en plak de inhoud van het rechter resultaat-venster in je volgende antwoord.
      * Sluit OTMoveIt

      Indien een bestand of map niet onmiddellijk kan verplaatst worden,
      kun je gevraagd worden om de PC te herstarten teneinde het verplaatsen te beëindigen.
      Klik dan op Ja/Yes.

    Open Kladblok, kopieer en plak het volgende (vetgedrukte, blauwe tekst) in een leeg venster:

    • @echo off
      sc stop "Win PPPe"
      sc delete "Win PPPe"
      cls
      exit

      Sla dit op op je Bureaublad als service.bat, met als type 'alle bestanden'
      Dubbelklik op service.bat om uit te voeren.
B

Bloob

Legacy Member
Na gisteren combofix te runnen is het niet meer teruggekomen eigenlijk :unsure:
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan