Kan na een tijdje niet meer typen! toetsenbord doet niets meer

kape · 9 september 2010

Dit ziet er nog allemaal even netjes uit. Dan gaan we eens wat dieper kijken om malware volkomen te kunnen uitsluiten.

Download ComboFix van één van deze locaties:

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

Lees hier meer over correct gebruik van Combofix.

Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen: Klik hier Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.
Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd. Als deze Recovery Console al is geïnstalleerd zal ComboFix automatisch verder gaan met het scannen naar malware
Volg anders de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren. Wanneer de Recovery Console succesvol is geïnstalleerd, klik je op “JA” om verder te gaan met het scannen naar malware.

NOTA: Wanneer ComboFix start, kan het zijn dat je een foutmelding krijgt dat “De inhoud van het ComboFix pakket werd gewijzigd”. Ga dan niet verder met de instructies, maar download ComboFix opnieuw. Deze melding kan verschijnen wanneer een file-infector (Virut) actief is op de computer. Blijf je die melding krijgen dan meld je dit.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

beebie_vanes · 9 september 2010

ComboFix 10-09-08.03 - vanessa 09/09/2010 22:06:58.1.2 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.32.1043.18.1790.1059 [GMT 2:00]

Gestart vanuit: c:\users\vanessa\Downloads\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\Microsoft\Network\Downloader\qmgr0.dat

c:\programdata\Microsoft\Network\Downloader\qmgr1.dat

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-08-09 to 2010-09-09 ))))))))))))))))))))))))))))))

.

2010-09-09 20:26 . 2010-09-09 20:26 -------- d-----w- c:\users\vanessa\AppData\Local\temp

2010-09-09 20:26 . 2010-09-09 20:26 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-09-08 15:33 . 2010-09-08 15:33 20332736 ----a-w- c:\users\vanessa\AppData\Roaming\TomTom\HOME\Profiles\o4vjyrjg.default\Updates\v2_7_6_2056_win.exe

2010-09-08 15:30 . 2010-09-08 15:30 -------- d-----w- c:\programdata\TomTom

2010-09-08 15:30 . 2010-09-08 15:30 -------- d-----w- c:\users\vanessa\AppData\Roaming\TomTom

2010-09-08 15:30 . 2010-09-08 15:30 -------- d-----w- c:\users\vanessa\AppData\Local\TomTom

2010-09-08 15:30 . 2010-09-08 15:30 -------- d-----w- c:\program files\TomTom International B.V

2010-09-08 15:29 . 2010-09-08 15:29 -------- d-----w- c:\program files\TomTom HOME 2

2010-09-08 15:29 . 2010-09-08 15:29 -------- d-----w- c:\program files\TomTom DesktopSuite

2010-09-06 16:04 . 2010-09-06 16:04 -------- d-----w- c:\users\vanessa\AppData\Roaming\Malwarebytes

2010-09-06 16:04 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-06 16:04 . 2010-09-06 16:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-09-06 16:04 . 2010-09-06 16:04 -------- d-----w- c:\programdata\Malwarebytes

2010-09-06 16:04 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-09-05 15:18 . 2010-09-05 15:18 388096 ----a-r- c:\users\vanessa\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-09-05 15:18 . 2010-09-05 15:18 -------- d-----w- c:\program files\Trend Micro

2010-09-04 20:41 . 2010-09-04 20:41 -------- d-----w- c:\program files\CCleaner

2010-08-11 18:17 . 2010-06-26 06:05 916480 ----a-w- c:\windows\system32\wininet.dll

2010-08-11 18:15 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-08-11 18:14 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-11 18:14 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-08-11 18:14 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll

2010-08-11 18:14 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-09 18:43 . 2008-08-18 15:08 4833 ----a-w- c:\windows\bthservsdp.dat

2010-09-08 16:15 . 2007-04-28 05:34 667352 ----a-w- c:\windows\system32\perfh013.dat

2010-09-08 16:15 . 2007-04-28 05:34 126854 ----a-w- c:\windows\system32\perfc013.dat

2010-09-04 20:13 . 2009-01-09 13:16 -------- d-----w- c:\program files\Microsoft

2010-09-04 08:31 . 2010-04-23 18:24 -------- d-----w- c:\program files\MP3 Rocket

2010-09-04 08:30 . 2010-04-23 18:24 -------- d-----w- c:\users\vanessa\AppData\Roaming\MP3Rocket

2010-08-29 14:37 . 2008-08-13 16:00 41621 ----a-w- c:\users\vanessa\AppData\Roaming\nvModes.dat

2010-08-21 20:52 . 2010-02-07 11:23 -------- d-----w- c:\programdata\McAfee Security Scan

2010-08-12 20:27 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2010-08-11 21:23 . 2007-04-27 20:30 -------- d-----w- c:\program files\Microsoft Works

2010-06-28 20:57 . 2010-07-15 18:35 38848 ----a-w- c:\windows\avastSS.scr

2010-06-28 20:57 . 2008-11-16 17:35 165032 ----a-w- c:\windows\system32\aswBoot.exe

2010-06-28 20:37 . 2008-11-16 17:36 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-06-28 20:37 . 2008-11-16 17:35 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-06-28 20:33 . 2008-11-16 17:36 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-06-28 20:32 . 2008-11-16 17:35 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2010-06-28 20:32 . 2008-11-16 17:35 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-06-26 06:02 . 2010-08-11 18:16 109056 ----a-w- c:\windows\system32\iesysprep.dll

2010-06-26 06:02 . 2010-08-11 18:16 71680 ----a-w- c:\windows\system32\iesetup.dll

2010-06-26 04:25 . 2010-08-11 18:16 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2010-06-23 13:28 . 2010-06-23 13:28 501936 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbCDBC.tmp.exe

2010-06-21 13:37 . 2010-08-11 18:16 2037760 ----a-w- c:\windows\system32\win32k.sys

2010-06-19 16:55 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat

2010-06-18 17:31 . 2010-08-11 18:16 36864 ----a-w- c:\windows\system32\rtutils.dll

2010-06-14 14:55 . 2009-08-24 19:20 427376 ----a-w- c:\users\vanessa\AppData\Roaming\HiYo\Data\hiyo_install.exe

2007-04-28 05:44 . 2007-04-28 05:44 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2008-02-04 1038136]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-01-14 1688872]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-14 39408]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-08-24 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-09-19 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-19 8497696]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-19 81920]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-09 845360]

"CardReaderMonitor"="c:\program files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe" [2007-07-25 643072]

"CarboniteSetupLite"="c:\program files\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe" [2008-04-07 306112]

"PCMAgent"="c:\program files\CyberLink\PowerCinema\PCMAgent.exe" [2008-03-21 143360]

"CLMLServer"="c:\program files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe" [2008-04-11 196608]

"PlayMovie"="c:\program files\CyberLink\PlayMovie\PMVService.exe" [2008-03-31 172032]

"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 55824]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]

"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-08-05 647520]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-08 305440]

"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2010-02-05 2056192]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-11-21 784912]

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0bootdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

R2 Ca533av;Icatch(IV) Video Camera Device;c:\windows\system32\Drivers\Ca533av.sys [x]

R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 135664]

R3 hitmanpro3;Hitman Pro 3 Support Driver;c:\windows\system32\drivers\hitmanpro3.sys [x]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]

R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys [x]

R3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

S1 aswSP;aswSP; [x]

S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\CyberLink\PlayMovie\000.fcl [2008-03-31 41456]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]

S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2010-08-24 92008]

S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-10-05 288256]

S3 vm331avs;Bison Webcam;c:\windows\system32\Drivers\vm331avs.sys [2007-09-07 943016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

bthsvcs REG_MULTI_SZ BthServ

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

ezSharedSvc

.

Inhoud van de 'Gedeelde Taken' map

2010-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 17:18]

2010-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 17:18]

2010-08-28 c:\windows\Tasks\Norton Security Scan for vanessa.job

- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-04-28 07:48]

2010-09-09 c:\windows\Tasks\Recovery DVD Creator-vanessa.job

- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2007-04-27 09:13]

2010-09-09 c:\windows\Tasks\Uitgebreide garantie-vanessa.job

- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2007-04-27 09:13]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/ig?hl=nl

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

.

- - - - ORPHANS VERWIJDERD - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-09-09 22:26

Windows 6.0.6002 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files\CyberLink\PlayMovie\000.fcl"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Voltooingstijd: 2010-09-09 22:33:09

ComboFix-quarantined-files.txt 2010-09-09 20:33

Pre-Run: 48.722.042.880 bytes beschikbaar

Post-Run: 48.669.679.616 bytes beschikbaar

Current=1 Default=1 Failed=0 LastKnownGood=10 Sets=1,2,3,4,5,6,7,8,9,10

- - End Of File - - FC6D5DC0448A2EBE308F26803E367EAF

kape · 9 september 2010

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\avastSS.scr

c:\windows\system32\aswBoot.exe

c:\windows\system32\drivers\aswTdi.sys

c:\windows\system32\drivers\aswSP.sys

c:\windows\system32\drivers\aswRdr.sys

c:\windows\system32\drivers\aswMonFlt.sys

c:\windows\system32\drivers\aswFsBlk.sys

c:\windows\system32\drivers\hitmanpro3.sys

Driver::

aswRdr.sys

aswSP.sys

aswTdi.sys

aswMonFlt.sys

aswFsBlk.sys

hitmanpro3.sys

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast5"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

beebie_vanes · 10 september 2010

ComboFix 10-09-08.03 - vanessa 10/09/2010 14:09:21.2.2 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.32.1043.18.1790.783 [GMT 2:00]

Gestart vanuit: c:\users\vanessa\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\vanessa\Desktop\CFScript.txt..txt

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::

"c:\windows\avastSS.scr"

"c:\windows\system32\aswBoot.exe"

"c:\windows\system32\drivers\aswFsBlk.sys"

"c:\windows\system32\drivers\aswMonFlt.sys"

"c:\windows\system32\drivers\aswRdr.sys"

"c:\windows\system32\drivers\aswSP.sys"

"c:\windows\system32\drivers\aswTdi.sys"

"c:\windows\system32\drivers\hitmanpro3.sys"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\avastSS.scr

c:\windows\system32\aswBoot.exe

c:\windows\system32\drivers\aswFsBlk.sys

c:\windows\system32\drivers\aswMonFlt.sys

c:\windows\system32\drivers\aswRdr.sys

c:\windows\system32\drivers\aswSP.sys

c:\windows\system32\drivers\aswTdi.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_aswFsBlk

-------\Legacy_aswMonFlt

-------\Legacy_aswSP

-------\Service_aswFsBlk

-------\Service_aswMonFlt

-------\Service_aswSP

(((((((((((((((((((( Bestanden Gemaakt van 2010-08-10 to 2010-09-10 ))))))))))))))))))))))))))))))

.

2010-09-10 12:25 . 2010-09-10 12:30 -------- d-----w- c:\users\vanessa\AppData\Local\temp

2010-09-10 12:25 . 2010-09-10 12:25 -------- d-----w- c:\users\Public\AppData\Local\temp

2010-09-10 12:25 . 2010-09-10 12:25 -------- d-----w- c:\users\Default\AppData\Local\temp