Doorzoek het forum
Zoeken met Startpagina
Startpagina Thema's
MANONNA
ComboFix 11-12-24.10 - MANONNA 25-12-2011 22:54:48.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.2037.997
Gestart vanuit: c:\users\MANONNA\Desktop\ComboFix.exe
gebruikte Opdracht switches :: c:\users\MANONNA\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-11-25 to 2011-12-25 ))))))))))))))))))))))))))))))
.
.
2011-12-25 21:22 . 2011-12-25 21:22 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB005053-922D-4B11-B5C6-A6F1C2827945}\offreg.dll
2011-12-23 11:44 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB005053-922D-4B11-B5C6-A6F1C2827945}\mpengine.dll
2011-12-18 16:36 . 2011-12-18 16:36 ——– d—–w- c:\users\MANONNA\AppData\Local\Messenger_Plus_Live
2011-12-18 16:26 . 2011-12-23 13:25 ——– d—–w- c:\program files\BrowserCompanion
2011-12-18 16:25 . 2011-12-19 20:51 ——– d—–w- c:\users\MANONNA\AppData\Local\Linkury
2011-12-14 18:39 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 18:39 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 18:39 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-14 18:39 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-14 18:39 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-14 18:39 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-14 18:39 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-30 21:13 . 2011-11-30 21:13 ——– d—–w- c:\users\MANONNA\AppData\Local\Deployment
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 18:01 . 2010-06-29 18:14 41184 —-a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2008-05-22 09:13 199816 —-a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-03-06 17:10 435032 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2008-05-22 09:14 314456 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2008-05-22 09:14 34392 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2008-05-22 09:14 52952 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2008-05-22 09:13 55128 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-11-28 17:51 . 2008-05-22 09:14 20568 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-22 19:29 . 2011-06-05 20:35 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-03 04:06 . 2010-05-01 07:52 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-11-22 19:34 . 2011-03-30 20:21 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
@=“{472083B0-C522-11CF-8763-00608CC02F24}”
2011-11-28 18:01 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
“ehTray.exe”=“c:\windows\ehome\ehTray.exe”
“IncrediMail”=“c:\program files\IncrediMail\bin\IncMail.exe”
“NTI Scheduler”=“c:\program files\Common Files\NewTech Infosystems\Scheduler\Schdlr32.exe”
.
“SynTPEnh”=“c:\program files\Synaptics\SynTP\SynTPEnh.exe”
“LManager”=“c:\progra~1\LAUNCH~1\LManager.exe”
“IntelliPoint”=“c:\program files\Microsoft IntelliPoint\ipoint.exe”
“IgfxTray”=“c:\windows\system32\igfxtray.exe”
“HotKeysCmds”=“c:\windows\system32\hkcmd.exe”
“Persistence”=“c:\windows\system32\igfxpers.exe”
“RtHDVCpl”=“RtHDVCpl.exe”
“Malwarebytes Anti-Malware (reboot)”=“c:\program files\Malwarebytes' Anti-Malware\mbam.exe”
“SunJavaUpdateSched”=“c:\program files\Common Files\Java\Java Update\jusched.exe”
.
“EnableUIADesktopToggle”= 0 (0x0)
.
“AppInit_DLLs”=c:\windows\System32\eNetHook.dll
.
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
.
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
2007-02-06 22:04 464168 —-a-w- c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe
.
2007-02-09 08:40 13312 —-a-w- c:\acer\Empowering Technology\eDSMSNfix.exe
.
2011-04-22 12:21 247728 —-a-w- d:\tomtom\TomTom HOME 2\TomTomHOMERunner.exe
.
2006-11-05 19:48 57344 —-a-w- c:\acer\WR_PopUp\WarReg_PopUp.exe
.
“DisableMonitoring”=dword:00000001
.
“DisableMonitoring”=dword:00000001
.
“DisableMonitoring”=dword:00000001
.
“EnableNotifications”=dword:00000001
“EnableNotificationsRef”=dword:00000002
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
S0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\System32\drivers\sfsync03.sys
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys
S1 aswSnx;aswSnx;
S1 aswSP;aswSP;
S2 aswFsBlk;aswFsBlk;
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe
S2 TomTomHOMEService;TomTomHOMEService;d:\tomtom\TomTom HOME 2\TomTomHOMEService.exe
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys
.
.
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
——- Bijkomende Scan ——-
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE: &Add animation to IncrediMail Style Box - c:\program files\IncrediMail\bin\resources\WebMenuImg.htm
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\MANONNA\AppData\Roaming\Mozilla\Firefox\Profiles\6x29b06f.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.startpagina.nl/
FF - prefs.js: keyword.URL - hxxp://www.plusnetwork.com/?sp=addr&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-25 23:06
Windows 6.0.6002 Service Pack 2 NTFS
.
scannen van verborgen processen …
.
scannen van verborgen autostart items …
.
scannen van verborgen bestanden …
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
——————— VERGRENDELDE REGISTER SLEUTELS ———————
.
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
“BlindDial”=dword:00000000
.
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
“BlindDial”=dword:00000000
.
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
“BlindDial”=dword:00000000
.
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
“BlindDial”=dword:00000000
.
Voltooingstijd: 2011-12-25 23:13:56
ComboFix-quarantined-files.txt 2011-12-25 22:13
.
Pre-Run: 16.598.130.688 bytes beschikbaar
Post-Run: 16.332.316.672 bytes beschikbaar
.
- - End Of File - - 3E31B62589EA90EC977ADF5DE26447DB
