websites laden niet in gelijk welke browser maar andere internettoepassingen werken w

Sarah_V · 8 november 2009

ComboFix 09-11-07.02 - HP_Eigenaar 08/11/2009 13:28.4.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1023.604 [GMT 1:00]

Gestart vanuit: c:\documents and settings\HP_Eigenaar\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\HP_Eigenaar\Bureaublad\CFScript.txt

AV: Norton Internet Security 2006 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::

"c:\windows\system32\nssm.exe"

"c:\windows\system32\winback.exe"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\McAfee

c:\documents and settings\All Users\Application Data\McAfee\MCLOGS\Common\McUICnt\McUICnt000.log

c:\documents and settings\All Users\Application Data\McAfee\MCLOGS\McUICnt\McUICnt\McUICnt000.log

c:\windows\system32\nssm.exe

c:\windows\system32\winback.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-10-08 to 2009-11-08 ))))))))))))))))))))))))))))))

.

2009-11-06 19:18 . 2009-11-06 19:18 -------- d-----w- c:\documents and settings\HP_Eigenaar\Application Data\Malwarebytes

2009-11-06 19:18 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-06 19:18 . 2009-11-06 19:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-06 19:18 . 2009-11-06 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-11-06 19:18 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-05 23:10 . 2009-11-06 21:31 -------- d-----w- c:\program files\SeaMonkey

2009-11-05 17:17 . 2009-11-05 17:17 -------- d-----w- c:\program files\Trend Micro

2009-11-04 21:04 . 2009-11-04 21:04 -------- d-----w- c:\documents and settings\HP_Eigenaar\Application Data\AVG8

2009-11-04 20:52 . 2009-11-04 20:52 -------- d-----w- c:\documents and settings\HP_Eigenaar\Local Settings\Application Data\Threat Expert

2009-11-04 20:29 . 2009-11-04 20:55 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-11-04 16:21 . 2009-11-04 16:21 -------- d-----w- c:\windows\system32\wbem\Repository

2009-11-04 16:20 . 2009-11-04 16:20 -------- d-----w- c:\program files\Mplayer

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-08 12:19 . 2004-12-03 03:15 569464 ----a-w- c:\windows\system32\perfh013.dat

2009-11-08 12:19 . 2004-12-03 03:15 117868 ----a-w- c:\windows\system32\perfc013.dat

2009-11-07 22:21 . 2006-10-09 13:37 -------- d-----w- c:\program files\Steam

2009-11-07 21:19 . 2006-10-10 22:41 132008 ----a-w- c:\documents and settings\HP_Eigenaar\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-11-07 19:58 . 2009-11-07 19:58 -------- d-----w- c:\program files\CCleaner

2009-11-04 16:19 . 2006-10-07 22:55 -------- d-----w- c:\documents and settings\HP_Eigenaar\Application Data\CoreFTP

2009-11-04 16:15 . 2006-10-06 14:22 -------- d-----w- c:\program files\Microsoft Works

2009-11-04 16:14 . 2007-03-11 10:24 -------- d-----w- c:\documents and settings\HP_Eigenaar\Application Data\dvdcss

2009-11-04 16:14 . 2009-09-16 22:10 -------- d-----w- c:\program files\iTunes

2009-11-04 16:14 . 2009-09-16 22:10 -------- d-----w- c:\program files\iPod

2009-11-04 16:14 . 2008-04-17 10:01 -------- d-----w- c:\program files\Common Files\Apple

2009-11-04 16:14 . 2009-09-16 22:07 -------- d-----w- c:\program files\QuickTime

2009-11-04 16:10 . 2006-10-08 13:27 -------- d-----w- c:\program files\Lexmark

2009-11-04 14:09 . 2006-06-15 10:28 -------- d-----w- c:\program files\Java

2009-11-03 23:40 . 2006-06-15 11:00 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-11-02 21:14 . 2008-09-29 09:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2009-10-31 18:50 . 2006-10-17 11:19 6172 ----a-w- c:\windows\system32\d3d9caps.dat

2009-10-29 00:27 . 2006-10-08 14:14 -------- d-----w- c:\program files\Sound Forge

2009-10-02 21:21 . 2008-02-27 09:22 -------- d-----w- c:\program files\Windows Live

2009-09-25 22:30 . 2007-11-16 23:32 -------- d-----w- c:\program files\Guitar Pro 5

2009-09-16 22:11 . 2009-09-16 22:10 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2009-09-16 22:02 . 2009-09-16 22:02 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.0.70\SetupAdmin.exe

2009-09-11 14:20 . 2004-08-03 21:00 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-09-11 14:20 . 2004-08-03 21:00 136192 ----a-w- c:\windows\system32\msv1_0(2)(2).dll

2009-09-04 21:05 . 2004-08-03 21:00 58880 ----a-w- c:\windows\system32\msasn1.dll

2009-09-04 21:05 . 2004-08-03 21:00 58880 ----a-w- c:\windows\system32\msasn1(2)(2).dll

2009-08-29 07:32 . 2004-08-03 21:00 832512 ----a-w- c:\windows\system32\wininet(2)(2).dll

2009-08-29 07:32 . 2004-08-03 21:00 832512 ------w- c:\windows\system32\wininet.dll

2009-08-29 07:32 . 2004-08-03 21:00 1168384 ----a-w- c:\windows\system32\urlmon(2)(2).dll

2009-08-29 07:32 . 2004-08-03 21:00 105984 ----a-w- c:\windows\system32\url(2)(2).dll

2009-08-29 07:32 . 2006-10-17 10:57 268288 ----a-w- c:\windows\system32\iertutil(3).dll

2009-08-29 07:32 . 2004-08-03 21:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2009-08-29 07:32 . 2004-08-03 21:00 17408 ----a-w- c:\windows\system32\corpol.dll

2009-08-26 08:02 . 2004-08-03 21:00 247326 ----a-w- c:\windows\system32\strmdll.dll

2009-08-16 22:51 . 2009-08-16 22:51 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\msxml6Exec.exe

2009-08-16 22:51 . 2009-08-16 22:51 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\Sleep.exe

2009-08-16 22:51 . 2009-08-16 22:51 3181612 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\vcredistExec.exe

2009-08-16 22:38 . 2009-08-16 22:51 24504088 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\NokiaSoftwareUpdaterSetup_nl[1].exe

.

((((((((((((((((((((((((((((( SnapShot@2009-11-08_01.10.59 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-11-08 12:15 . 2009-11-08 12:15 16384 c:\windows\Temp\Perflib_Perfdata_700.dat

+ 2009-11-08 12:15 . 2009-11-08 12:15 16384 c:\windows\Temp\Perflib_Perfdata_6c0.dat

+ 2004-12-03 03:15 . 2009-11-08 12:19 93540 c:\windows\system32\perfc009.dat

- 2004-12-03 03:15 . 2009-11-08 00:49 93540 c:\windows\system32\perfc009.dat

+ 2004-12-03 03:15 . 2009-11-08 12:19 495188 c:\windows\system32\perfh009.dat

- 2004-12-03 03:15 . 2009-11-08 00:49 495188 c:\windows\system32\perfh009.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]

"Google Update"="c:\documents and settings\HP_Eigenaar\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-12 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-02-13 7557120]

"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]

"PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2006-02-24 147456]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-13 663552]

"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-12-15 49152]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-06-15 180269]

"LXBLKsk"="c:\progra~1\Lexmark\PHOTOC~1\LXBLKsk.exe" [2003-03-26 282624]

"MemoryCardManager"="c:\program files\Lexmark\Lexmark Photo Center\MemoryCardManager.exe" [2003-04-28 122880]

"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2004-09-21 73728]

"USBToolTip"="c:\program files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2005-06-13 192512]

"PinnacleDriverCheck"="c:\windows\system32\\PSDrvCheck.exe" [2004-03-11 406016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-08 305440]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-03-08 16010240]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-02-13 1519616]

c:\documents and settings\Default User\Menu Start\Programma's\Opstarten\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-6-15 27136]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-10-8 113664]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=

"c:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=

"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=

"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=

"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=

"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=

"c:\\Program Files\\Steam\\SteamApps\\oudmetje\\counter-strike\\hl.exe"=

"c:\\Program Files\\Quake III Arena\\quake3.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Steam\\Steam.exe"=

"c:\\Program Files\\Shareaza\\Shareaza.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

R3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [15/06/2006 11:40 468768]

S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\Aspi32.sys [11/02/2007 17:53 16512]

S3 GNDHV71;Genius VideoCAM Live V2;c:\windows\system32\DRIVERS\gndhv71.sys --> c:\windows\system32\DRIVERS\gndhv71.sys [?]

S3 PLUsbbc2;Hi-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [6/10/2006 22:34 7936]

S3 Usblink;Usblink Driver;c:\windows\system32\drivers\ulink.sys [6/10/2006 22:35 40060]

--- Andere Services/Drivers In Geheugen ---

*Deregistered* - mbr

*Deregistered* - PROCEXP113

.

Inhoud van de 'Gedeelde Taken' map

2009-11-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27657144-3854435335-3181869771-1008Core.job

- c:\documents and settings\HP_Eigenaar\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-12 17:35]

2009-11-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27657144-3854435335-3181869771-1008UA.job

- c:\documents and settings\HP_Eigenaar\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-12 17:35]

2009-11-07 c:\windows\Tasks\OGADaily.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]

2009-11-08 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_BE&c=63&bd=PAVILION&pf=desktop

FF - ProfilePath - c:\documents and settings\HP_Eigenaar\Application Data\Mozilla\Firefox\Profiles\cs3i32f2.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/gitaarles

FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll

FF - plugin: c:\documents and settings\HP_Eigenaar\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll

FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-11-08 13:37

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

Voltooingstijd: 2009-11-08 13:40

ComboFix-quarantined-files.txt 2009-11-08 12:40

ComboFix2.txt 2009-11-08 01:13

ComboFix3.txt 2009-11-07 13:00

Pre-Run: 165.204.275.200 bytes beschikbaar

Post-Run: 165.314.342.912 bytes beschikbaar

- - End Of File - - F183811F1468094DA3B41017FECA36A1

---------- Post toegevoegd om 13:52 ---------- Vorige post was om 13:42 ----------

de java moet ik nog doen, tot zo met nog een nieuw combologje

Sarah_V · 8 november 2009

hier de combolog ná het verwijderen en installeren van Java

(PC & internet werken op dit moment soepel)

ComboFix 09-11-07.02 - HP_Eigenaar 08/11/2009 14:38.5.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1023.589 [GMT 1:00]

Gestart vanuit: c:\documents and settings\HP_Eigenaar\Bureaublad\ComboFix.exe

AV: Norton Internet Security 2006 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-10-08 to 2009-11-08 ))))))))))))))))))))))))))))))

.

2009-11-07 22:18 . 2009-11-08 12:41 -------- d--h--r- c:\documents and settings\HP_Eigenaar\Onlangs geopend