problemen na MS removal tool virus

spinozella · 13 juni 2011

KApe, hierbij de laatste log via combo fix

bij automatische heropstart kwam er wel een pop up van malwarebyte met waarschuwing en ik heb die gewoon

gesloten om comboproces verder te zetten

ComboFix 11-06-12.04 - LeBon 13/06/2011 12:21:03.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.32.1043.18.767.287 [GMT 2:00]

Gestart vanuit: c:\documents and settings\LeBon\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\LeBon\Bureaublad\CFScript.txt

AV: Symantec AntiVirus Corporate Edition *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}

.

FILE ::

"C:\mbam-setup-1.51.0.1200.exe"

"c:\program files\PDFCreator-0_9_8_setup.exe"

"C:\rkill.com"

"c:\windows\003089_.tmp"

"c:\windows\system32\ConduitEngine.tmp"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\fL28218KpOlM28218

c:\documents and settings\All Users\Application Data\fL28218KpOlM28218\fL28218KpOlM28218

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_F-SECURE_STANDALONE_MINIFILTER

-------\Service_F-Secure Standalone Minifilter

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-05-13 to 2011-06-13 ))))))))))))))))))))))))))))))

.

2011-06-11 22:04 . 2011-06-11 22:04 16695184 -c--a-w- C:\mpas-feX64.exe

2011-06-11 16:10 . 2011-06-13 10:20 118936 -c--a-w- C:\rkill.com

2011-06-11 15:34 . 2011-06-11 15:34 -------- d-----w- c:\documents and settings\LeBon\Application Data\Malwarebytes

2011-06-11 15:34 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-11 15:34 . 2011-06-11 15:34 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-06-11 15:34 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-11 15:34 . 2011-06-11 15:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-11 15:33 . 2011-06-13 10:20 9435312 -c--a-w- C:\mbam-setup-1.51.0.1200.exe

2011-06-10 07:44 . 2011-06-10 07:44 388096 ----a-r- c:\documents and settings\LeBon\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-06-10 07:44 . 2011-06-10 07:44 -------- d-----w- c:\program files\Trend Micro

2011-06-10 07:41 . 2011-06-10 07:41 1402880 -c--a-w- C:\HiJackThis.msi

2011-06-10 07:39 . 2011-06-10 07:41 69356 -c--a-w- C:\executable.exe

2011-06-09 19:46 . 2011-06-09 19:49 -------- dc----w- c:\documents and settings\Administrator

2011-06-02 08:56 . 2011-06-09 18:49 -------- d-----w- c:\windows\system32\NtmsData

2011-06-01 14:35 . 2011-06-01 14:35 -------- d-----w- c:\documents and settings\LeBon\Application Data\BitZipper

2011-06-01 14:34 . 2011-06-01 14:36 -------- d-----w- c:\program files\BitZipper

2011-06-01 14:34 . 2011-06-05 11:32 -------- d-----w- c:\program files\PC Speed Maximizer

2011-05-27 06:46 . 2011-05-27 06:46 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2011-05-26 11:26 . 2009-07-31 09:05 1372672 -c----w- c:\windows\system32\dllcache\msxml6.dll

2011-05-26 11:26 . 2008-04-14 20:09 88064 -c----w- c:\windows\system32\dllcache\msxml6r.dll

2011-05-26 11:26 . 2008-04-14 20:09 88064 ----a-w- c:\windows\system32\msxml6r.dll

2011-05-26 11:26 . 2008-04-14 20:31 103424 -c----w- c:\windows\system32\dllcache\dpcdll.dll

2011-05-26 11:07 . 2006-12-28 22:31 19569 ----a-w- c:\windows\003089_.tmp

2011-05-24 09:03 . 2011-05-09 20:46 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{1C1BA3EA-F6D6-4970-855F-F9C3592E3EA2}\mpengine.dll

2011-05-23 08:35 . 2007-08-21 11:32 98304 ----a-w- c:\windows\system32\redmonnt.dll

2011-05-20 12:42 . 2011-05-20 13:31 -------- d-----w- c:\documents and settings\LeBon\Application Data\Sammsoft

2011-05-20 08:23 . 2011-05-20 08:23 -------- d-sh--w- c:\documents and settings\LeBon\IECompatCache

2011-05-20 08:04 . 2011-05-20 08:04 -------- d-sh--w- c:\windows\system32\AI_RecycleBin

2011-05-20 08:04 . 2011-05-20 08:04 -------- d-----w- c:\program files\W3i

2011-05-19 10:19 . 2011-05-19 10:19 -------- dc----w- c:\documents and settings\All Users\Application Data\Fighters

2011-05-18 15:45 . 2011-05-18 15:45 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE

2011-05-18 15:44 . 2011-05-18 15:45 -------- d-----r- c:\documents and settings\LocalService\Favorieten

2011-05-18 15:11 . 2011-05-18 15:11 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2011-05-18 15:08 . 2011-05-18 15:08 -------- d-sh--w- c:\documents and settings\LeBon\PrivacIE

2011-05-18 14:58 . 2011-05-18 14:58 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2011-05-18 14:55 . 2011-05-18 14:55 -------- d-sh--w- c:\documents and settings\LeBon\IETldCache

2011-05-18 14:09 . 2011-05-18 14:15 -------- dc-h--w- c:\windows\ie8

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-13 10:20 . 2009-10-26 14:50 17695920 -c--a-w- c:\program files\PDFCreator-0_9_8_setup.exe

2011-05-09 20:46 . 2008-07-30 06:16 6962000 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2011-05-02 19:41 . 2011-05-02 19:41 389120 ----a-w- c:\windows\system32\RegistryHelperLM.ocx

2011-04-19 15:13 . 2011-03-04 11:30 0 -c--a-w- c:\windows\system32\ConduitEngine.tmp

2010-03-09 10:03 . 2010-03-09 10:03 24978056 -c--a-w- c:\program files\nitro_pdf_professional_adwords.exe

2009-10-11 09:01 . 2009-10-11 09:01 11074851 -c--a-w- c:\program files\WRITEEXPRESS.exe

2009-09-27 12:54 . 2009-09-27 12:26 195343800 -c--a-w- c:\program files\X12-30208.exe

2009-06-09 14:35 . 2009-06-09 14:35 1726360 -c--a-w- c:\program files\dopdf.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Startw3i"="c:\program files\PC Speed Maximizer\Startw3i.exe" [2010-11-24 173328]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-06-07 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-04-08 48752]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-03 435096]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^LeBon^Menu Start^Programma's^Opstarten^Microsoft Office Groove.lnk]

path=c:\documents and settings\LeBon\Menu Start\Programma's\Opstarten\Microsoft Office Groove.lnk

backup=c:\windows\pss\Microsoft Office Groove.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 10:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstallIQUpdater]

2011-05-10 14:03 1205760 ----a-w- c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]

2005-04-17 10:30 85184 ----a-w- c:\progra~1\SYMANT~1\VPTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

.

R3 EraserUtilDrv11110;EraserUtilDrv11110;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11110.sys [16-5-2011 15:13 105592]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11-6-2011 17:34 22712]

S3 CFcatchme;CFcatchme;\??\c:\docume~1\LeBon\LOCALS~1\Temp\CFcatchme.sys --> c:\docume~1\LeBon\LOCALS~1\Temp\CFcatchme.sys [?]

S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\drivers\s916bus.sys [23-4-2008 16:04 83496]

S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\drivers\s916mdfl.sys [23-4-2008 16:24 15016]

S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\drivers\s916mdm.sys [23-4-2008 16:24 109992]

S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s916mgmt.sys [23-4-2008 17:13 103976]

S3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\drivers\s916obex.sys [23-4-2008 16:49 100008]

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - WUAUSERV

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-07 09:12]

.

2011-06-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-07 09:12]

.

2011-06-13 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

.

2011-06-12 c:\windows\Tasks\OGADaily.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]

.

2011-06-13 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 16:04]

.

2011-06-13 c:\windows\Tasks\User_Feed_Synchronization-{78768EB6-0C71-492F-B092-F52FA476376F}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

.

2011-06-12 c:\windows\Tasks\User_Feed_Synchronization-{AC17FA01-2A2C-4E99-BBEC-13864B2B27F1}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}

uInternet Settings,ProxyOverride = <local>

uSearchURL,(Default) = hxxp://g.msn.be/0SENLBE/SAOS01?FORM=TOOLBR

IE: E&xporteren naar Microsoft Excel - d:\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: Linked&In Search

TCP: DhcpNameServer = 195.130.130.130 195.130.131.130

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-06-13 12:47

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'explorer.exe'(1104)

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files\Windows Defender\MsMpEng.exe

c:\program files\Common Files\Symantec Shared\ccSetMgr.exe

c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

c:\program files\Symantec AntiVirus\DefWatch.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Symantec AntiVirus\Rtvscan.exe

c:\windows\system32\SearchIndexer.exe

c:\progra~1\MI3AA1~1\wcescomm.exe

c:\progra~1\MI3AA1~1\rapimgr.exe

c:\windows\system32\SearchProtocolHost.exe

c:\windows\system32\SearchFilterHost.exe

c:\windows\SoftwareDistribution\Download\231bd1d5b162faa0c29603e08f1d1d58\update\update.exe

.

**************************************************************************

.

Voltooingstijd: 2011-06-13 13:08:03 - machine werd herstart

ComboFix-quarantined-files.txt 2011-06-13 11:07

ComboFix2.txt 2011-06-13 09:23

.

Pre-Run: 259.710.976 bytes beschikbaar

Post-Run: 197.201.920 bytes beschikbaar

.

- - End Of File - - 3CA3DACFA58491002625A0C29879EE50

kape · 13 juni 2011

En hoe gedraagt de PC zich nu ?

spinozella · 13 juni 2011

Beste kape

hierbij mijn laatse logfile van combofile na ingave CFScript in combofix.exe

HAd even een bericht gezien bij herstarten van malwarebyte maar heb dit genegeerd en cobofix verder laten lopen ...

Ik moet daarnet ergens de log fout hebben gepost op discussie , log is van deze namiddag en intussen heb ik verder kunnen werken evenwel traag en af en toe schijfopruiming maar daar weet ik van dat dit denk ik normaal is. Pc is ook niet meer nieuw en met windows xp prof erop mag ik denk ik niet beter verwachten...ik wissel af met laptop werk.

Ik w