AnnieW

Op dit moment geen meldingen meer van Windows defender dus ik denk dat probleem is opgelost.

[ATTACH]37559[/ATTACH] zoek-results.txt

[ATTACH]37556[/ATTACH] log.txt

[ATTACH]37554[/ATTACH] AdwCleaner[S0].txt

Ik heb de scan gedraaid en zie hier het resultaat van het Scanlogboek: Malwarebytes Anti-Malware Malwarebytes | Free Anti-Malware & Internet Security Software Scandatum: 18-11-2014 Scantijd: 04:03:21 Logbestand: MBAM Scanlog.txt Beheerder: Ja Versie: 0.00.0.0000 Malwaredatabase: v2014.11.18.02 Rootkitdatabase: v2014.11.12.01 Licentie: Proef Malwarebescherming: Ingeschakeld Kwaadaardige Website Bescherming: Ingeschakeld Zelfbescherming: Uitgeschakeld Besturingssysteem: Windows 8.1 Processor: x64 Bestandssysteem: NTFS Gebruiker: Gebruiker Scantype: Aangepaste Scan Resultaat: Voltooid Objecten Gescand: 767122 Verstreken Tijd: 5 u, 29 m, 12 s Geheugen: Ingeschakeld Opstarten: Ingeschakeld Bestandssysteem: Ingeschakeld Archieven: Ingeschakeld Rootkits: Ingeschakeld Heuristiek: Ingeschakeld POP: Ingeschakeld POA: Ingeschakeld Processen: 0 (Geen kwaadaardige items gedetecteerd) Modules: 0 (Geen kwaadaardige items gedetecteerd) Registersleutels: 0 (Geen kwaadaardige items gedetecteerd) Registerwaardes: 0 (Geen kwaadaardige items gedetecteerd) Registerdata: 0 (Geen kwaadaardige items gedetecteerd) Mappen: 0 (Geen kwaadaardige items gedetecteerd) Bestanden: 0 (Geen kwaadaardige items gedetecteerd) Fysieke Sectoren: 0 (Geen kwaadaardige items gedetecteerd) (end)

Zie de bijlage[ATTACH]37522[/ATTACH] log.txt

Ik heb sinds een jaar een nieuwe PC met Windows 8.1. Heb de Virusscanner van Ziggo ingesteld en dacht hiermee goed beveiligd te zijn. Nu blijk ik toch allerlei malware etc. op mijn PC te hebben gekregen, hoe weet ik niet. Windows defender ziet het probleem en ruimt op maar zodra de PC opnieuw opgestart is is het probleem er weer. Ik heb daarom gezocht naar een gratis programma om dit te verwijderen en kwam op Spyhunter uit. Hij heeft uren staan draaien en kwam met als resultaat 37 bedreigingen. Het gaat om de volgende malware: Allin1Convert.toolbar 10 bedreigingen Adserver: 3 Adtech: 1 Atlas DMT: 14 Atwola: 1 Pro Market: 5 Tribal Fusion: 1 Weborama: 2 Zodra ik echter de bedreigingen wilde gaan repareren blijkt het programma niet meer gratis te zijn en moet ik me eerst registreren voor een bedrag van € 36,29. Op zich vind ik dit nog niet zo'n probleem als ik maar zeker van kan zijn dat het een betrouwbaar programma is en ik niet nog meer rommel binnen haal. Omdat ik een paar jaar geleden met mijn oude PC ook zoiets aan de hand gehad heb en jullie mijn probleem toen hebben opgelost, wend ik me toch weer tot jullie met de vraag wat ik het beste kan doen. Wellicht kunnen jullie mij nu weer helpen. Graag een reactie en bij voorbaat mijn dank.

Ja dat heb ik in het begin al een keer gedaan op aanraden van jullie, maar toen kon ik helemaal niet meer het Internet op en heb ik heel veel handelingen moeten verrichten om weer zo ver te komen. Dus ik durf dat eigenlijk niet meer te proberen.......... Ik werk voortaan wel met Firefox, even wennen maar dan kan ik in elk geval weer bijlagen downloaden....

Ik had als standaard browser altijd IE maar heb nu Firefox ingeschakeld als standaard browser, en hiermee kan ik nu wel de bijlagen downloaden. Met IE nog steeds niet......

Google Chrome staat niet meer op mijn computer, ik weet niet meer of ik het toen meteen verwijderd heb of pas later.... Ik heb alleen nog Google Desktop; Google Earth Plug-in en Google Update op de laptop staan. Ik heb op een of andere manier met het downloaden van Google Chrome toen ook het programma Sweetim.com op mijn PC gekregen en dat was heel irritant. Maar heel moeilijk te verwijderen, dus misschien dat dat er nog mee te maken heeft?? Als ik nu bij zoekopdracht Sweetim intyp krijg ik nog steeds "Registervermelding cc_20120625_131511. Verder zou ik het niet meer weten.....

Ik gebruik geen mailprogramma, ik log rechtstreeks in op www.gmail.com. Ik heb naast mijn emailadres van gmail ook mijn emailadres van quicknet (Ziggo) en deze wordt doorgeleid naar Gmail. Dat werkte altijd prima en tot een paar maanden terug kon ik alle bijlagen gewoon openen. Op mijn andere PC werkt het nog steeds goed dus daar kan het niet in zitten. De ellende is volgens mij begonnen toen ik GoogleChrome wilde downloaden.

Bovenstaande opdrachten allemaal uitgevoerd, en nu verder?? (Ik kan nog steeds geen bijlagen downloaden uit mijn mail....)

[ATTACH]19429[/ATTACH] In Firefox kon ik de opgegeven bestanden niet vinden. Ik heb daqarna met de zoekopdracht gezocht naar DealPly en de volgende bestanden gevonden, zie de bijlage. Ik heb er nog niets mee gedaan dus........... bijlage PCHelpforum 25-6.docx

ComboFix 12-06-24.03 - Annie Wissink 25-06-2012 9:09.3.2 - x86 Gestart vanuit: c:\users\Annie Wissink\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\Annie Wissink\Desktop\CFScript.txt . . (((((((((((((((((((( Bestanden Gemaakt van 2012-05-25 to 2012-06-25 )))))))))))))))))))))))))))))) . . 2012-06-25 07:22 . 2012-06-25 07:22 -------- d-----w- c:\users\Annie Wissink\AppData\Local\temp 2012-06-25 07:22 . 2012-06-25 07:22 -------- d-----w- c:\users\McAfeeMVSUser\AppData\Local\temp 2012-06-25 07:22 . 2012-06-25 07:22 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-06-22 21:06 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-06-22 20:01 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-22 20:01 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll 2012-06-22 20:01 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-22 20:01 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll 2012-06-22 19:59 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll 2012-06-22 19:59 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll 2012-06-22 19:59 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll 2012-06-22 19:59 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-22 19:59 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe 2012-06-20 22:12 . 2012-06-18 01:14 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A7D640DB-89CF-4790-97DA-024AAD010ED1}\mpengine.dll 2012-06-20 21:41 . 2012-06-22 19:47 -------- d-----w- c:\program files\AVG Secure Search 2012-06-20 21:29 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll 2012-06-20 21:29 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll 2012-06-20 21:29 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll 2012-06-20 21:26 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-20 21:26 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys 2012-06-15 11:45 . 2012-06-15 11:45 -------- d-----w- c:\users\Annie Wissink\AppData\Roaming\Malwarebytes 2012-06-15 11:44 . 2012-06-15 11:44 -------- d-----w- c:\programdata\Malwarebytes 2012-06-15 11:44 . 2012-06-22 21:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2012-06-11 10:31 . 2012-06-11 19:14 -------- d-----w- C:\HiJackThis 2012-06-10 19:46 . 2012-06-10 19:46 -------- d-----w- c:\program files\Common Files\Java(148) 2012-06-07 13:40 . 2012-06-07 13:40 -------- d-----w- c:\users\Annie Wissink\AppData\Local\AVG Secure Search 2012-05-27 17:46 . 2012-05-27 18:54 -------- d-----w- c:\users\Annie Wissink\AppData\Roaming\Apple Computer 2012-05-27 17:46 . 2012-05-27 17:46 -------- d-----w- c:\users\Annie Wissink\AppData\Local\Apple Computer 2012-05-27 17:46 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-05-27 17:46 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll 2012-05-27 17:44 . 2012-05-27 17:44 -------- d-----w- c:\program files\iPod 2012-05-27 17:44 . 2012-05-27 17:46 -------- d-----w- c:\program files\iTunes 2012-05-27 17:44 . 2012-05-27 17:44 -------- d-----w- c:\programdata\Apple Computer 2012-05-27 17:42 . 2012-05-27 17:42 -------- d-----w- c:\users\Annie Wissink\AppData\Local\Apple 2012-05-27 17:42 . 2012-06-20 21:00 -------- d-----w- c:\program files\Apple Software Update 2012-05-27 17:39 . 2012-05-27 17:39 -------- d-----w- c:\program files\Bonjour 2012-05-27 17:39 . 2012-05-27 17:44 -------- d-----w- c:\program files\Common Files\Apple 2012-05-27 17:39 . 2012-05-27 17:42 -------- d-----w- c:\programdata\Apple . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-19 02:50 . 2012-04-19 02:50 24896 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2012-04-03 08:16 . 2012-05-10 16:10 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-03 08:16 . 2012-05-10 16:10 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-03-30 12:39 . 2012-05-10 16:10 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys 2010-06-19 16:08 . 2009-12-15 22:48 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-06-22 19:45 2068536 ----a-w- c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-06-22 2068536] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-14 16:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-10-01 107864] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "Samsung_AppInst"="f:\samsungsoftware\AppInst.exe" [bU] "YouSendIt.exe"="c:\program files\YouSendIt\Express\YouSendIt.exe" [bU] "Olympus ib"="c:\program files\Olympus\ib\olycamdetect.exe" [2011-03-11 93360] "AdobeBridge"="c:\program files\Adobe\Adobe Bridge CS5\Bridge.exe" [2010-03-09 11989960] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-06 68856] "KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-03-06 943504] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-04-02 21416] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040] "ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456] "CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-04-10 167936] "PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936] "RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456] "Skytel"="Skytel.exe" [2007-11-21 1826816] "PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600] "WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-19 30192] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-06 77824] "ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336] "Freecorder FLV Service"="c:\program files\Freecorder\FLVSrvc.exe" [2010-06-26 167936] "MDS_Menu"="c:\program files\Olympus\ib\MUITransfer\MUIStartMenu.exe" [2010-07-01 220336] "Olympus ib"="c:\program files\Olympus\ib\olycamdetect.exe" [2011-03-11 93360] "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] "AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992] "SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-06-22 1104440] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-13 138008] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-13 171288] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-13 172824] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-03-06 3508624] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . --- Andere Services/Drivers In Geheugen --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache bthsvcs REG_MULTI_SZ BthServ HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}] 2011-05-30 21:06 114176 ----a-w- c:\windows\System32\advpack.dll . Inhoud van de 'Gedeelde Taken' map . 2012-06-24 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-06 13:09] . 2012-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-23 13:10] . 2012-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-23 13:10] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.nl/ uDefault_Search_URL = hxxp://www.google.com/ie uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 212.54.40.25 212.54.35.25 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://photoservice.fujicolor.eu/ips-opdata/objects/jordan.cab DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab FF - ProfilePath - c:\users\Annie Wissink\AppData\Roaming\Mozilla\Firefox\Profiles\ekyvkqh7.default\ FF - prefs.js: browser.search.defaulturl - user_pref('extensions.dealply.partner', 'vita'); user_pref('extensions.dealply.channel', 'vitadownloadsoft'); user_pref('extensions.dealply.installId', 'v23500247419457494676952012050217072409'); user_pref('extensions.dealply.installIdSource', 'inst'); user_pref('extensions.dealply.sampleGroup', '9'); . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2012-06-25 09:22 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . HKCU\Software\Microsoft\Windows\CurrentVersion\Run Samsung_AppInst = f:\samsungsoftware\AppInst.exe????????p???????????????t??????????????????????????????????????????????????????????????????????????? . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2012-06-25 09:26:43 ComboFix-quarantined-files.txt 2012-06-25 07:26 ComboFix2.txt 2012-06-24 19:27 ComboFix3.txt 2012-06-23 22:38 ComboFix4.txt 2012-06-17 12:50 ComboFix5.txt 2012-06-25 07:06 . Pre-Run: 41.611.091.968 bytes beschikbaar Post-Run: 41.588.310.016 bytes beschikbaar . - - End Of File - - A1A3DF369A8117689D3E0D361290EB82

Ik hoop dat het goed gegaan is want nadat ik het txt.script in Combofix.exe gesleept had gaf ie aan dat er een updat was van het programma en toen heb ik op ja gedrukt, daarna is Combofix opnieuw opgestart. Zie hieronder de logfile: ComboFix 12-06-24.03 - Annie Wissink 24-06-2012 21:09:00.2.2 - x86 Gestart vanuit: c:\users\Annie Wissink\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\Annie Wissink\Desktop\CFScript.txt . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521} c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\DIFxAPI.dll c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\DifXInstall32.exe c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\DIFxInstallLog.txt c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\GEARAspiWDM.inf c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\gearaspiwdmx86.cat c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\x86\GEARAspi.dll c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\x86\GEARAspiWDM.sys c:\programdata\Ask c:\users\Annie Wissink\AppData\Local\Temp(326) c:\users\Annie Wissink\AppData\Local\Temp(326)\Annie Wissink.bmp c:\users\Annie Wissink\AppData\Local\Temp(326)\eDatasecurity\FileList.txt c:\users\McAfeeMVSUser\AppData\Local\Temp(348) . . (((((((((((((((((((( Bestanden Gemaakt van 2012-05-24 to 2012-06-24 )))))))))))))))))))))))))))))) . . 2012-06-24 19:22 . 2012-06-24 19:23 -------- d-----w- c:\users\Annie Wissink\AppData\Local\temp 2012-06-24 19:22 . 2012-06-24 19:22 -------- d-----w- c:\users\McAfeeMVSUser\AppData\Local\temp 2012-06-24 19:22 . 2012-06-24 19:22 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-06-22 21:06 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-06-22 20:01 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-22 20:01 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll 2012-06-22 20:01 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-22 20:01 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll 2012-06-22 19:59 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll 2012-06-22 19:59 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll 2012-06-22 19:59 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll 2012-06-22 19:59 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-22 19:59 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe 2012-06-20 22:12 . 2012-06-18 01:14 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A7D640DB-89CF-4790-97DA-024AAD010ED1}\mpengine.dll 2012-06-20 21:41 . 2012-06-22 19:47 -------- d-----w- c:\program files\AVG Secure Search 2012-06-20 21:29 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll 2012-06-20 21:29 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll 2012-06-20 21:29 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll 2012-06-20 21:26 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-20 21:26 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys 2012-06-15 11:45 . 2012-06-15 11:45 -------- d-----w- c:\users\Annie Wissink\AppData\Roaming\Malwarebytes 2012-06-15 11:44 . 2012-06-15 11:44 -------- d-----w- c:\programdata\Malwarebytes 2012-06-15 11:44 . 2012-06-22 21:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2012-06-11 10:31 . 2012-06-11 19:14 -------- d-----w- C:\HiJackThis 2012-06-10 19:46 . 2012-06-10 19:46 -------- d-----w- c:\program files\Common Files\Java(148) 2012-06-07 13:40 . 2012-06-07 13:40 -------- d-----w- c:\users\Annie Wissink\AppData\Local\AVG Secure Search 2012-05-27 17:46 . 2012-05-27 18:54 -------- d-----w- c:\users\Annie Wissink\AppData\Roaming\Apple Computer 2012-05-27 17:46 . 2012-05-27 17:46 -------- d-----w- c:\users\Annie Wissink\AppData\Local\Apple Computer 2012-05-27 17:46 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-05-27 17:46 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll 2012-05-27 17:44 . 2012-05-27 17:44 -------- d-----w- c:\program files\iPod 2012-05-27 17:44 . 2012-05-27 17:46 -------- d-----w- c:\program files\iTunes 2012-05-27 17:44 . 2012-05-27 17:44 -------- d-----w- c:\programdata\Apple Computer 2012-05-27 17:42 . 2012-05-27 17:42 -------- d-----w- c:\users\Annie Wissink\AppData\Local\Apple 2012-05-27 17:42 . 2012-06-20 21:00 -------- d-----w- c:\program files\Apple Software Update 2012-05-27 17:39 . 2012-05-27 17:39 -------- d-----w- c:\program files\Bonjour 2012-05-27 17:39 . 2012-05-27 17:44 -------- d-----w- c:\program files\Common Files\Apple 2012-05-27 17:39 . 2012-05-27 17:42 -------- d-----w- c:\programdata\Apple . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-19 02:50 . 2012-04-19 02:50 24896 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2012-04-03 08:16 . 2012-05-10 16:10 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-03 08:16 . 2012-05-10 16:10 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-03-30 12:39 . 2012-05-10 16:10 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys 2010-06-19 16:08 . 2009-12-15 22:48 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-06-22 19:45 2068536 ----a-w- c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-06-22 2068536] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-14 16:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-10-01 107864] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "Samsung_AppInst"="f:\samsungsoftware\AppInst.exe" [bU] "YouSendIt.exe"="c:\program files\YouSendIt\Express\YouSendIt.exe" [bU] "Olympus ib"="c:\program files\Olympus\ib\olycamdetect.exe" [2011-03-11 93360] "AdobeBridge"="c:\program files\Adobe\Adobe Bridge CS5\Bridge.exe" [2010-03-09 11989960] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-06 68856] "KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-03-06 943504] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-04-02 21416] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040] "ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-04-10 147456] "CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-04-10 167936] "PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-04-18 167936] "RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456] "Skytel"="Skytel.exe" [2007-11-21 1826816] "PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600] "WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-19 30192] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-06 77824] "ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336] "Freecorder FLV Service"="c:\program files\Freecorder\FLVSrvc.exe" [2010-06-26 167936] "MDS_Menu"="c:\program files\Olympus\ib\MUITransfer\MUIStartMenu.exe" [2010-07-01 220336] "Olympus ib"="c:\program files\Olympus\ib\olycamdetect.exe" [2011-03-11 93360] "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] "AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992] "SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-06-22 1104440] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-13 138008] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-13 171288] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-13 172824] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-03-06 3508624] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . --- Andere Services/Drivers In Geheugen --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache bthsvcs REG_MULTI_SZ BthServ HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}] 2011-05-30 21:06 114176 ----a-w- c:\windows\System32\advpack.dll . Inhoud van de 'Gedeelde Taken' map . 2012-06-24 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-06 13:09] . 2012-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-23 13:10] . 2012-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-23 13:10] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.nl/ uDefault_Search_URL = hxxp://www.google.com/ie uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: internet Trusted Zone: mcafee.com Trusted Zone: //about.htm/ Trusted Zone: //Exclude.htm/ Trusted Zone: //LanguageSelection.htm/ Trusted Zone: //Message.htm/ Trusted Zone: //MyAgttryCmd.htm/ Trusted Zone: //MyAgttryNag.htm/ Trusted Zone: //MyNotification.htm/ Trusted Zone: //NOCLessUpdate.htm/ Trusted Zone: //quarantine.htm/ Trusted Zone: //ScanNow.htm/ Trusted Zone: //strings.vbs/ Trusted Zone: //Template.htm/ Trusted Zone: //Update.htm/ Trusted Zone: //VirFound.htm/ Trusted Zone: mcafee.com\* Trusted Zone: mcafeeasap.com\betavscan Trusted Zone: mcafeeasap.com\vs Trusted Zone: mcafeeasap.com\www TCP: DhcpNameServer = 212.54.40.25 212.54.35.25 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://photoservice.fujicolor.eu/ips-opdata/objects/jordan.cab DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab FF - ProfilePath - c:\users\Annie Wissink\AppData\Roaming\Mozilla\Firefox\Profiles\ekyvkqh7.default\ FF - prefs.js: browser.search.defaulturl - user_pref('extensions.dealply.partner', 'vita'); user_pref('extensions.dealply.channel', 'vitadownloadsoft'); user_pref('extensions.dealply.installId', 'v23500247419457494676952012050217072409'); user_pref('extensions.dealply.installIdSource', 'inst'); user_pref('extensions.dealply.sampleGroup', '9'); . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2012-06-24 21:23 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . HKCU\Software\Microsoft\Windows\CurrentVersion\Run Samsung_AppInst = f:\samsungsoftware\AppInst.exe????????p???????????????t??????????????????????????????????????????????????????????????????????????? . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2012-06-24 21:27:06 ComboFix-quarantined-files.txt 2012-06-24 19:27 ComboFix2.txt 2012-06-23 22:38 ComboFix3.txt 2012-06-17 12:50 ComboFix4.txt 2012-06-15 16:12 . Pre-Run: 42.238.808.064 bytes beschikbaar Post-Run: 41.581.547.520 bytes beschikbaar . - - End Of File - - 316E745C677DFA599AB208C6B5DB551E