ComboFix 08-08-19.02 - Sloetjes 2008-08-20 14:39:39.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.228 [GMT 2:00] Gestart vanuit: C:\Documents and Settings\Sloetjes\Bureaublad\ComboFix.exe * Nieuw herstelpunt werd aangemaakt * Resident AV is active [color=red][b]WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !![/b][/color] . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Sloetjes\Application Data\Microsoft\Internet Explorer\Quick Launch\PCPrivacyCleaner.lnk C:\Documents and Settings\Sloetjes\Cookies\sloetjes@2o7[1].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@ad.yieldmanager[2].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@bluestreak[1].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@ehg-adversitement.hitbox[2].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@ehg-reed.hitbox[2].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@ehg-upcchellomedia.hitbox[2].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@memo2.rhinocreations[3].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@sat.vodafone[2].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@stat.onestat[1].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@statcounter[1].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@tradedoubler[2].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@tsw0[1].txt C:\Documents and Settings\Sloetjes\Cookies\sloetjes@visit.kodak[1].txt C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\__c0058274.dat C:\WINDOWS\system32\__c00CF96C.dat . (((((((((((((((((((( Bestanden Gemaakt van 2008-07-20 to 2008-08-20 )))))))))))))))))))))))))))))) . 2008-08-20 14:15 . 2008-08-20 14:16 d-------- C:\WINDOWS\ERUNT 2008-08-20 14:11 . 2008-08-20 14:11 d-------- C:\SDFix 2008-07-24 09:13 . 2008-08-01 13:13 d-------- C:\Program Files\Avanquest update 2008-07-24 09:10 . 2008-08-01 13:15 d-------- C:\Program Files\Motorola Phone Tools 2008-07-24 09:10 . 2008-08-01 12:47 d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-07-20 14:15 . 2008-07-20 14:15 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-19 07:38 --------- d-----w C:\Program Files\Norton Security Scan 2008-08-19 07:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-24 07:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-06 18:32 --------- d-----w C:\Documents and Settings\Sloetjes\Application Data\Sony Corporation 2008-07-06 18:08 --------- d-----w C:\Program Files\Sony 2008-07-06 18:03 --------- d-----w C:\Documents and Settings\Sloetjes\Application Data\InstallShield 2008-07-03 08:47 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-07-03 08:47 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf 2008-07-03 08:47 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motccgp_01005.Wdf 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360] "NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL" [2003-07-28 15:19 49152] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-10 21:06 68856] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184] "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-07-28 15:19 4841472] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2003-07-28 15:19 49152] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-18 07:53 949376] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 01:06 487424] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "nwiz"="nwiz.exe" [2003-07-28 15:19 323584 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] C:\Documents and Settings\Sloetjes\Menu Start\Programma's\Opstarten\ Mediacontrole Picture Motion Browser.lnk - C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2008-07-06 20:11:38 385024] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Documents and Settings\\Sloetjes\\Bureaublad\\LimeWire\\LimeWire.exe"= "C:\\StubInstaller.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-04-02 22:13] S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 20:03] S3 se44bus;Sony Ericsson Device 068 driver (WDM);C:\WINDOWS\system32\DRIVERS\se44bus.sys [2006-11-30 14:58] S3 se44mdfl;Sony Ericsson Device 068 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se44mdfl.sys [2006-11-30 14:58] S3 se44mdm;Sony Ericsson Device 068 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se44mdm.sys [2006-11-30 14:58] S3 se44mgmt;Sony Ericsson Device 068 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se44mgmt.sys [2006-11-30 14:58] S3 se44nd5;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (NDIS);C:\WINDOWS\system32\DRIVERS\se44nd5.sys [2006-11-30 14:58] S3 se44obex;Sony Ericsson Device 068 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se44obex.sys [2006-11-30 14:58] S3 se44unic;Sony Ericsson Device 068 USB Ethernet Emulation SEMC44 (WDM);C:\WINDOWS\system32\DRIVERS\se44unic.sys [2006-11-30 14:58] . Inhoud van de 'Gedeelde Taken' map 2008-07-22 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42] 2008-08-13 C:\WINDOWS\Tasks\Norton Security Scan.job - C:\Program Files\Norton Security Scan\Nss.exe [2008-01-09 04:08] . - - - - ORPHANS REMOVED - - - - HKLM-Run-Cmaudio - cmicnfg.cpl Notify-d8eb80c3382 - C:\WINDOWS\system32\__c00CF96C.dat Notify-__c0058274 - C:\WINDOWS\system32\__c0058274.dat . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.google.nl/ O8 -: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 -: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 -: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 -: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O16 -: {36D04559-44B7-45E0-BA81-E1508FAB359F} - hxxp://unity3d.com/download_webplayer/UnityWebPlayer.cab C:\WINDOWS\Downloaded Program Files\UnityWebPlayer.inf . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-20 14:46:12 Windows 5.1.2600 Service Pack 2 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** . --------------------- DLLs Geladen Onder Lopende Processen --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\Eset\pr_imon.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\ESET\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe . ************************************************************************** . Voltooingstijd: 2008-08-20 14:52:31 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-20 12:52:28 Pre-Run: 15,608,856,576 bytes beschikbaar Post-Run: 16,471,216,128 bytes beschikbaar 146 --- E O F --- 2008-08-15 11:25:43