Kan niet downloaden

Roni · 18 oktober 2009

Beste Kape,

Ik heb inderdaad Combofix in één keer hebt laten "uitvoeren". Maar ja, ik kan ook niet anders he, want wat was ook alweer mijn probleem?

Wellicht kan ik Combofix op een usbstick zetten via een andere pc en dan installeren en uitvoeren op deze pc. Vervolgens zal ik hier dan weer een logje plaatsen.

Gr.

Roni

kape · 19 oktober 2009

Daar was inderdaad rekening mee gehouden, maar vraag was of het - in dit geval - wel zou lukken. Nee dus ... en dan is je idee om het via stick te proberen zeker het meest aangewezen.

Roni · 20 oktober 2009

Beste Kape,

Bij dezen mijn Combofix-log:

ComboFix 09-10-19.01 - Wim 20-10-2009 14:09.3.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.31.1043.18.3069.2001 [GMT 2:00]

Gestart vanuit: H:\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

SP: AVG Anti-Spyware *enabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604}

SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-09-20 to 2009-10-20 ))))))))))))))))))))))))))))))

.

2009-10-20 12:18 . 2009-10-20 12:18 -------- d-----w- c:\users\Public\AppData\Local\temp

2009-10-20 12:18 . 2009-10-20 12:18 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-10-20 12:18 . 2009-10-20 12:18 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2009-10-19 18:32 . 2009-03-08 11:32 72704 ----a-w- c:\windows\system32\admparse.dll

2009-10-16 00:51 . 2009-10-16 00:51 -------- d-----w- C:\08fc90103c293df422

2009-10-16 00:51 . 2009-10-16 00:51 -------- d-----w- c:\windows\CheckSur

2009-10-16 00:12 . 2009-08-31 13:55 428544 ----a-w- c:\windows\system32\EncDec.dll

2009-10-16 00:12 . 2009-08-31 13:55 293376 ----a-w- c:\windows\system32\psisdecd.dll

2009-10-16 00:11 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL

2009-10-16 00:11 . 2009-07-11 19:32 513024 ----a-w- c:\windows\system32\wlansvc.dll

2009-10-16 00:11 . 2009-07-11 19:32 302592 ----a-w- c:\windows\system32\wlansec.dll

2009-10-16 00:11 . 2009-07-11 19:32 293376 ----a-w- c:\windows\system32\wlanmsm.dll

2009-10-16 00:11 . 2009-07-11 19:29 127488 ----a-w- c:\windows\system32\L2SecHC.dll

2009-10-16 00:10 . 2009-09-10 17:30 213504 ----a-w- c:\windows\system32\msv1_0.dll

2009-10-16 00:07 . 2009-09-04 12:24 61440 ----a-w- c:\windows\system32\msasn1.dll

2009-10-16 00:06 . 2009-09-14 09:44 144896 ----a-w- c:\windows\system32\drivers\srv2.sys

2009-10-16 00:01 . 2009-10-19 18:35 -------- d-----w- c:\windows\system32\catroot2

2009-10-15 23:51 . 2009-10-15 23:51 -------- d-----w- c:\users\Wim\AppData\Local\WindowsUpdate

2009-10-15 23:16 . 2009-10-15 23:16 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-10-15 22:48 . 2009-10-15 23:16 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-10-15 22:48 . 2009-10-15 23:16 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-10-15 22:48 . 2009-10-19 22:01 -------- d-----w- c:\windows\system32\drivers\Avg

2009-10-15 22:48 . 2009-10-15 23:16 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-10-15 22:48 . 2009-10-15 23:08 -------- d-----w- c:\program files\AVG

2009-10-15 19:59 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-13 23:27 . 2009-10-13 23:27 -------- d-----w- c:\users\Administrator\Office Genuine Advantage

2009-10-10 23:45 . 2009-10-10 23:45 -------- d-----w- C:\Foxit Reader

2009-10-10 23:45 . 2009-10-10 23:45 -------- d-----w- C:\Foxit

2009-10-05 22:19 . 2009-10-05 22:19 -------- d-sh--w- C:\found.001

2009-10-04 22:08 . 2009-10-04 22:08 -------- d-sh--w- C:\found.000

2009-10-02 23:58 . 2009-10-01 08:29 195440 ------w- c:\windows\system32\MpSigStub.exe

2009-10-02 23:28 . 2009-10-02 23:28 -------- d-----w- c:\users\Administrator\AppData\Roaming\PC Suite

2009-09-24 00:46 . 2009-09-24 00:46 -------- d-----w- c:\users\Wim\Office Genuine Advantage

2009-09-22 21:56 . 2009-09-22 21:56 -------- d-----w- c:\programdata\Office Genuine Advantage

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-20 12:11 . 2006-11-02 16:11 714854 ----a-w- c:\windows\system32\perfh013.dat

2009-10-20 12:11 . 2006-11-02 16:11 148548 ----a-w- c:\windows\system32\perfc013.dat

2009-10-19 23:29 . 2007-06-06 11:40 -------- d-----w- c:\users\Wim\AppData\Roaming\Azureus

2009-10-19 10:32 . 2007-06-02 16:30 12931 ----a-w- c:\users\Wim\AppData\Roaming\nvModes.dat

2009-10-16 21:33 . 2008-11-18 20:34 13401 ----a-w- c:\users\Administrator\AppData\Roaming\nvModes.dat

2009-10-16 00:27 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2009-10-16 00:19 . 2007-06-03 01:25 -------- d-----w- c:\programdata\Microsoft Help

2009-10-15 23:14 . 2008-10-29 15:59 -------- d-----w- c:\programdata\avg8

2009-10-15 19:59 . 2008-06-20 17:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-13 23:50 . 2004-12-31 22:37 -------- d-----w- c:\program files\VS Revo Group

2009-10-13 22:59 . 2007-03-20 16:01 -------- d-----w- c:\program files\Java

2009-10-13 22:48 . 2008-09-11 23:56 -------- d-----w- c:\program files\Microsoft Silverlight

2009-10-13 19:55 . 2007-06-30 04:31 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-10-10 18:40 . 2007-06-02 14:22 114392 ----a-w- c:\users\Wim\AppData\Local\GDIPFONTCACHEV1.DAT

2009-10-10 00:56 . 2007-06-03 12:15 -------- d-----w- c:\program files\Common Files\Adobe

2009-10-10 00:02 . 2009-08-14 11:25 -------- d-----w- c:\programdata\NOS

2009-10-10 00:02 . 2009-08-14 11:25 -------- d-----w- c:\program files\NOS

2009-09-30 21:49 . 2007-06-03 12:25 -------- d-----w- c:\programdata\FLEXnet

2009-09-28 21:34 . 2009-03-03 20:38 -------- d-----w- c:\programdata\Google Updater

2009-09-17 23:49 . 2009-09-17 23:49 -------- d-----w- c:\programdata\Nokia

2009-09-17 23:48 . 2009-09-17 23:29 -------- d-----w- c:\program files\Common Files\Nokia

2009-09-17 23:48 . 2009-09-17 22:45 -------- d-----w- c:\program files\Nokia

2009-09-17 23:48 . 2009-09-17 23:22 -------- d-----w- c:\programdata\Installations

2009-09-17 23:44 . 2009-09-17 23:44 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf

2009-09-17 23:44 . 2009-09-17 22:45 -------- d-----w- c:\users\Wim\AppData\Roaming\PC Suite

2009-09-17 23:44 . 2009-09-17 23:36 -------- d-----w- c:\users\Wim\AppData\Roaming\Nokia

2009-09-17 23:44 . 2009-09-17 22:44 -------- d-----w- c:\programdata\PC Suite

2009-09-17 23:43 . 2009-09-17 23:43 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf

2009-09-17 23:29 . 2009-09-17 23:29 -------- d-----w- c:\program files\Common Files\PCSuite

2009-09-17 23:29 . 2009-09-17 22:44 -------- d-----w- c:\programdata\Downloaded Installations

2009-09-17 23:28 . 2009-09-17 23:28 -------- d-----w- c:\program files\DIFX

2009-09-17 23:27 . 2009-09-17 23:27 -------- d-----w- c:\program files\PC Connectivity Solution

2009-09-17 23:08 . 2009-09-17 23:08 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf

2009-09-10 12:53 . 2008-06-20 17:28 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-09 11:40 . 2009-03-03 20:37 -------- d-----w- c:\program files\Google

2009-08-28 12:39 . 2009-09-02 23:01 28672 ----a-w- c:\windows\system32\Apphlpdm.dll

2009-08-28 10:15 . 2009-09-02 23:01 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

2009-08-27 05:22 . 2009-10-19 18:34 916480 ----a-w- c:\windows\system32\wininet.dll

2009-08-27 05:17 . 2009-10-19 18:34 71680 ----a-w- c:\windows\system32\iesetup.dll

2009-08-27 05:17 . 2009-10-19 18:34 109056 ----a-w- c:\windows\system32\iesysprep.dll

2009-08-27 03:42 . 2009-10-19 18:34 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL

2009-08-14 17:07 . 2009-10-16 00:13 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys

2009-08-14 16:29 . 2009-10-16 00:13 104960 ----a-w- c:\windows\system32\netiohlp.dll

2009-08-14 16:29 . 2009-10-16 00:13 17920 ----a-w- c:\windows\system32\netevent.dll

2009-08-14 14:16 . 2009-10-16 00:13 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE

2009-08-14 14:16 . 2009-10-16 00:13 17920 ----a-w- c:\windows\system32\ROUTE.EXE

2009-08-14 14:16 . 2009-10-16 00:13 11264 ----a-w- c:\windows\system32\MRINFO.EXE

2009-08-14 14:16 . 2009-10-16 00:13 27136 ----a-w- c:\windows\system32\NETSTAT.EXE

2009-08-14 14:16 . 2009-10-16 00:13 19968 ----a-w- c:\windows\system32\ARP.EXE

2009-08-14 14:16 . 2009-10-16 00:13 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE

2009-08-14 14:16 . 2009-10-16 00:13 10240 ----a-w- c:\windows\system32\finger.exe

2009-08-05 14:22 . 2009-10-16 00:13 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-08-05 14:22 . 2009-10-16 00:13 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-08-03 13:07 . 2009-08-03 13:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll

2009-08-03 13:07 . 2009-08-03 13:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll

2009-08-03 13:07 . 2009-08-03 13:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe

2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

2009-05-08 18:29 . 2009-05-03 00:52 3394080 --sha-w- c:\windows\System32\drivers\fidbox.dat

.

((((((((((((((((((((((((((((( SnapShot@2009-09-24_20.19.31 )))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CollaborationHost"="c:\windows\system32\p2phost.exe" [2008-01-19 192000]

"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-12 5724184]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 234856]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2006-11-01 413696]

"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-19 411768]

"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]

"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-22 438272]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-20 1451304]

"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 34352]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]

"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2007-01-20 200704]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-13 90191]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-13 7766016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-13 81920]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-18 2025752]

"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-01-18 4349952]

c:\users\Wim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2008-7-9 547840]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-12 22:17 352256 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk]

backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup

backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Wim^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Azureus Turbo Accelerator.lnk]

backup=c:\windows\pss\Azureus Turbo Accelerator.lnk.Startup

backupExtension=.Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistrySmart

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-34793211-334541986-1737563230-1000]

"EnableNotifications"=dword:00000001

"EnableNotificationsRef"=dword:00000003

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [16-10-2009 0:48 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [16-10-2009 1:16 108552]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [3-9-2008 14:07 8944]

R1 SAS***IL;SAS***IL;c:\program files\SUPERAntiSpyware\SAS***IL.SYS [3-9-2008 14:07 55024]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [16-10-2009 0:48 908056]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [16-10-2009 0:48 297752]

R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [20-6-2008 13:02 810320]

S2 gupdate1c99c402a19f510;Google Updateservice (gupdate1c99c402a19f510);c:\program files\Google\Update\GoogleUpdate.exe [3-3-2009 22:39 133104]

S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\System32\drivers\nmwcdnsu.sys [19-3-2009 14:48 136704]

S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\System32\drivers\nmwcdnsuc.sys [19-3-2009 14:48 8320]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [3-9-2008 14:07 7408]

S4 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [3-3-2008 1:16 598856]

.

Inhoud van de 'Gedeelde Taken' map

2009-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 20:39]

2009-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-03 20:39]

2009-10-19 c:\windows\Tasks\User_Feed_Synchronization-{3DFA86B5-F43E-45A1-A7D9-F80458F098C6}.job

- c:\windows\system32\msfeedssync.exe [2009-10-19 03:41]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

mStart Page = hxxp://www.yahoo.com

uInternet Settings,ProxyOverride = *.local

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

.

- - - - ORPHANS VERWIJDERD - - - -

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-10-20 14:18

Windows 6.0.6001 Service Pack 1 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

C:\sccfg.sys 362 bytes

Scan succesvol afgerond

verborgen bestanden: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MEMSWEEP2]

"ImagePath"="\??\c:\windows\system32\9E65.tmp"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-34793211-334541986-1737563230-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AD5079CF-9D8B-CF87-F0BC-607E55733409}*]

"iafpkjhakbpblidlem"=hex:6a,61,62,70,6d,68,6d,68,66,65,6f,66,68,6d,6d,63,6c,62,

68,6d,00,00

"hadaamkljcfjnacl"=hex:6a,61,65,6f,70,67,6e,6d,69,63,67,63,62,63,68,64,66,65,

6a,6c,00,fb

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:0000007b

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Voltooingstijd: 2009-10-20 14:20

ComboFix-quarantined-files.txt 2009-10-20 12:20

ComboFix2.txt 2009-09-24 20:21

Pre-Run: 30.455.328.768 bytes beschikbaar

Post-Run: 34.908.487.680 bytes beschikbaar

- - End Of File - - C395CF6E6723934DBE603E8DAF2463B9

kape · 21 oktober 2009

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\p2phost.exe

Folder::

C:\found.001

C:\found.000

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CollaborationHost"=-

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis. En laat dan ook even weten of downloaden nu wel lukt ?

Roni · 22 oktober 2009

Beste Kape,

Het lukt nog steeds niet om downloads op te slaan.

Bij dezen mijn Combofix-log en de Hijack This log:

ComboFix 09-10-20.03 - Wim 22-10-2009 2:21.4.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.31.1043.18.3069.1823 [GMT 2:00]

Gestart vanuit: H:\ComboFix.exe

gebruikte Opdracht switches :: H:\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

SP: AVG Anti-Spyware *enabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604}

SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::

"c:\windows\system32\p2phost.exe"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\found.000

c:\found.000\dir0000.chk\EtwRTEventLog-Application.etl

c:\found.000\dir0000.chk\EtwRTEventLog-System.etl

C:\found.001

c:\found.001\file0000.chk

c:\users\Wim\AppData\Local\Temp\swt-win32-3346.dll

c:\windows\system32\p2phost.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-09-22 to 2009-10-22 ))))))))))))))))))))))))))))))

.

2009-10-22 00:28 . 2009-10-22 00:28 -------- d-----w- c:\users\Public\AppData\Local\temp

2009-10-22 00:28 . 2009-10-22 00:28 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-10-22 00:28 . 2009-10-22 00:28 -------- d-----w- c:\users\Administrator\AppData\Local\temp