spyware of virus probleem

marky marc · 14 mei 2010

Het lukt momenteel niet om combofix te draaien. Na opstart reageert pc niet meer (zeer traag) Is dit mogelijk doordat viper en mcafee elkaar tegenwerken ?? Ik heb in veilige modus mcafee al eens laten scannen (1 fout) maar zonder verbetering. Ik ben nu in veilige modus met viper aan het scannen.

Is het mogelijk om combofix te laten draaien in veilige modus.

kape · 14 mei 2010

Is het mogelijk om combofix te laten draaien in veilige modus.

Dat kan, ja !

marky marc · 14 mei 2010

kape

ik heb een combofix kunnen uitvoeren maar ik kan het voorlopig niet posten doordat ik niet kan werken buiten mijn veilige modus. Krijg viper niet in veilige modus verwijderd of afgezet.

marky marc · 14 mei 2010

gekozen om naar een vroeger herstelpunt te gaan . punt voordat ik viper gedownload hebt. Wat ook wel zal betekenen dat mijn generic ook terug aanwezig is.

combo:

ComboFix 10-05-07.07 - Marc 14/05/2010 20:13:50.14.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1022.546 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Marc\Bureaublad\ComboFix.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-04-14 to 2010-05-14 ))))))))))))))))))))))))))))))

.

2010-05-14 18:04 . 2010-05-14 18:04 -------- d-----w- c:\windows\system32\wbem\Repository

2010-05-14 17:38 . 2010-05-14 18:00 -------- d-----w- C:\ComboFix(2)

2010-05-12 13:23 . 2010-05-12 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Sunbelt

2010-05-12 13:23 . 2010-05-12 13:23 -------- d-----w- c:\documents and settings\Marc\Application Data\Sunbelt

2010-05-12 13:21 . 2010-05-12 13:21 -------- d-----w- c:\program files\Sunbelt Software

2010-05-01 09:01 . 2010-05-01 09:01 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore

2010-05-01 08:37 . 2010-05-01 08:37 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE

2010-05-01 08:37 . 2010-05-01 08:37 -------- d-----r- c:\documents and settings\NetworkService\Favorieten

2010-04-30 09:48 . 2010-04-30 09:48 388096 ----a-r- c:\documents and settings\Marc\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-04-30 09:48 . 2010-04-30 09:48 -------- d-----w- c:\program files\Trend Micro

2010-04-30 09:44 . 2010-04-30 09:45 182656 ----a-w- c:\windows\system32\dllcache\ndis.sys

2010-04-27 14:19 . 2010-04-27 14:19 -------- d-----w- c:\documents and settings\Marc\Application Data\Malwarebytes

2010-04-27 14:18 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-27 14:18 . 2010-04-27 14:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-27 14:18 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-27 14:18 . 2010-04-30 10:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-26 16:17 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys

2010-04-26 16:17 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys

2010-04-26 16:16 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-04-26 16:16 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys

2010-04-26 16:15 . 2010-04-26 16:15 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-14 18:04 . 2009-11-24 10:29 -------- d-----w- c:\program files\Everest Poker

2010-05-12 16:48 . 2008-10-22 17:04 -------- d-----w- c:\program files\USD

2010-05-12 15:41 . 2008-04-21 13:32 -------- d-----w- c:\documents and settings\Marc\Application Data\OpenOffice.org2

2010-05-12 13:26 . 2010-05-01 08:34 112 ----a-w- c:\documents and settings\All Users\Application Data\6pq0BV.dat

2010-05-10 11:24 . 2008-04-21 13:35 1 ----a-w- c:\documents and settings\Marc\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys

2010-05-05 18:15 . 2010-05-05 18:14 -------- d-----w- c:\program files\QuickTime

2010-05-03 14:17 . 2010-01-08 09:45 -------- d-----w- c:\program files\iTunes

2010-05-01 10:52 . 2005-12-15 01:52 -------- d-----w- c:\program files\Common Files\Sonic Shared

2010-05-01 09:57 . 2005-12-15 01:52 -------- d-----w- c:\program files\Sonic

2010-04-30 10:55 . 2010-04-30 10:55 6153352 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-04-30 09:45 . 2004-09-14 08:38 182656 ----a-w- c:\windows\system32\drivers\ndis.sys

2010-04-28 18:13 . 2007-03-21 14:42 -------- d-----w- c:\program files\McAfee

2010-04-11 15:47 . 2009-11-28 17:35 -------- d-----w- c:\program files\PokerStars

2010-04-09 14:44 . 2010-04-08 12:14 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-04-08 12:15 . 2010-04-08 12:15 1956656 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe

2010-03-28 11:40 . 2004-09-14 08:38 70312 ----a-w- c:\windows\system32\perfc013.dat

2010-03-28 11:40 . 2004-09-14 08:38 443522 ----a-w- c:\windows\system32\perfh013.dat

2010-03-10 06:17 . 2004-09-14 08:38 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-02-25 06:20 . 2004-09-14 08:38 916480 ----a-w- c:\windows\system32\wininet.dll

2010-02-24 13:11 . 2005-12-15 01:28 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-19 16:49 . 2009-03-30 16:31 288096 ----a-r- c:\documents and settings\Marc\Application Data\McAfee\Supportability\MVTLogs\Results\detect.dll

2010-02-16 19:09 . 2004-09-14 08:38 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 19:09 . 2004-08-04 00:58 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe

2006-11-08 15:01 . 2006-11-08 15:01 774144 ----a-w- c:\program files\RngInterstitial.dll

.

((((((((((((((((((((((((((((( SnapShot@2010-05-08_16.48.40 )))))))))))))))))))))))))))))))))))))))))

.

+ 2005-12-20 16:23 . 2010-05-14 18:12 32768 c:\windows\system32\config\systemprofile\Local Settings\Geschiedenis\History.IE5\index.dat

- 2005-12-20 16:23 . 2010-05-08 15:48 32768 c:\windows\system32\config\systemprofile\Local Settings\Geschiedenis\History.IE5\index.dat

+ 2010-05-14 18:12 . 2010-05-14 18:12 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat

+ 2010-05-14 17:59 . 2010-05-14 18:06 1661564 c:\windows\system32\Restore\rstrlog.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-10-10 69632]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-21 45056]

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-25 809488]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2008-11-07 15:41 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\WINDOWS\\system32\\LEXPPS.EXE"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

"c:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\frd.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [25/12/2008 13:14 10384]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [13/12/2008 14:04 210216]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [31/01/2010 17:26 135664]

S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [29/08/2006 0:54 10664]

.

Inhoud van de 'Gedeelde Taken' map

2010-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 15:26]

2010-05-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 15:26]

2009-08-14 c:\windows\Tasks\McDefragTask.job

- c:\program files\mcafee\mqc\QcConsol.exe [2007-03-21 10:22]

2009-11-01 c:\windows\Tasks\McQcTask.job

- c:\program files\mcafee\mqc\QcConsol.exe [2007-03-21 10:22]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.nieuwsblad.be/index.html

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe

Trusted Zone: dexia.be\directnet

Trusted Zone: internet

Trusted Zone: mcafee.com

.

**************************************************************************

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden:

**************************************************************************

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(636)

c:\windows\system32\Ati2evxx.dll

c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(1116)

c:\program files\McAfee\SiteAdvisor\saHook.dll

c:\program files\Logitech\SetPoint\lgscroll.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Voltooingstijd: 2010-05-14 20:21:21

ComboFix-quarantined-files.txt 2010-05-14 18:21

ComboFix2.txt 2010-05-14 17:44

ComboFix3.txt 2010-05-14 17:21

ComboFix4.txt 2010-05-14 15:44

ComboFix5.txt 2010-05-14 18:11

Pre-Run: 13.432.614.912 bytes beschikbaar

Post-Run: 13.395.664.896 bytes beschikbaar

- - End Of File - - DB007C659E59F3EED856D3E28647C11A

14 mei 2010 aangepast door marky marc

marky marc · 14 mei 2010

Verslag van de combo in veilige modus als je er iets mee moest zijn

ComboFix 10-05-10.03 - Marc 14/05/2010 17:33:01.15.2 - x86 MINIMAL

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1022.677 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Marc\Bureaublad\ComboFix.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

AV: Sunbelt VIPRE *On-access scanning enabled* (Updated) {964FCE60-0B18-4D30-ADD6-EB178909041C}

FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\20654nm2.exe

c:\windows\Tasks\At15.job

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-04-14 to 2010-05-14 ))))))))))))))))))))))))))))))

.

2010-05-12 13:28 . 2010-01-04 04:29 69720 ----a-w- c:\windows\system32\drivers\sbapifs.sys

2010-05-12 13:28 . 2010-01-04 04:29 13400 ----a-w- c:\windows\system32\drivers\sbaphd.sys

2010-05-12 13:23 . 2010-05-12 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Sunbelt

2010-05-12 13:23 . 2010-05-12 13:23 -------- d-----w- c:\documents and settings\Marc\Application Data\Sunbelt

2010-05-12 13:21 . 2010-03-11 13:49 204632 ----a-w- c:\windows\system32\drivers\sbtis.sys