pc is heel traag en hapert

devil1570 · 1 maart 2011

ComboFix 11-02-28.03 - Alex 01/03/2011 10:47:30.1.4 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2047.1093 [GMT 1:00]

Gestart vanuit: c:\users\Alex\Desktop\ComboFix.exe

AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}

FW: BitDefender Firewall *Enabled* {A0115F06-6D34-063E-1C9A-77345A574EF5}

SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\facemoods.com

c:\program files\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll

c:\program files\facemoods.com\facemoods\1.4.17.5\facemoods.crx

c:\program files\facemoods.com\facemoods\1.4.17.5\facemoods.png

c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsApp.dll

c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsEng.dll

c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe

c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll

c:\program files\facemoods.com\facemoods\1.4.17.5\uninstall.exe

c:\restoration\Restoration.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-02-01 to 2011-03-01 ))))))))))))))))))))))))))))))

.

2011-03-01 09:55 . 2011-03-01 09:55 -------- d-----w- c:\users\Alex\AppData\Local\temp

2011-03-01 09:55 . 2011-03-01 09:55 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-02-28 18:43 . 2011-02-28 18:43 -------- d-----w- c:\programdata\InstallMate

2011-02-27 18:01 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-02-27 18:01 . 2011-02-27 18:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-02-27 18:01 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-02-27 15:48 . 2011-02-27 15:48 388096 ----a-r- c:\users\Alex\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-02-27 15:48 . 2011-02-27 15:48 -------- d-----w- c:\program files\Trend Micro

2011-02-27 15:34 . 2011-02-27 15:34 -------- d-----w- c:\program files\CCleaner

2011-02-27 15:29 . 2011-02-27 15:29 -------- d-----w- c:\users\Alex\AppData\Roaming\Malwarebytes

2011-02-27 15:28 . 2011-02-27 15:28 -------- d-----w- c:\programdata\Malwarebytes

2011-02-26 10:05 . 2011-02-26 10:05 -------- d-----w- c:\program files\Tunatic

2011-02-25 17:14 . 2011-02-26 17:57 12872 ----a-w- c:\windows\system32\bootdelete.exe

2011-02-25 16:57 . 2011-02-27 15:19 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-02-25 16:57 . 2011-02-25 16:57 -------- d-----w- c:\program files\Hitman Pro 3.5

2011-02-25 16:56 . 2011-02-26 09:59 -------- d-----w- c:\programdata\Hitman Pro

2011-02-23 13:04 . 2011-02-23 13:20 -------- d-----w- c:\users\Alex\AppData\Roaming\U3

2011-02-20 19:25 . 2011-02-26 09:49 -------- d-----w- c:\program files\Steam

2011-02-20 19:09 . 2011-02-20 19:09 -------- d-----w- c:\program files\TI Education

2011-02-20 19:08 . 2009-03-24 11:52 218432 ----a-w- c:\windows\system32\RICHTX32.OCX

2011-02-20 19:08 . 2007-08-15 11:09 40960 ----a-w- c:\windows\system32\ssubtmr6.dll

2011-02-20 19:08 . 2007-08-15 11:09 167683 ----a-w- c:\windows\system32\COMCT232.OCX

2011-02-20 19:08 . 2011-02-20 19:23 -------- d-----w- c:\program files\Smarty Uninstaller Pro

2011-02-19 16:31 . 2011-02-20 14:03 -------- d-----w- c:\users\Alex\AppData\Local\PokerStars

2011-02-19 00:47 . 2011-02-19 00:47 -------- d-----w- c:\users\Alex\AppData\Local\Microsoft Games

2011-02-19 00:23 . 2011-02-19 00:23 -------- d-----w- c:\program files\HyCam2

2011-02-17 18:38 . 2011-02-17 18:39 -------- d-----w- c:\program files\Game_Maker8

2011-02-14 19:26 . 2011-02-14 20:25 -------- d-----w- c:\program files\Convar

2011-02-14 19:04 . 2011-03-01 09:54 -------- d-----w- C:\Restoration

2011-02-09 22:19 . 2011-01-06 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-02-09 22:19 . 2010-12-31 13:57 2039808 ----a-w- c:\windows\system32\win32k.sys

2011-02-09 22:19 . 2010-10-15 14:08 3602320 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-02-09 22:19 . 2010-10-15 13:48 1205080 ----a-w- c:\windows\system32\ntdll.dll

2011-02-09 22:19 . 2010-10-15 14:08 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-01-30 22:30 . 2011-01-30 22:30 -------- d-----w- c:\program files\Guild Wars

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-29 11:48 . 2010-11-08 18:06 53632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll

2010-12-29 11:48 . 2010-11-08 18:06 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2010-12-29 11:48 . 2010-11-08 18:06 29568 ----a-w- c:\windows\system32\LMIport.dll

2010-12-29 11:48 . 2010-11-08 18:06 87424 ----a-w- c:\windows\system32\LMIinit.dll

2010-12-28 15:55 . 2011-01-12 12:36 413696 ----a-w- c:\windows\system32\odbc32.dll

2010-12-21 23:29 . 2010-12-21 23:29 658696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2010-12-14 14:49 . 2011-01-12 12:35 1169408 ----a-w- c:\windows\system32\sdclt.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]

"Skytel"="Skytel.exe" [2007-06-15 1826816]

"RCSystem"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 57344]

"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2006-11-22 57344]

"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-12-06 180224]

"AsioReg"="CTASIO.DLL" [2006-12-12 79872]

"CTHelper"="CTHELPER.EXE" [2006-12-12 19456]

"CTxfiHlp"="CTXFIHLP.EXE" [2006-12-12 20480]

"CTXFIREG"="CTxfiReg.exe" [2006-12-12 44032]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]

"BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2010-03-18 1123360]

"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2009-10-19 71152]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-03 1848648]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

WiFi Station N.lnk - c:\program files\Hercules\WiFi Station N\WiFiN.exe [2010-9-20 124200]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKLM\~\startupfolder\C:^Users^Alex^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^winlogin.exe]

path=c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogin.exe

backup=c:\windows\pss\winlogin.exe.Startup

backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-09-23 03:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-04-16 20:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2007-02-26 18:46 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]

R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;c:\windows\system32\DRIVERS\3xHybrid.sys [2006-11-22 1121536]

R3 Arrakis3;BitDefender Arrakis-server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2009-10-19 183880]

R3 qcusbser;ACER Android USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\qcusbser.sys [2009-08-14 105984]

R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 XDva375;XDva375;c:\windows\system32\XDva375.sys [x]

R4 amBX Engine;amBX Engine;d:\installs\System\amBX_Engine.exe [x]

R4 amBX Service;amBX Service;d:\installs\System\amBX_Service.exe [x]

R4 Philips amBX USB HAL;Philips amBX USB HAL;d:\installs\System\Device Drivers\Philips USB\Philips_amBX_USB_HAL.exe [x]

S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\windows\system32\DRIVERS\BdfNdisf6.sys [2010-09-19 72784]

S2 AcerSyncServiceWinService;AcerSyncServiceWinService;c:\program files\Acer\AcerSync\AcerSyncService.exe [2010-04-14 172576]

S2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2010\bdvedisk.sys [2010-01-19 85128]

S2 HerculesWiFi;HerculesWiFi;c:\windows\system32\HerculesWiFiService.exe [2008-08-13 48128]

S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]

S3 BDFM;BDFM;c:\windows\system32\DRIVERS\bdfm.sys [2010-02-03 153448]

S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-05-20 30576]

S3 netr28u;Hercules Wireless N USB Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2008-01-30 599040]

S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]

S3 radpms;Driver for RADPMS Device;c:\windows\system32\DRIVERS\radpms.sys [2010-05-31 13408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

bdx REG_MULTI_SZ scan

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://start.facemoods.com/?a=bfus

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\ooe0xz0d.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2849859&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - BittorrentBar_NL Customized Web Search

FF - prefs.js: browser.startup.homepage - HLN home

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS VERWIJDERD - - - -

BHO-{64182481-4F71-486b-A045-B233BD0DA8FC} - c:\program files\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll

Toolbar-{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll

HKLM-Run-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe

MSConfigStartUp-amBX System Tray Application - d:\installs\System\ApplicationManager\amBXAppMgr.exe

MSConfigStartUp-Google Update - c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe

MSConfigStartUp-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe

HKLM_ActiveSetup-{346019B4-D6E2-4CB6-99E9-DD8A26CF0C77} - msiexec

AddRemove-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.5\uninstall.exe

AddRemove-Vector Magic - l:\nieuwe map\Vector Magic\Uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-03-01 10:55

Windows 6.0.6002 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

c:\users\Alex\AppData\Local\Temp\catchme.dll 53248 bytes executable

Scan succesvol afgerond

verborgen bestanden: 1

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Voltooingstijd: 2011-03-01 10:57:00

ComboFix-quarantined-files.txt 2011-03-01 09:56

Pre-Run: 415.844.921.344 bytes beschikbaar

Post-Run: 415.771.045.888 bytes beschikbaar

Current=1 Default=1 Failed=0 LastKnownGood=3 Sets=1,2,3,7

- - End Of File - - 542EDD3D3885EF79A17C49FF7F850B3A

kape · 1 maart 2011

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Firefox::

FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\ooe0xz0d.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: browser.search.selectedEngine -

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht en laat dan eens weten hoe het nu met de snelheid staat ?

devil1570 · 1 maart 2011

ComboFix 11-02-28.05 - Alex 01/03/2011 11:44:42.2.4 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2047.1020 [GMT 1:00]

Gestart vanuit: c:\users\Alex\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Alex\Desktop\CFScript.txt

AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}

FW: BitDefender Firewall *Disabled* {A0115F06-6D34-063E-1C9A-77345A574EF5}

SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-02-01 to 2011-03-01 ))))))))))))))))))))))))))))))

.

2011-03-01 10:52 . 2011-03-01 10:52 -------- d-----w- c:\users\Alex\AppData\Local\temp

2011-03-01 10:52 . 2011-03-01 10:52 -------- d-----w- c:\users\Default\AppData\Local\temp