SearchSettings Spyware

[PatrickB]

Goedenavond,

Hierbij het logje van Combofix:

Moest Combofox nou op een speciale manier weer verwijderd worden?

ComboFix 11-04-06.03 - H.G.J. van Gils 07-04-2011 19:21:33.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.2558.2082 [GMT 2:00]

Gestart vanuit: c:\documents and settings\H.G.J. van Gils\Bureaublad\ComboFix.exe

AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

* Nieuw herstelpunt werd aangemaakt

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\1.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\a.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\b.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\c.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\d.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\e.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\f.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\g.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\h.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\i.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\J.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\k.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\l.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\m.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\n.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\o.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\p.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\q.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\r.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\s.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\t.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\u.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\v.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\w.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\x.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\y.xml

c:\documents and settings\H.G.J. van Gils\Application Data\PriceGong\Data\z.xml

c:\documents and settings\H.G.J. van Gils\WINDOWS

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-03-07 to 2011-04-07 ))))))))))))))))))))))))))))))

.

.

2011-04-03 12:02 . 2011-04-07 16:58 -------- d--h--r- c:\documents and settings\H.G.J. van Gils\Onlangs geopend

2011-03-29 15:55 . 2011-03-29 15:55 388096 ----a-r- c:\documents and settings\H.G.J. van Gils\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-03-29 15:55 . 2011-03-29 15:55 -------- d-----w- c:\program files\Trend Micro

2011-03-29 15:30 . 2011-03-29 15:30 -------- d-----w- c:\program files\Orbitdownloader

2011-03-29 09:10 . 2011-03-29 15:08 -------- d-----w- c:\program files\YouTube Downloader

2011-03-18 16:10 . 2011-03-18 16:10 -------- d-----w- c:\windows\system32\wbem\Repository

2011-03-18 16:09 . 2011-04-07 17:19 -------- d-----w- c:\documents and settings\H.G.J. van Gils\Bureaublad

2011-03-12 11:28 . 2011-03-12 11:28 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

2011-03-09 18:11 . 2011-03-09 18:11 -------- d-----w- c:\program files\Common Files\Java

2011-03-09 18:11 . 2011-03-09 18:11 -------- d-----w- c:\program files\Rocky Mountain Traders

2011-03-09 18:11 . 2011-03-18 16:34 -------- d-----w- c:\documents and settings\H.G.J. van Gils\Local Settings\Application Data\DVDVideoSoftTB

2011-03-09 18:11 . 2011-03-09 18:11 -------- d-----w- c:\windows\system32\URTTEMP

2011-03-09 18:10 . 2011-03-31 17:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-09 13:54 . 2004-08-03 23:03 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:54 . 2004-08-03 23:03 186880 ----a-w- c:\windows\system32\encdec.dll

2011-02-02 07:58 . 2010-05-15 10:43 2067456 ----a-w- c:\windows\system32\mstscax.dll

2011-01-27 11:57 . 2010-05-15 10:43 677888 ----a-w- c:\windows\system32\mstsc.exe

2011-01-21 14:44 . 2004-08-03 23:03 441344 ----a-w- c:\windows\system32\shimgvw.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\documents and settings\H.G.J. van Gils\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-05-15 136176]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]

"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-12-11 352976]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=

"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=

.

R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [9-6-2010 18:43 11352]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [7-5-2010 13:06 32856]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2-11-2009 21:27 19472]

S2 ACEDRV09;ACEDRV09;\??\c:\windows\system32\drivers\ACEDRV09.sys --> c:\windows\system32\drivers\ACEDRV09.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18-3-2010 14:16 130384]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18-3-2010 14:16 753504]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-04-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-515967899-1303643608-1801674531-1003Core.job

- c:\documents and settings\H.G.J. van Gils\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-15 13:05]

.

2011-04-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-515967899-1303643608-1801674531-1003UA.job

- c:\documents and settings\H.G.J. van Gils\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-15 13:05]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204

IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Free YouTube to MP3 Converter - c:\documents and settings\H.G.J. van Gils\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

FF - ProfilePath - c:\documents and settings\H.G.J. van Gils\Application Data\Mozilla\Firefox\Profiles\0m9azfcd.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - Grooveshark - Listen to Free Music Online - Internet Radio - Free MP3 Streaming

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=937811&p=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

- - - - ORPHANS VERWIJDERD - - - -

.

WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-04-07 19:27

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-515967899-1303643608-1801674531-1003\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'winlogon.exe'(908)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\ATL.DLL

.

Voltooingstijd: 2011-04-07 19:30:05

ComboFix-quarantined-files.txt 2011-04-07 17:30

.

Pre-Run: 58.155.315.200 bytes beschikbaar

Post-Run: 58.285.621.248 bytes beschikbaar

.

- - End Of File - - D5FE83F2E2093525182A9D77DB6C5A92

[kape]

Combofix heeft nog wat ongewenste bestanden van de PC verwijderd. CF mag je nu verwijderen via Start -> Uitvoeren/Zoekopdracht en typ: ComboFix /Uninstall

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Download CCleaner.

Klik op “Download Latest Version” en dan start de download van CCleaner automatisch en gratis op.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Wil je dit uitgebreid in beeld bekijken, klik dan hier voor de handleiding.

Het is aangewezen om de bestaande herstelpunten te verwijderen (daar zitten besmette herstelpunten tussen die je eventueel zou kunnen terugzetten) door systeemherstel tijdelijk uit te schakelen. Doe dit via Start -> Configuratiescherm -> Prestaties en Onderhoud -> Systeem -> Systeemherstel -> "Systeemherstel op alle stations uitschakelen" aanvinken. Toepassen en OK. PC herstarten en het vinkje terug weg halen.

That's it !