opstarten pc internet

kape · 7 augustus 2010

Malwarebytes heeft zijn werk gedaan, het aantal opstarters is flink verminderd en het logje van HijackThis ziet er prima uit. Nu nog een laatste stap :

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

Lees hier meer over correct gebruik van Combofix.

Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen: Klik hier Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.

Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd. Als deze Recovery Console al is geïnstalleerd zal ComboFix automatisch verder gaan met het scannen naar malware
Volg anders de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren. Wanneer de Recovery Console succesvol is geïnstalleerd, klik je op “JA” om verder te gaan met het scannen naar malware.

NOTA: Wanneer ComboFix start, kan het zijn dat je een foutmelding krijgt dat “De inhoud van het ComboFix pakket werd gewijzigd”. Ga dan niet verder met de instructies, maar download ComboFix opnieuw. Deze melding kan verschijnen wanneer een file-infector (Virut) actief is op de computer. Blijf je die melding krijgen dan meld je dit.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

nathalie73 · 7 augustus 2010

Hallo ik heb alles gedaan zoals gezegd en dit is het logboek van combofix

ComboFix 10-08-06.01 - nathalie 07/08/2010 8:27.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1022.540 [GMT 2:00]

Gestart vanuit: c:\documents and settings\nathalie\Bureaublad\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\nathalie\Application Data\EurekaLog

c:\documents and settings\nathalie\System

c:\documents and settings\nathalie\System\win_qs8.jqx

c:\windows\system32\Thumbs.db

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_NPF

(((((((((((((((((((( Bestanden Gemaakt van 2010-07-07 to 2010-08-07 ))))))))))))))))))))))))))))))

.

2010-08-06 21:00 . 2010-08-06 21:00 -------- d-----w- c:\documents and settings\nathalie\Application Data\Malwarebytes

2010-08-06 21:00 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-06 21:00 . 2010-08-06 21:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-08-06 21:00 . 2010-08-06 21:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-06 21:00 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-06 20:25 . 2010-08-06 20:38 -------- d-----w- c:\program files\CodeStuff

2010-08-06 19:12 . 2010-08-06 19:12 -------- d-----w- c:\documents and settings\All Users\Application Data\242CE

2010-08-06 18:24 . 2010-08-06 18:24 388096 ----a-r- c:\documents and settings\nathalie\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-08-06 18:24 . 2010-08-06 18:24 -------- d-----w- c:\program files\Trend Micro

2010-08-06 17:36 . 2010-08-06 17:36 61440 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-2222d537-n\decora-sse.dll

2010-08-06 17:36 . 2010-08-06 17:36 503808 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-30c9c27b-n\msvcp71.dll

2010-08-06 17:36 . 2010-08-06 17:36 499712 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-30c9c27b-n\jmc.dll

2010-08-06 17:36 . 2010-08-06 17:36 348160 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-30c9c27b-n\msvcr71.dll

2010-08-06 17:36 . 2010-08-06 17:36 12800 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-2222d537-n\decora-d3d.dll

2010-08-01 12:02 . 2010-08-01 12:03 -------- d-----w- c:\program files\Graboid

2010-07-26 07:28 . 2010-07-26 07:28 -------- d-----w- c:\windows\system32\wbem\Repository

2010-07-14 09:29 . 2010-08-06 21:41 -------- d-----w- c:\documents and settings\nathalie\Application Data\uTorrent

2010-07-14 08:51 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

2010-07-11 18:03 . 2010-07-11 18:03 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2010-07-11 18:01 . 2010-07-11 18:01 -------- d-----w- c:\program files\Common Files\Skype

2010-07-11 18:01 . 2010-07-11 18:01 -------- d-----r- c:\program files\Skype

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-06 21:43 . 2009-03-26 20:06 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-08-06 21:40 . 2008-04-10 12:36 -------- d-----w- c:\documents and settings\nathalie\Application Data\Skype

2010-08-06 21:12 . 2009-03-26 20:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-08-06 20:10 . 2008-05-03 11:44 -------- d-----w- c:\documents and settings\nathalie\Application Data\LimeWire

2010-08-06 19:13 . 2008-04-04 20:21 -------- d-----w- c:\documents and settings\nathalie\Application Data\BearShare

2010-08-06 17:46 . 2008-04-04 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2010-08-06 16:26 . 2008-04-10 12:39 -------- d-----w- c:\documents and settings\nathalie\Application Data\skypePM

2010-07-29 07:35 . 2005-09-13 19:03 -------- d-----w- c:\program files\Common Files\Java

2010-07-29 07:34 . 2005-09-13 19:03 -------- d-----w- c:\program files\Java

2010-07-26 07:28 . 2009-09-25 11:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-07-26 07:07 . 2008-04-03 14:47 112672 ----a-w- c:\documents and settings\nathalie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-17 03:00 . 2010-05-01 07:27 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-07-14 09:29 . 2010-04-29 08:38 -------- d-----w- c:\program files\uTorrent

2010-07-11 18:01 . 2008-04-10 12:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2010-07-06 14:56 . 2009-09-11 16:23 -------- d-----w- c:\documents and settings\nathalie\Application Data\HpUpdate

2010-06-28 20:09 . 2008-04-09 11:48 -------- d-----w- c:\program files\HP

2010-06-27 09:25 . 2008-04-25 11:22 -------- d-----w- c:\documents and settings\nathalie\Application Data\HP

2010-06-27 09:23 . 2010-06-27 08:56 119666 ----a-w- c:\windows\hpoins11.dat

2010-06-27 09:10 . 2010-06-27 09:10 -------- d-----w- c:\program files\Common Files\Sonic Shared

2010-06-24 19:12 . 2005-08-19 10:31 534996 ----a-w- c:\windows\system32\perfh013.dat

2010-06-24 19:12 . 2005-08-19 10:31 100020 ----a-w- c:\windows\system32\perfc013.dat

2010-06-14 14:31 . 2005-08-19 01:43 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr

2010-05-26 16:00 . 2010-05-26 16:00 503808 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-57a2017c-n\msvcp71.dll

2010-05-26 16:00 . 2010-05-26 16:00 499712 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-57a2017c-n\jmc.dll

2010-05-26 16:00 . 2010-05-26 16:00 348160 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-57a2017c-n\msvcr71.dll

2010-05-26 16:00 . 2010-05-26 16:00 61440 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-46b6790b-n\decora-sse.dll

2010-05-26 16:00 . 2010-05-26 16:00 12800 ----a-w- c:\documents and settings\nathalie\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-46b6790b-n\decora-d3d.dll

2010-05-13 10:31 . 2010-07-26 07:23 225336 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1043.dat

2005-09-14 09:18 . 2005-09-14 09:18 8 --sh--r- c:\windows\system32\6F4823E4A3.sys

2005-09-14 09:18 . 2005-09-14 09:18 5224 --sha-w- c:\windows\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]

2009-05-04 10:56 398776 ----a-w- c:\program files\BearShare Applications\BearShare\BearShareIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VoipBuster"="c:\program files\VoipBuster.com\VoipBuster\VoipBuster.exe" [2010-07-16 10608432]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-04 68856]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-30 57344]

"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]

"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]

"RTHDCPL"="RTHDCPL.EXE" [2005-08-18 14820864]

"AGRSMMSG"="AGRSMMSG.exe" [2005-08-24 88203]

"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-07-25 32768]

"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2005-08-17 61440]

"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 20480]

"LMgrOSD"="c:\program files\Launch Manager\OSD.exe" [2005-03-16 204800]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-09-02 81920]

"PCMService"="c:\program files\Home Cinema\PowerCinema\PCMService.exe" [2005-09-15 139264]

"InstantOn"="c:\programme\CyberLink\PowerCinema Linux\ion_install.exe" [2005-03-25 93640]

"USB Storage Toolbox"="c:\windows\UMStor\Res.EXE" [2005-09-14 65536]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2010-02-05 2056192]

c:\documents and settings\nathalie\Menu Start\Programma's\Opstarten\

OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%ProgramFiles%\\Messenger\\msmsgs.exe"=

"%WinDir%\\system32\\fxsclnt.exe"=

"%ProgramFiles%\\CA\\eTrust Antivirus\\InocIT.exe"=

"%ProgramFiles%\\CA\\eTrust Antivirus\\Realmon.exe"=

"%ProgramFiles%\\CA\\eTrust Antivirus\\InoRpc.exe"=

"%ProgramFiles%\\WIDCOMM\\Bluetooth Software\\BTTray.exe"=

"c:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"=

"c:\\Program Files\\VoipBuster.com\\VoipBuster\\VoipBuster.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [14/11/2009 21:03 108289]

S1 mailKmd;mailKmd; [x]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [29/01/2010 16:20 135664]

S3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [13/09/2005 18:20 799744]

S3 STV674;Xtra Digital Camera;c:\windows\system32\drivers\STV674.sys --> c:\windows\system32\drivers\STV674.sys [?]

S3 STV674m;Xtra Digital Cameram;c:\windows\system32\drivers\STV674m.sys --> c:\windows\system32\drivers\STV674m.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]

2010-05-04 17:21 124928 ----a-w- c:\windows\system32\advpack.dll

.

Inhoud van de 'Gedeelde Taken' map

2010-07-26 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-08-07 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-03 16:08]

2010-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 14:20]

2010-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 14:20]

2010-08-06 c:\windows\Tasks\OGADaily.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]

2010-08-07 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]

2010-08-07 c:\windows\Tasks\User_Feed_Synchronization-{2FF403DD-E51B-4DC9-AE35-405659F371CE}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 16:36]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = hxxp://www.aldi.com/

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM

IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM

IE: Verzenden naar &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

DPF: {D5D487A1-C632-4C61-915C-AE196959EEB2} - hxxp://dbserver.edm.uhasselt.be/competas/info/Competas2005StartV2_0_4_5.cab

.

- - - - ORPHANS VERWIJDERD - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-08-07 08:44

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1159B246-0933-86DB-AD593C3CB7051897}\{4B332D01-174C-E53B-FFAF1A8AAD861E31}\{3A54BA3C-24AD-210D-6C7EF9C90D2B01E7}*]

"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,14,7e,56,

ce,c1,92,0d,e5,6e,36,bc,2c,72,f3,97,11,18,1e,db,84,9f,5f,8a,26,cf,6e,bb,96,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{48FFDBC0-65F5-8101-E6A5E6DD5D6987D3}\{27CA9EF6-7C20-BA5C-F1E964FD391A5DCD}\{EF53C495-2C8A-F63D-BE87F6505A64DD38}*]

"J6LUTEVR24DWS6LBRK5JBJYX6E1"=hex:01,00,01,00,00,00,00,00,64,ee,da,6f,cf,9a,c5,

9b,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{71AAA611-245D-D09F-882845FC5EAA24CC}\{DFD26894-68B9-4777-FDD1761F9E74CD53}\{F10C9B44-6C01-0B82-830AFBCCD029C402}*]

"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,14,7e,56,

ce,c1,92,0d,e5,6e,36,bc,2c,72,f3,97,11,18,1e,db,84,9f,5f,8a,26,cf,6e,bb,96,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AB53ABC9-60C7-8B2C-A2AB126EB1F03A59}\{6511FF0A-0202-CA71-9BBA47A5377501DE}\{CE12CB05-B8C7-0E6B-6DC342F04A20B600}*]

"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,14,7e,56,

ce,c1,92,0d,e5,6e,36,bc,2c,72,f3,97,11,18,1e,db,84,9f,5f,8a,26,cf,6e,bb,96,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{D6C53DCC-FBE6-A484-895E707488E1192C}\{427B1CEB-CDC7-050B-E6202C9404952D54}\{86A51E58-9B8E-E4EB-26F8074E7F2FD295}*]

"J6LUTEVR24DWS6LBRK5JBJYX6E1"=hex:01,00,01,00,00,00,00,00,64,ee,da,6f,cf,9a,c5,

9b,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EC36979A-271C-CB21-250CD586E00814A2}\{8EF4E408-9A98-28EF-CDFA1ACBF6ED5141}\{501B0FF8-8336-4915-6C99805756A8837E}*]

"J6LUTEVR24DWS6LBRK5JBJYX6E1"=hex:01,00,01,00,00,00,00,00,64,ee,da,6f,cf,9a,c5,

9b,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]

"3140211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(928)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(520)

c:\progra~1\WINDOW~2\wmpband.dll

c:\program files\Windows Desktop Search\deskbar.dll

c:\program files\Windows Desktop Search\en-us\dbres.dll.mui

c:\program files\Windows Desktop Search\dbres.dll

c:\program files\Windows Desktop Search\wordwheel.dll

c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui

c:\program files\Windows Desktop Search\msnlExtRes.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\btncopy.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

c:\program files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\HPZipm12.exe

c:\program files\CyberLink\Shared Files\RichVideo.exe

c:\progra~1\COMMON~1\X10\Common\x10nets.exe

c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe

c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

c:\windows\RTHDCPL.EXE

c:\windows\AGRSMMSG.exe

c:\windows\system32\SearchIndexer.exe

c:\windows\system32\wbem\wmiapsrv.exe

.

**************************************************************************

.

Voltooingstijd: 2010-08-07 08:52:06 - machine werd herstart

ComboFix-quarantined-files.txt 2010-08-07 06:52

Pre-Run: 2.909.974.528 bytes beschikbaar

Post-Run: 3.329.200.128 bytes beschikbaar

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 0BD5C5C8DC9FB60E9CCBDB73D52BECF1

kape · 7 augustus 2010

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\6F4823E4A3.sys

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]

Driver::

mailKmd

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

nathalie73 · 8 augustus 2010

Hello dit is de logboek van combofix

ComboFix 10-08-07.02 - nathalie 08/08/2010 15:37:45.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1022.508 [GMT 2:00]

Gestart vanuit: c:\documents and settings\nathalie\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\nathalie\Bureaublad\CFScript.txt..txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

* Nieuw herstelpunt werd aangemaakt

FILE ::

"c:\windows\system32\6F4823E4A3.sys"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\6F4823E4A3.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_mailKmd

(((((((((((((((((((( Bestanden Gemaakt van 2010-07-08 to 2010-08-08 ))))))))))))))))))))))))))))))