HELP! Computer loopt vast bij verwijderen, installeren

Jescomputer · 12 juli 2010

GELUKT:

ComboFix 10-07-11.03 - Jessica 12-07-2010 11:46:33.1.2 - x86 NETWORK

Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.31.1043.18.2038.1475 [GMT 2:00]

Gestart vanuit: c:\users\Jessica\Desktop\ComboFix.exe

AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\install.exe

c:\windows\xpsp1hfm.log

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-06-12 to 2010-07-12 ))))))))))))))))))))))))))))))

.

2010-07-08 13:11 . 2010-07-08 13:11 -------- d-----w- c:\users\Jessica\AppData\Roaming\Malwarebytes

2010-07-08 13:11 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-08 13:11 . 2010-07-08 13:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-08 13:11 . 2010-07-08 13:11 -------- d-----w- c:\programdata\Malwarebytes

2010-07-08 13:11 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-02 11:36 . 2006-11-02 16:11 745648 ----a-w- c:\windows\system32\perfh013.dat

2010-07-02 11:36 . 2006-11-02 16:11 147064 ----a-w- c:\windows\system32\perfc013.dat

2010-06-12 09:19 . 2009-05-09 17:47 -------- d-----w- c:\programdata\Roxio

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32B279E3-5023-4CD8-A295-70C79EDBB294}]

2009-03-23 15:48 2620416 ----a-w- c:\program files\HyvesToolbar\Hyves Toolbar\tbcore3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{AB8DC1E0-22BE-4181-B77E-02C495E031F8}"= "c:\program files\HyvesToolbar\Hyves Toolbar\tbcore3.dll" [2009-03-23 2620416]

[HKEY_CLASSES_ROOT\clsid\{ab8dc1e0-22be-4181-b77e-02c495e031f8}]

[HKEY_CLASSES_ROOT\TBSB00081.TBSB00081.3]

[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]

[HKEY_CLASSES_ROOT\TBSB00081.TBSB00081]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{AB8DC1E0-22BE-4181-B77E-02C495E031F8}"= "c:\program files\HyvesToolbar\Hyves Toolbar\tbcore3.dll" [2009-03-23 2620416]

[HKEY_CLASSES_ROOT\clsid\{ab8dc1e0-22be-4181-b77e-02c495e031f8}]

[HKEY_CLASSES_ROOT\TBSB00081.TBSB00081.3]

[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]

[HKEY_CLASSES_ROOT\TBSB00081.TBSB00081]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-09-12 443968]

"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2007-09-20 253952]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-02 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-11-08 1006264]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-20 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-20 154136]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-20 137752]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784]

"RtHDVCpl"="RtHDVCpl.exe" [2007-08-25 4669440]

"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-09-19 311296]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-12-16 29744]

"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2007-11-09 36864]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]

"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]

"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-07-16 111952]

"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"GrpConv"="grpconv -o" [X]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

c:\users\Jessica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Mediacontrole Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-2-17 344064]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2007-08-14 19:05 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

R2 gupdate1c9f433ff38b83e;Google Updateservice (gupdate1c9f433ff38b83e);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-23 133104]

R2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [2007-09-20 204800]

R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]

R2 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472]

R2 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-06-20 397312]

R2 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-06-20 1089536]

R2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2007-09-28 292128]

R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-12-16 29744]

R3 netr28u;Linksys USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-12-14 570880]

R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-06-06 812544]

R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2007-09-20 79136]

R4 PRISMSVC;PRISMSVC;c:\windows\system32\PRISMSVC.EXE [2004-10-04 57344]

S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2007-08-29 9344]

--- Andere Services/Drivers In Geheugen ---

*NewlyCreated* - ECACHE

.

Inhoud van de 'Gedeelde Taken' map

2010-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-23 18:53]

2010-07-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-23 18:53]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.hyves.nl

uInternet Settings,ProxyOverride = *.local

IE: Add to Windows &Live Favorites - Welcome to Windows Live

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

- - - - ORPHANS VERWIJDERD - - - -

HKLM-RunOnce-<NO NAME> - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-07-12 11:54

Windows 6.0.6000 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:0000007b

.

Voltooingstijd: 2010-07-12 11:56:43

ComboFix-quarantined-files.txt 2010-07-12 09:56

Pre-Run: 38.246.580.224 bytes beschikbaar

Post-Run: 56.319.561.728 bytes beschikbaar

- - End Of File - - 1EFEB0E944E447AE77D164FE543158F0

kape · 12 juli 2010

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Symantec PIF AlertEng"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"GrpConv"=-

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

Jescomputer · 12 juli 2010

ComboFix 10-07-11.03 - Jessica 12-07-2010 13:02:56.1.2 - x86 NETWORK

Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.31.1043.18.2038.1581 [GMT 2:00]

Gestart vanuit: c:\users\Jessica\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Jessica\Desktop\CFScript.txt

AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}

SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-06-12 to 2010-07-12 ))))))))))))))))))))))))))))))

.

2010-07-12 11:12 . 2010-07-12 11:12 -------- d-----w- c:\users\TEMP\AppData\Local\temp

2010-07-12 11:12 . 2010-07-12 11:12 -------- d-----w- c:\users\Public\AppData\Local\temp

2010-07-12 11:12 . 2010-07-12 11:12 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-07-12 11:12 . 2010-07-12 11:12 -------- d-----w- c:\users\Administrator\AppData\Local\temp