foutmelding

Hoi Huib.

Wat weet je toch veel.

ComboFix 13-03-27.01 - kooten 27-03-2013 14:34:52.1.2 - x86

Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.31.1043.18.2047.1043

Gestart vanuit: c:\users\kooten\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\POGCPAGH\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

c:\favoritevideo\InvisibleFolder

(((((((((((((((((((( Bestanden Gemaakt van 2013-02-27 to 2013-03-27 ))))))))))))))))))))))))))))))

2013-03-27 13:42 . 2013-03-27 13:42 ——– d—–w- c:\users\Default\AppData\Local\temp

2013-03-27 08:32 . 2013-03-27 08:32 ——– d—–w- c:\users\kooten\AppData\Roaming\FreemakeVideoDownloader

2013-03-27 08:29 . 2013-02-25 11:47 8013376 —-a-w- c:\program files\Internet Explorer\Microsoft.mshtml.dll

2013-03-26 06:39 . 2013-03-15 07:21 7108640 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BA51F2D2-600E-42D9-93EA-AF0E1AA800EB}\mpengine.dll

2013-03-24 09:51 . 2013-03-24 09:53 ——– d—–w- c:\users\kooten\AppData\Local\iLivid

2013-03-24 09:47 . 2013-03-24 09:47 ——– d—–w- c:\windows\system32\searchplugins

2013-03-24 09:47 . 2013-03-24 09:47 ——– d—–w- c:\windows\system32\Extensions

2013-03-24 09:47 . 2013-03-24 09:47 ——– d—–w- c:\users\kooten\AppData\Roaming\Babylon

2013-03-24 09:47 . 2013-03-24 09:47 ——– d—–w- c:\programdata\Babylon

2013-03-24 09:47 . 2013-03-24 09:47 ——– d—–w- c:\program files\Gophoto.it

2013-03-14 10:16 . 2013-03-14 10:16 ——– d—–w- c:\program files\RealNetworks

2013-03-14 10:16 . 2013-03-14 10:16 ——– d—–w- c:\programdata\RealNetworks

2013-03-14 10:15 . 2013-03-14 10:15 ——– d—–w- c:\program files\Common Files\xing shared

2013-03-13 11:07 . 2013-02-12 01:57 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys

2013-03-13 10:30 . 2013-03-13 11:28 ——– d—–w- c:\users\kooten\AppData\Roaming\IDM

2013-03-10 12:42 . 2013-03-10 12:47 ——– d—–w- c:\users\kooten\AppData\Roaming\Wise Registry Cleaner

2013-03-05 18:24 . 2013-03-05 18:24 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-03-05 18:24 . 2013-03-05 18:24 ——– d—–w- c:\program files\Java

2013-03-05 11:29 . 2013-03-05 11:31 ——– d—–w- c:\users\kooten\AppData\Roaming\jdast

2013-03-05 11:29 . 2013-03-05 11:29 ——– d—–w- c:\program files\JDAST

2013-03-04 10:25 . 2013-03-27 13:43 ——– d—–w- c:\users\kooten\AppData\Local\Temp

2013-03-03 16:37 . 2013-03-20 14:14 ——– d—–w- c:\program files\trend micro

2013-03-03 16:37 . 2013-03-03 16:38 ——– d—–w- C:\rsit

2013-03-03 16:27 . 2013-03-03 16:27 ——– d—–w- c:\programdata\Licenses

2013-03-01 16:52 . 2013-03-01 16:53 ——– d—–w- c:\program files\AppCleaner

2013-03-01 09:30 . 2013-03-06 23:33 164736 —-a-w- c:\windows\system32\drivers\aswVmm.sys

2013-03-01 09:30 . 2013-03-06 23:33 49248 —-a-w- c:\windows\system32\drivers\aswRvrt.sys

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

2013-03-16 12:04 . 2012-08-27 06:05 693976 —-a-w- c:\windows\system32\FlashPlayerApp.exe

2013-03-16 12:04 . 2012-08-27 06:05 73432 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-03-14 10:14 . 2012-12-13 17:41 499712 —-a-w- c:\windows\system32\msvcp71.dll

2013-03-14 10:14 . 2012-12-13 17:41 348160 —-a-w- c:\windows\system32\msvcr71.dll

2013-03-06 23:33 . 2012-08-26 18:26 368176 —-a-w- c:\windows\system32\drivers\aswSP.sys

2013-03-06 23:33 . 2012-08-26 18:26 49760 —-a-w- c:\windows\system32\drivers\aswRdr.sys

2013-03-06 23:33 . 2012-08-26 18:26 62376 —-a-w- c:\windows\system32\drivers\aswTdi.sys

2013-03-06 23:33 . 2012-08-26 18:26 765736 —-a-w- c:\windows\system32\drivers\aswSnx.sys

2013-03-06 23:33 . 2012-08-26 18:26 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys

2013-03-06 23:33 . 2012-08-26 18:26 29816 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys

2013-03-06 23:32 . 2012-08-26 18:25 41664 —-a-w- c:\windows\avastSS.scr

2013-03-06 23:32 . 2012-08-26 18:25 228600 —-a-w- c:\windows\system32\aswBoot.exe

2013-03-05 18:24 . 2012-08-27 08:42 782240 —-a-w- c:\windows\system32\deployJava1.dll

2013-03-05 18:24 . 2012-08-27 08:42 861088 —-a-w- c:\windows\system32\npDeployJava1.dll

2013-02-13 08:19 . 2013-02-13 08:19 102008 —-a-w- c:\windows\system32\drivers\RapportKELL.sys

2013-02-06 12:19 . 2013-02-06 12:19 1690784 —-a-w- c:\windows\system32\drivers\rt2870.sys

2013-01-24 10:46 . 2012-10-19 07:25 14664 —-a-w- c:\windows\stinger.sys

2013-01-24 10:24 . 2013-01-24 10:23 167344 —-a-w- c:\windows\system32\mfevtps.exe.a6e1.deleteme

2013-01-24 10:23 . 2013-01-24 10:23 167344 —-a-w- c:\windows\system32\mfevtps.exe.b191.deleteme

2013-01-17 00:28 . 2012-08-26 20:46 232336 ——w- c:\windows\system32\MpSigStub.exe

2013-01-05 05:26 . 2013-02-13 08:06 3602808 —-a-w- c:\windows\system32\ntkrnlpa.exe

2013-01-05 05:26 . 2013-02-13 08:06 3550072 —-a-w- c:\windows\system32\ntoskrnl.exe

2013-01-04 11:28 . 2013-02-13 08:06 905576 —-a-w- c:\windows\system32\drivers\tcpip.sys

2013-01-04 01:38 . 2013-02-13 08:06 2048512 —-a-w- c:\windows\system32\win32k.sys

2013-01-02 11:40 . 2012-08-26 18:13 241328 —-a-w- c:\windows\system32\RaCoInst.dll

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

2009-11-08 07:55 297808 —-a-w- c:\windows\System32\mscoree.dll

@=“{472083B0-C522-11CF-8763-00608CC02F24}”

2013-03-06 23:32 121968 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll

“AutoSizer”=“c:\program files\AutoSizer\AutoSizer.exe”

“ehTray.exe”=“c:\windows\ehome\ehTray.exe”

“avast”=“c:\program files\AVAST Software\Avast\avastUI.exe”

“TkBellExe”=“c:\program files\Real\RealPlayer\Update\realsched.exe”

“EnableUIADesktopToggle”= 0 (0x0)

“aux”=wdmaud.drv

@=“Service”

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Conceptronic Wireless Utility.lnk

backup=c:\windows\pss\Conceptronic Wireless Utility.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\users\kooten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk

backup=c:\windows\pss\FrostWire On Startup.lnk.Startup

backupExtension=.Startup

2012-10-11 20:56 59280 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

2012-11-23 08:22 307712 —-a-w- c:\program files\FileHippo.com\UpdateChecker.exe

2012-09-22 19:28 116648 —-atw- c:\users\kooten\AppData\Local\Google\Update\GoogleUpdate.exe

2012-12-08 17:54 421888 —-a-w- c:\program files\QuickTime\qttask.exe

2012-07-03 08:04 252848 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

2013-03-14 10:14 295512 —-a-w- c:\program files\Real\RealPlayer\Update\realsched.exe

2010-07-04 19:51 17408 —-a-w- c:\program files\Unlocker\UnlockerAssistant.exe

2008-01-18 21:38 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe

S1 A2DDA;A2 Direct Disk Access Support Driver;c:\users\kooten\Documents\EmsisoftEmergencyKit\Run\a2ddax86.sys

— Andere Services/Drivers In Geheugen —

*NewlyCreated* - NPF

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

2008-04-11 15:23 38400 —-a-w- c:\windows\System32\SoundSchemes.exe

2008-08-28 08:50 30720 —-a-w- c:\windows\System32\soundschemes2.exe

Inhoud van de ‘Gedeelde Taken’ map

2013-03-17 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

2013-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe

2013-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe

2013-03-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2896428252-2494772866-194625595-1000Core.job

- c:\users\kooten\AppData\Local\Google\Update\GoogleUpdate.exe

2013-03-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2896428252-2494772866-194625595-1000UA.job

- c:\users\kooten\AppData\Local\Google\Update\GoogleUpdate.exe

——- Bijkomende Scan ——-

uStart Page = about:blank

mStart Page = about:blank

mLocal Page = about:blank

mWindow Title = Microsoft Internet Explorer

TCP: DhcpNameServer = 62.179.104.196 213.46.228.196

DPF: {1C3DE665-D259-4C72-9D7D-C51FCB4CCFB9} - hxxp://92.63.3.218/SysCamInst.cab

DPF: {7F245E01-651F-48E5-8A85-4752EC65E4ED} - hxxp://www.brasserie-schaffhausen.ch/activex/Cisco210Viewer.cab

DPF: {96816368-C1E3-414D-A193-63C3CC921990} - hxxp://thebigchip.remotemanager.co.uk/common/activex/MJPEGRender.ocx

DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://webcam.salisbury.edu/activex/AMC.cab

DPF: {F3D4C08D-3616-43F0-9E29-44C749B0664B} - hxxp://tajima-airportterm.miemasu.net/JpegInst.cab

- - - - ORPHANS VERWIJDERD - - - -

Toolbar-10 - (no file)

SafeBoot-WudfPf

SafeBoot-WudfRd

MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

MSConfigStartUp-Advanced SystemCare 5 - c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe

MSConfigStartUp-Anti-phishing Domain Advisor - c:\programdata\Anti-phishing Domain Advisor\visicom_antiphishing.exe

MSConfigStartUp-emsisoft anti-malware - c:\program files\emsisoft anti-malware\a2guard.exe

MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

MSConfigStartUp-ToolwizCareFree - c:\program files\ToolwizCareFree\ToolwizCares.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-03-27 14:43

Windows 6.0.6002 Service Pack 2 NTFS

scannen van verborgen processen …

scannen van verborgen autostart items …

scannen van verborgen bestanden …

c:\windows\TEMP\TMP0000005D3EE2F7D148062C2D 524288 bytes

Scan succesvol afgerond

verborgen bestanden: 1

**************************************************************************

——————— VERGRENDELDE REGISTER SLEUTELS ———————

@Denied: (A 2) (Everyone)

@=“FlashBroker”

“LocalizedString”=“@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101”

“Enabled”=dword:00000001

@=“c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe”

@=“{FAB3E735-69C7-453B-A446-B6823C6DF1C9}”

@Denied: (A 2) (Everyone)

@=“IFlashBroker5”

@=“{00020424-0000-0000-C000-000000000046}”

@=“{FAB3E735-69C7-453B-A446-B6823C6DF1C9}”

“Version”=“1.0”

@=“?????????????????? v1”

@=“{E23FE9C6-778E-49D4-B537-38FCDE4887D8}”

@=“?????????????????? v2”

@=“{9BE31822-FDAD-461B-AD51-BE1D1C159921}”

——————— DLLs Geladen Onder Lopende Processen ———————

- - - - - - - > ‘Explorer.exe’(744)

c:\program files\AutoSizer\AutoSizer.dll

Voltooingstijd: 2013-03-27 14:45:48

ComboFix-quarantined-files.txt 2013-03-27 13:45

Pre-Run: 266.694.832.128 bytes beschikbaar

Post-Run: 266.698.829.824 bytes beschikbaar

- - End Of File - - CB2F6CA4E4AE6A4819A238CBD8A8BA85

Gr Koot.

fazantje

koot

fazantje

koot

koot

fazantje

koot

Ben

koot

fazantje