virus , alle beveiliging werkt niet meer !!!!!!

bij de eerste is het gelukt , nu staat nod 32 erop ,

ComboFix 09-03-02.01 - 2009-03-02 23:45:51.3 - FAT32x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1043.18.502.160

Gestart vanuit: c:\documents and settings\naam\Bureaublad\ComboFix.exe

AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)

* Nieuw herstelpunt werd aangemaakt

(((((((((((((((((((( Bestanden Gemaakt van 2009-02-02 to 2009-03-02 ))))))))))))))))))))))))))))))

2009-03-02 23:39 . 2009-03-02 23:39 d——– c:\windows\LastGood

2009-03-02 23:39 . 2009-03-02 23:39 d——– c:\program files\ESET

2009-03-02 23:39 . 2009-03-02 23:39 d——– c:\documents and settings\All Users\Application Data\ESET

2009-02-28 18:40 . 2009-02-28 18:40 dr-h—– c:\documents and settings\naam\Onlangs geopend

2009-02-27 13:54 . 2009-02-27 13:54 d–h—– C:\$AVG8.VAULT$

2009-02-27 11:07 . 2009-02-27 11:07 d——– c:\program files\Microsoft CAPICOM 2.1.0.2

2009-02-27 09:51 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll

2009-02-27 09:51 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui

2009-02-26 16:23 . 2009-02-26 16:23 d——– c:\program files\AVG

2009-02-25 16:56 . 2009-02-25 16:56 d——– c:\program files\Foxit Software

2009-02-25 16:46 . 2009-02-25 16:46 216 –a—— c:\windows\pdf2word.INI

2009-02-25 16:13 . 2009-02-25 16:13 d——– c:\program files\Investintech.com Inc

2009-02-25 14:14 . 2009-02-25 14:19 540 –a—— c:\windows\PSDCWIN.INI

2009-02-25 14:14 . 2009-02-25 14:18 448 –a—— c:\windows\PSDWIN.INI

2009-02-25 14:13 . 2009-02-25 14:13 d——– C:\PSDWIN

2009-02-23 21:02 . 2009-02-23 21:02 d——– c:\program files\M4P MP3 Converter

2009-02-23 20:32 . 2001-03-17 22:34 22,528 –a—— c:\windows\system32\WNASPI32.DLL

2009-02-23 20:32 . 2002-07-17 09:05 16,512 –a—— c:\windows\system32\drivers\ASPI32.SYS

2009-02-18 22:49 . 2009-02-18 22:49 d——– c:\program files\Easy Computing

2009-02-09 14:24 . 2009-02-09 14:24 d——– c:\program files\Svetlograd

2009-02-02 13:51 . 2009-02-02 13:51 d——– c:\program files\MSBuild

2009-02-02 13:45 . 2009-02-02 13:45 d——– c:\program files\Reference Assemblies

2009-02-02 13:45 . 2006-06-29 13:07 14,048 ——— c:\windows\system32\spmsg2.dll

2009-02-02 13:38 . 2009-02-02 13:38 d——– c:\documents and settings\All Users\Application Data\NokiaMusic

2009-02-02 13:35 . 2009-02-02 13:35 d——– c:\program files\DIFX

2009-02-02 13:35 . 2008-08-26 10:26 18,816 –a—— c:\windows\system32\drivers\pccsmcfd.sys

2009-02-02 13:34 . 2008-05-07 07:38 90,624 –a—— c:\windows\system32\nmwcdcls.dll

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-02-25 23:08 14,848 —-a-w c:\windows\system32\dllcache\register.exe

2009-01-28 15:29 ——— d—–w c:\program files\Sparkle

2009-01-17 19:10 ——— d—–w c:\documents and settings\All Users\Application Data\Babylon

2009-01-16 20:31 3,594,752 —-a-w c:\windows\system32\dllcache\mshtml.dll

2008-12-19 20:04 410,984 —-a-w c:\windows\system32\deploytk.dll

2008-12-19 09:13 70,656 —-a-w c:\windows\system32\dllcache\ie4uinit.exe

2008-12-19 09:10 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe

2008-12-19 05:25 634,024 —-a-w c:\windows\system32\dllcache\iexplore.exe

2008-12-19 05:23 161,792 —-a-w c:\windows\system32\dllcache\ieakui.dll

2008-12-11 10:57 333,952 ——w c:\windows\system32\dllcache\srv.sys

2008-09-09 19:21 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\Geschiedenis\History.IE5\MSHist012008090920080910\index.dat

2008-09-09 19:21 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

((((((((((((((((((((((((((((( SnapShot_2009-02-26_16.17.16.48 )))))))))))))))))))))))))))))))))))))))))

- 2006-03-17 19:53:34 167,936 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\accicons.exe

+ 2009-03-02 17:00:50 167,936 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\accicons.exe

- 2006-03-17 19:53:34 2,560 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\cagicon.exe

+ 2009-03-02 17:00:50 2,560 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\cagicon.exe

- 2006-03-17 19:53:34 34,304 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\misc.exe

+ 2009-03-02 17:00:50 34,304 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\misc.exe

- 2006-03-17 19:53:36 8,192 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\mspicons.exe

+ 2009-03-02 17:00:50 8,192 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\mspicons.exe

- 2006-03-17 19:53:36 3,584 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\opwicon.exe

+ 2009-03-02 17:00:50 3,584 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\opwicon.exe

- 2006-03-17 19:53:36 114,688 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\outicon.exe

+ 2009-03-02 17:00:50 114,688 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\outicon.exe

- 2006-03-17 19:53:34 16,384 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\PEicons.exe

+ 2009-03-02 17:00:50 16,384 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\PEicons.exe

- 2006-03-17 19:53:34 30,720 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\pptico.exe

+ 2009-03-02 17:00:50 30,720 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\pptico.exe

- 2006-03-17 19:53:36 22,528 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\unbndico.exe

+ 2009-03-02 17:00:50 22,528 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\unbndico.exe

- 2006-03-17 19:53:34 45,056 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\wordicon.exe

+ 2009-03-02 17:00:50 45,056 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\wordicon.exe

- 2006-03-17 19:53:34 90,112 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\xlicons.exe

+ 2009-03-02 17:00:50 90,112 —-a-r c:\windows\Installer\{91110413-6000-11D3-8CFE-0050048383C9}\xlicons.exe

+ 2009-03-02 22:40:22 10,134 —-a-r c:\windows\Installer\{97C5184E-0FB4-4B56-B38E-94BC2E54E015}\callmsi.exe

+ 2009-03-02 22:40:22 136,448 —-a-r c:\windows\Installer\{97C5184E-0FB4-4B56-B38E-94BC2E54E015}\egui.exe

- 2001-01-22 02:25:24 32,768 —-a-w c:\windows\system32\ATHPRXY.DLL

+ 2004-01-29 06:08:24 32,768 —-a-w c:\windows\system32\ATHPRXY.DLL

+ 2008-07-01 07:56:22 39,944 —-a-w c:\windows\system32\drivers\eamon.sys

+ 2008-07-01 07:57:14 53,256 —-a-w c:\windows\system32\drivers\easdrv.sys

+ 2008-07-01 08:04:40 34,312 —-a-w c:\windows\system32\drivers\epfwtdir.sys

- 1999-10-18 03:01:42 1,129,232 —-a-w c:\windows\system32\FM20.DLL

+ 2003-09-25 11:07:00 1,139,472 —-a-w c:\windows\system32\FM20.DLL

- 2001-03-27 09:57:28 29,968 —-a-w c:\windows\system32\FM20NLD.DLL

+ 2003-10-13 22:08:30 28,672 —-a-w c:\windows\system32\FM20NLD.DLL

- 2005-05-26 03:19:32 178,408 —-a-w c:\windows\system32\muweb.dll

+ 2008-10-16 13:06:48 208,744 —-a-w c:\windows\system32\muweb.dll

+ 2009-03-02 22:29:32 16,384 —-a-w c:\windows\TEMP\Perflib_Perfdata_1b8.dat

– Snapshot teruggezet naar huidige datum –

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe”

“MSMSGS”=“c:\program files\Messenger\msmsgs.exe”

“EPSON Stylus DX3800 Series”=“c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE”

“preload”=“c:\windows\RUNXMLPL.exe”

“IgfxTray”=“c:\windows\system32\igfxtray.exe”

“HotKeysCmds”=“c:\windows\system32\hkcmd.exe”

“SynTPLpr”=“c:\program files\Synaptics\SynTP\SynTPLpr.exe”

“SynTPEnh”=“c:\program files\Synaptics\SynTP\SynTPEnh.exe”

“EPM-DM”=“c:\acer\epm\epm-dm.exe”

“ePowerManagement”=“c:\acer\ePM\ePM.exe”

“IMJPMIG8.1”=“c:\windows\IME\imjp8_1\IMJPMIG.EXE”

“MSPY2002”=“c:\windows\system32\IME\PINTLGNT\ImScInst.exe”

“PHIME2002ASync”=“c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE”

“PHIME2002A”=“c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE”

“PCMService”=“c:\program files\Arcade\PCMService.exe”

“LaunchAp”=“c:\program files\Launch Manager\LaunchAp.exe”

“PowerKey”=“c:\program files\Launch Manager\PowerKey.exe”

“LManager”=“c:\program files\Launch Manager\HotkeyApp.exe”

“CtrlVol”=“c:\program files\Launch Manager\CtrlVol.exe”

“LMgrOSD”=“c:\program files\Launch Manager\OSDCtrl.exe”

“Wbutton”=“c:\program files\Launch Manager\Wbutton.exe”

“eRecoveryService”=“c:\program files\Acer\eRecovery\Monitor.exe”

“EPSON Stylus DX3800 Series”=“c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE”

“Adobe Photo Downloader”=“c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

“QuickTime Task”=“c:\program files\QuickTime\qttask.exe”

“SunJavaUpdateSched”=“c:\program files\Java\jre6\bin\jusched.exe”

“egui”=“c:\program files\ESET\ESET NOD32 Antivirus\egui.exe”

“SoundMan”=“SOUNDMAN.EXE”

“BluetoothAuthenticationAgent”=“bthprops.cpl”

“Logitech Hardware Abstraction Layer”=“KHALMNPR.EXE”

“Kernel and Hardware Abstraction Layer”=“KHALMNPR.EXE”

“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE”

c:\documents and settings\naam\Menu Start\Programma's\Opstarten\

OpenOffice.org 2.4 .lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE

Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe

BTTray.lnk - c:\program files\Sitecom\Bluetooth Software\BTTray.exe

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe

Adobe Reader Snelle start.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

“vidc.xvid”= xvid.dll

@=“”

“%windir%\\system32\\sessmgr.exe”=

“c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe”=

“c:\program files\Microsoft ActiveSync\rapimgr.exe”= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

“c:\program files\Microsoft ActiveSync\WCESMgr.exe”= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

“c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe”=

“c:\\Program Files\\eMule\\emule.exe”=

“c:\\Program Files\\PopCap Games\\Zuma Deluxe\\Zuma.exe”=

“%windir%\\Network Diagnostic\\xpnetdiag.exe”=

“26675:TCP”= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys

R1 Hotkey;Hotkey;c:\windows\system32\drivers\HOTKEY.sys

R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe

R2 EpmPsd;Acer EPM Power Scheme Driver;c:\windows\system32\drivers\epm-psd.sys

R2 EpmShd;Acer EPM System Hardware Driver;c:\windows\system32\drivers\epm-shd.sys

R2 osaio;osaio;c:\windows\system32\drivers\osaio.sys

R2 osanbm;osanbm;c:\windows\system32\drivers\osanbm.sys

R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS

S1 mailKmd;mailKmd;

S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS

S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys

S3 ZD1211BU(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);c:\windows\system32\drivers\ZD1211BU.sys

— Andere Services/Drivers In Geheugen —

*NewlyCreated* - EAMON

*NewlyCreated* - EASDRV

*NewlyCreated* - EKRN

*NewlyCreated* - EPFWTDIR

Inhoud van de ‘Gedeelde Taken’ map

2009-03-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe

- - - - ORPHANS VERWIJDERD - - - -

Notify-avgrsstarter - avgrsstx.dll

——- Bijkomende Scan ——-

uStart Page = hxxp://www.startpagina.nl/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = “c:\program files\MSN Gaming Zone\Windows\bckgzm.exe”

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Verzenden naar &Bluetooth - c:\program files\Sitecom\Bluetooth Software\btsendto_ie_ctx.htm

DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab

DPF: {91F52A42-C10D-49A7-B941-882C657C604F} - hxxp://kitcentral.wanadoo.nl/download/install/win32/nl/instwact/instwact.dll

DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} - file:///E:/CDVIEWER/CdViewer.cab

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-02 23:48:20

Windows 5.1.2600 Service Pack 3 FAT NTAPI

scannen van verborgen processen …

scannen van verborgen autostart items …

scannen van verborgen bestanden …

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

——————— VERGRENDELDE REGISTER SLEUTELS ———————

“Name”=“ActiveSync”

“DisplayName”=“Microsoft ActiveSync”

“Param1”=“ActiveSync”

“Param2”=“”

“Type”=“wellknown”

“Order”=dword:00000000

“State”=dword:0000000b

“Name”=“oemDesktop1”

“DisplayName”=“Acrobat Reader for PC”

“Param1”=“oem\\APP\\AdbeRdr705_nld_full.exe”

“Param2”=“”

“Type”=“createprocess”

“Order”=dword:00000000

“State”=dword:0000001b

Voltooingstijd: 2009-03-02 23:50:16

ComboFix-quarantined-files.txt 2009-03-02 22:50:10

ComboFix2.txt 2008-06-22 20:28:30

Pre-Run: 4.049.944.576 bytes beschikbaar

Post-Run: 4,086,300,672 bytes beschikbaar

227 — E O F — 2009-03-02 17:00:49

Huib

maria

maria

Huib

maria

Huib

maria

Huib

maria

Teaser