ComboFix 09-08-19.0C - Arne Vanhoof 20/08/2009 22:50.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.32.1043.18.3581.1857 [GMT 2:00]
Gestart vanuit: c:\users\Arne Vanhoof\Downloads\ComboFix.exe
AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: Bitdefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
SP: BitDefender AntiSpam *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-2815755638-1480285660-2120787009-500
c:\$recycle.bin\S-1-5-21-652352353-311927663-4269263483-1007
c:\$recycle.bin\S-1-5-21-652352353-311927663-4269263483-500
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\dsp_sps.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\enc_aacplus.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\enc_flac.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\enc_lame.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\enc_vorbis.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\enc_wav.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\enc_wma.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\gen_crasher.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\gen_ff.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\gen_hotkeys.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\gen_ml.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\gen_tray.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_cdda.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_dshow.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_flac.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_flv.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_linein.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_midi.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_mod.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_mp3.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_mp4.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_nsv.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_swf.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_vorbis.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_wave.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\in_wm.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_autotag.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_bookmarks.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_dash.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_disc.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_history.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_impex.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_local.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_nowplaying.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_online.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_orb.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_playlists.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_plg.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_pmp.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_rg.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_transcode.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\ml_wire.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\out_disk.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\out_ds.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\out_wave.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\playlist.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\pmp_activesync.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\pmp_ipod.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\pmp_njb.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\pmp_p4s.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\pmp_usb.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\tagz.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\vis_nsfs.lng
c:\users\Arne Vanhoof\AppData\Local\Temp\WLZB4DD.tmp\winamp.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\dsp_sps.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\enc_aacplus.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\enc_flac.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\enc_lame.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\enc_vorbis.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\enc_wav.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\enc_wma.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\gen_crasher.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\gen_ff.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\gen_hotkeys.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\gen_ml.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\gen_tray.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_cdda.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_dshow.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_flac.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_flv.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_linein.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_midi.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_mod.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_mp3.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_mp4.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_nsv.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_swf.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_vorbis.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_wave.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\in_wm.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_autotag.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_bookmarks.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_dash.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_disc.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_history.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_impex.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_local.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_nowplaying.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_online.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_orb.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_playlists.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_plg.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_pmp.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_rg.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_transcode.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\ml_wire.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\out_disk.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\out_ds.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\out_wave.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\playlist.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\pmp_activesync.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\pmp_ipod.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\pmp_njb.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\pmp_p4s.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\pmp_usb.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\tagz.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\vis_nsfs.lng
c:\users\ARNEVA~1\AppData\Local\Temp\WLZB4DD.tmp\winamp.lng
c:\windows\Installer\9b4d046.msi
.
(((((((((((((((((((( Bestanden Gemaakt van 2009-07-20 to 2009-08-20 ))))))))))))))))))))))))))))))
.
2009-08-20 05:36 . 2009-08-20 05:36 -------- d-----w- c:\users\TEMP\AppData\Roaming\BitDefender
2009-08-20 05:34 . 2009-08-20 05:38 -------- d-----w- c:\users\TEMP
2009-08-19 21:18 . 2009-06-15 15:24 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-08-19 21:18 . 2009-06-15 15:22 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-08-19 21:18 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-08-19 21:18 . 2009-06-15 18:20 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-08-19 21:18 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2009-08-19 21:18 . 2009-06-15 15:23 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2009-08-19 21:18 . 2009-06-15 15:24 72704 ----a-w- c:\windows\system32\secur32.dll
2009-08-19 21:18 . 2009-06-15 12:57 9728 ----a-w- c:\windows\system32\lsass.exe
2009-08-15 19:12 . 2009-08-15 19:12 -------- d-----w- c:\program files\iPod
2009-08-15 19:09 . 2009-08-15 19:09 75040 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-08-13 08:21 . 2009-07-17 14:35 71680 ----a-w- c:\windows\system32\atl.dll
2009-08-13 08:21 . 2009-06-10 12:12 160256 ----a-w- c:\windows\system32\wkssvc.dll
2009-08-13 08:21 . 2009-06-04 12:34 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-08-13 08:21 . 2009-06-10 12:07 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-08-13 08:21 . 2009-07-14 13:00 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-08-13 08:21 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-08-13 08:21 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-08-13 08:21 . 2009-07-14 10:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-08-06 09:52 . 2009-08-06 09:52 -------- d-----w- c:\program files\Common Files\xing shared
2009-08-06 09:52 . 2009-08-06 09:52 -------- d-----w- c:\program files\Real
2009-08-06 09:52 . 2009-08-06 09:52 -------- d-----w- c:\program files\Common Files\Real
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-20 21:05 . 2008-09-26 13:49 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-20 20:59 . 2008-08-01 10:37 1660 ----a-w- c:\windows\bthservsdp.dat
2009-08-20 05:45 . 2006-11-02 16:11 716768 ----a-w- c:\windows\system32\perfh013.dat
2009-08-20 05:45 . 2006-11-02 16:11 149124 ----a-w- c:\windows\system32\perfc013.dat
2009-08-20 05:37 . 2008-08-01 11:00 -------- d-----w- c:\program files\Google
2009-08-19 21:16 . 2008-09-02 20:43 -------- d-----w- c:\users\Arne Vanhoof\AppData\Roaming\DMCache
2009-08-15 19:12 . 2008-08-20 14:38 -------- d-----w- c:\program files\iTunes
2009-08-15 19:12 . 2008-08-20 14:36 -------- d-----w- c:\program files\Common Files\Apple
2009-08-15 19:07 . 2008-08-20 14:38 -------- d-----w- c:\users\Arne Vanhoof\AppData\Roaming\Apple Computer
2009-08-15 18:32 . 2009-08-15 18:32 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-08-15 18:32 . 2008-08-17 09:57 -------- d-----w- c:\programdata\Apple
2009-08-14 08:30 . 2008-09-02 20:43 -------- d-----w- c:\program files\Internet Download Manager
2009-08-13 20:53 . 2008-08-12 17:12 -------- d-----w- c:\programdata\Microsoft Help
2009-08-13 20:52 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-03 16:45 . 2008-08-15 23:07 7592 ----a-w- c:\users\Arne Vanhoof\AppData\Local\d3d9caps.dat
2009-08-01 12:49 . 2008-09-02 20:43 -------- d-----w- c:\users\Arne Vanhoof\AppData\Roaming\IDM
2009-08-01 12:49 . 2009-04-24 22:10 198064 ----a-w- c:\users\Arne Vanhoof\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll
2009-07-31 22:51 . 2008-08-06 15:34 110256 ----a-w- c:\users\Arne Vanhoof\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-31 22:26 . 2008-10-28 12:10 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-18 16:06 . 2009-07-28 17:24 827904 ----a-w- c:\windows\system32\wininet.dll
2009-07-18 16:01 . 2009-07-28 17:24 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 09:46 . 2009-07-28 17:24 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-12 19:42 . 2009-07-12 19:42 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-12 19:41 . 2009-07-12 19:41 -------- d-----w- c:\program files\Bonjour
2009-07-12 19:40 . 2009-07-12 19:40 -------- d-----w- c:\program files\QuickTime
2009-07-08 15:21 . 2008-09-23 10:16 -------- d-----w- c:\users\Arne Vanhoof\AppData\Roaming\Skype
2009-07-08 14:43 . 2008-09-23 10:17 -------- d-----w- c:\users\Arne Vanhoof\AppData\Roaming\skypePM
2009-06-15 15:24 . 2009-07-15 10:30 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-07-15 10:30 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-15 10:30 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-15 10:30 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-06-05 09:42 . 2009-06-05 09:42 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-05 09:42 . 2009-06-05 09:42 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-23 21:22 . 2008-08-06 16:42 174212 ----a-w- c:\programdata\nvModes.dat
2008-06-19 09:59 . 2008-08-08 15:46 889856 ----a-w- c:\program files\mozilla firefox\components\pbgk1_9.dll
2008-08-01 10:53 . 2008-08-01 10:53 74 --sh--r- c:\windows\CT4CET.bin
2008-08-01 18:25 . 2008-08-01 18:13 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2008-09-15 15:25 4233480 ----a-w- c:\program files\Protector Suite QL\farchns.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2008-09-15 15:25 4233480 ----a-w- c:\program files\Protector Suite QL\farchns.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-01 68856]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Google Update"="c:\users\Arne Vanhoof\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-04-18 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-01-25 167936]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2008-03-04 36864]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-01 29744]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-12-03 405504]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-04-09 166432]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-09 13515296]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-09 92704]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2008-04-09 92704]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"snppro"="c:\windows\vsnppro.exe" [2006-12-27 843776]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-26 360448]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-02-05 536576]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2008-09-15 49928]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-13 177472]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-08-06 198160]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
c:\users\Arne Vanhoof\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office Groove.lnk - c:\program files\Microsoft Office\Office12\GROOVE.EXE [2009-2-14 337264]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-3 703280]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-2-22 1193240]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-01 11:06 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2008-09-15 15:12 96520 ----a-w- c:\program files\Protector Suite QL\psqlpwd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"c:\\Program Files\\FlashFXP\\FlashFXP.exe"= c:\program files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{77F7A492-1799-44F1-B80C-037235E560D1}"= c:\program files\Dell\MediaDirect\MediaDirect.exe
ell MediaDirect
"{9EDD1F83-D909-4FAF-8D6B-5B2FDCCF32CE}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{CC0FB4BF-37EC-46A3-B634-63FA39F4DC32}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{5FB00F5D-7574-4A81-929A-4FC97AB31276}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{F6412E22-5B8D-4ED6-A321-83E222B09F61}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{9405A2FD-7F81-4A9D-A1F5-AE624C16EF70}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{25D6511C-ACED-4EE4-9327-4BAB73FE8CB0}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{21188D71-5C98-4DAD-B693-0B6A5F51E915}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5F5DD065-AABB-4EDC-92C4-0AB553499B11}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{16E13410-F671-4D22-A88B-F85ECA80320A}"= c:\program files\Skype\Phone\Skype.exe
kype
"{6451C3EB-46F1-4B66-AB10-C4A1F98A97AC}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{8A1586D7-4FE4-4F1B-B60C-E050A9BDBF23}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{163DEEAB-E529-41D6-B122-5295D8E23C75}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{471792F3-D466-4FF8-80AD-50FE5A3801ED}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B44CEC57-FF71-438F-B98A-86E6DF4DBB93}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{A8FD7402-2007-4035-9CF9-850D14DBE92E}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{C1EDA8F7-2D55-4F8D-BC4C-6506C7843E52}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{DA50D5D1-175A-4921-BCBE-BF42C0AF33FF}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{60FAFF5E-A181-4954-8BB5-ECA914800D8C}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{397C4D08-E828-4CB5-BE3B-AA64C52EA57E}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7AF0607E-EAE0-4F87-AE99-4A136AE9848C}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\FlashFXP\\FlashFXP.exe"= c:\program files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [1/08/2008 12:36 73728]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [28/04/2008 16:56 161048]
R2 KotNET AutoLogin Service;KotNET AutoLogin Service;c:\program files\CuSo4\KotNET AutoLogin 3.0\Be.Cuso4.Kotnet.AutoLogin.Service.exe [8/11/2007 13:26 77824]
R2 SSPORT;SSPORT;c:\windows\System32\drivers\SSPORT.SYS [30/09/2008 18:12 5120]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [25/01/2008 16:40 85520]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [1/08/2008 20:30 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [1/08/2008 20:30 7424]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16/08/2009 15:56 133104]
S3 BulkUsb;VoIPUSBDriver.sys;c:\windows\System32\drivers\VoIPUSBDriver.sys [16/09/2005 16:14 149504]
S3 SNPPRO;USB PC Camera (snppro);c:\windows\System32\drivers\snppro.sys [13/08/2008 22:48 10186496]
S4 iaNvStor;Intel(R) Turbo Memory Controller;c:\windows\System32\drivers\iaNvStor.sys [1/08/2008 20:30 209408]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
bdx REG_MULTI_SZ scan
.
Inhoud van de 'Gedeelde Taken' map
2009-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-16 07:35]
2009-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-16 07:35]
2009-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-652352353-311927663-4269263483-1000Core.job
- c:\users\Arne Vanhoof\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-18 14:43]
2009-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-652352353-311927663-4269263483-1000UA.job
- c:\users\Arne Vanhoof\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-18 14:43]
2009-08-19 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
2009-08-20 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.be/
uInternet Settings,ProxyOverride = *.local
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
LSP: c:\windows\system32\idmmbc.dll
FF - ProfilePath - c:\users\Arne Vanhoof\AppData\Roaming\Mozilla\Firefox\Profiles\vfob3l90.default\
FF - prefs.js: browser.search.selectedEngine - GoogIe
FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/
FF - prefs.js: keyword.URL - hxxp://www.pageden.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=fiqaNw7f&q=
FF - component: c:\program files\Mozilla Firefox\components\pbgk1_9.dll
FF - component: c:\users\Arne Vanhoof\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\users\Arne Vanhoof\AppData\Roaming\Mozilla\Firefox\Profiles\vfob3l90.default\extensions\
[email protected]\components\pbgk1_9.dll
FF - plugin: c:\program files\Google\Google Earth Plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\Arne Vanhoof\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
FF - user.js: browser.search.selectedEngine - GoogIe
FF - user.js: keyword.URL - hxxp://www.pageden.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=fiqaNw7f&q=
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-08-20 23:00
Windows 6.0.6001 Service Pack 1 NTFS
scannen van verborgen processen ...
scannen van verborgen autostart items ...
scannen van verborgen bestanden ...
Scan succesvol afgerond
verborgen bestanden: 0
**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
- - - - - - - > 'Explorer.exe'(3620)
c:\program files\Protector Suite QL\farchns.dll
c:\program files\Protector Suite QL\infql2.dll
c:\windows\system32\btncopy.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\windows\System32\audiodg.exe
c:\windows\System32\wlanext.exe
c:\program files\Protector Suite QL\upeksvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\System32\stacsv.exe
c:\program files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2008\vsserv.exe
.
**************************************************************************
.
Voltooingstijd: 2009-08-20 23:12 - machine werd herstart
ComboFix-quarantined-files.txt 2009-08-20 21:11
Pre-Run: 27.163.049.984 bytes beschikbaar
Post-Run: 27.825.266.688 bytes beschikbaar
393 --- E O F --- 2009-08-19 21:20