Ga naar inhoud

download probleem

suske

Door suske
in Archief Windows Algemeen

 Delen

Aanbevolen berichten

suske Verkenner

suske

Geplaatst:
  • Auteur
Geplaatst:

logje van mbam

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Databaseversie: 7753

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

20/09/2011 11:20:26

mbam-log-2011-09-20 (11-20-26).txt

Scantype: Snelle scan

Objecten gescand: 178134

Verstreken tijd: 9 minuut/minuten, 37 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 30

Registerwaarden geïnfecteerd: 4

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 15

Bestanden geïnfecteerd: 27

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:

HKEY_CLASSES_ROOT\CLSID\{25B8D58C-B0CB-46b0-BA64-05B3804E4E86} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{AC5AB953-ED25-4f9c-87F0-B086B0178FFA} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{6160F76A-1992-4B17-A32D-0C706D159105} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\ExplorerBar.FunExplorer.1 (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\ExplorerBar.FunExplorer (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25B8D58C-B0CB-46B0-BA64-05B3804E4E86} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{25B8D58C-B0CB-46B0-BA64-05B3804E4E86} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25B8D58C-B0CB-46B0-BA64-05B3804E4E86} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{35B8D58C-B0CB-46b0-BA64-05B3804E4E86} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{C28A0312-C403-417b-A425-A915BC0519CD} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{877F3EAB-4462-44DF-8475-6064EAFD7FBF} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35B8D58C-B0CB-46B0-BA64-05B3804E4E86} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{35B8D58C-B0CB-46B0-BA64-05B3804E4E86} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35B8D58C-B0CB-46B0-BA64-05B3804E4E86} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{883DFC00-8A21-411d-956C-73A4E4B7D16F} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{480098C6-F6AD-4C61-9B5C-2BAE228A34D1} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\ExplorerBar.FunRedirector.1 (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\ExplorerBar.FunRedirector (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CDBFB47B-58A8-4111-BF95-06178DCE326D} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{CDBFB47B-58A8-4111-BF95-06178DCE326D} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CDBFB47B-58A8-4111-BF95-06178DCE326D} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8BCB5337-EC01-4E38-840C-A964F174255B} (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Media Access Startup (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16B6279B-9FF5-41fb-8BF9-404324F5DD1F}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1FB52AB3-5987-45a2-85E0-F3EC30DDDC29}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C5096216-7703-409E-B85A-8A6EE7395128}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{2224E955-00E9-4613-A844-CE69FCCAAE91} (Adware.DoubleD) -> Value: {2224E955-00E9-4613-A844-CE69FCCAAE91} -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{2224E955-00E9-4613-A844-CE69FCCAAE91} (Adware.DoubleD) -> Value: {2224E955-00E9-4613-A844-CE69FCCAAE91} -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC} (Adware.DoubleD) -> Value: {0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC} -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC} (Adware.DoubleD) -> Value: {0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC} -> Quarantined and deleted successfully.

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

c:\program files\internet saving optimizer (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160 (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\Data (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\FF (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\FF\components (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790 (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\Data (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\chrome (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\components (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\system search dispatcher (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\system search dispatcher\1.2.0.750 (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\system search dispatcher\1.2.0.750\Data (Adware.DoubleD) -> Quarantined and deleted successfully.

Bestanden geïnfecteerd:

c:\Users\suske\documents\downloads\freefox.exe (Adware.Dropper) -> Quarantined and deleted successfully.

c:\Windows\Temp\iLi31F0.tmp (Affiliate.Downloader) -> Quarantined and deleted successfully.

c:\Users\suske\local settings\temporary internet files\Content.IE5\Y3KYB4NW\installer_frostwire_4_18_5_nederlands_dutch[1].exe (PUP.SmsPay.pns) -> Not selected for removal.

c:\program files\internet saving optimizer\3.3.0.4160\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\FF\components\npffaddon.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\internet saving optimizer\3.3.0.4160\FF\components\npffhelpercomponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\HPCommon.dll (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\components\hpffaddon.dll (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\components\hpffaddon.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\media access startup\1.3.0.790\FF\components\hpffhelpercomponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\system search dispatcher\1.2.0.750\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\system search dispatcher\1.2.0.750\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\system search dispatcher\1.2.0.750\Data\eacore.mx (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\system search dispatcher\1.2.0.750\Data\urldynamic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.

c:\program files\system search dispatcher\1.2.0.750\Data\urlstatic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.

Link naar reactie
Delen op andere sites
  • Reacties 88
  • Aangemaakt
  • Laatste reactie

Beste reacties in dit topic

Populaire dagen

Beste reacties in dit topic

Populaire dagen

Geplaatste afbeeldingen

kape Grootmeester

kape

Geplaatst:
Geplaatst:

Dit lijkt maar een beperkt deel van het logje van Malwarebytes te zijn ... maar nu is al duidelijk dat er een hele berg rotzooi van je PC is verwijderd. Wil je Malwarebytes nu eens opnieuw laten scannen en hang daarna het nieuwe logje in een volgend bericht.

Link naar reactie
Delen op andere sites
suske Verkenner

suske

Geplaatst:
  • Auteur
Geplaatst:

2de scan log

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Databaseversie: 7753

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

21/09/2011 6:40:52

mbam-log-2011-09-21 (06-40-52).txt

Scantype: Snelle scan

Objecten gescand: 178386

Verstreken tijd: 11 minuut/minuten, 47 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 0

Registerwaarden geïnfecteerd: 0

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 1

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:

c:\Users\suske\local settings\temporary internet files\Content.IE5\Y3KYB4NW\installer_frostwire_4_18_5_nederlands_dutch[1].exe (PUP.SmsPay.pns) -> Quarantined and deleted successfully.

Link naar reactie
Delen op andere sites
kape Grootmeester

kape

Geplaatst:
Geplaatst:

Dit ziet er mooi uit ... Malwarebytes heeft een meer dan flinke hap uit je besmette bestanden genomen. Dan gaan we een volgende stap zetten :

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Link naar reactie
Delen op andere sites
kape Grootmeester

kape

Geplaatst:
Geplaatst:
hallo ,

om de antivirus te verwijderen heb je me de links gegeven van de combofix maar op de link krijg ik een bericht dat de sites onveilig zijn.

Een aantal antivirusprogramma's stellen - ten onrechte - dat Combofix niet veilig zou zijn. Dat is echter wel het geval. Indien je nà de melding van je antivirus verder kan werken, mag je dat gewoon doen : Combofix downloaden en laten scannen.
Link naar reactie
Delen op andere sites
suske Verkenner

suske

Geplaatst:
  • Auteur
Geplaatst:

hallo ,

hier het logje van combofix :top:

ComboFix 11-09-26.03 - suske 27/09/2011 12:20:38.1.2 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.32.1043.18.2686.1275 [GMT 2:00]

Gestart vanuit: E:\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

AV: Panda Antivirus Pro 2010 *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}

SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Panda Antivirus Pro 2010 *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Search Settings

c:\program files\Search Settings\SearchSettings.dll

c:\program files\Search Settings\SearchSettings.exe

c:\program files\Search Settings\SearchSettingsRes409.dll

c:\program files\Windows Searchqu Toolbar

c:\programdata\SPL2964.tmp

c:\programdata\SPL3449.tmp

c:\programdata\SPL37E0.tmp

c:\programdata\SPL4A29.tmp

c:\programdata\SPL6910.tmp

c:\programdata\SPL7004.tmp

c:\programdata\SPL7655.tmp

c:\programdata\SPL8077.tmp

c:\programdata\SPL80C0.tmp

c:\programdata\SPL87F7.tmp

c:\programdata\SPL8BDC.tmp

c:\programdata\SPL9C10.tmp

c:\programdata\SPLA6B9.tmp

c:\programdata\SPLB099.tmp

c:\programdata\SPLB782.tmp

c:\programdata\SPLD8E5.tmp

c:\programdata\SPLF67E.tmp

c:\users\suske\AppData\Local\Microsoft\Windows\Temporary Internet Files\TestBrowser.html

c:\windows\system32\comct332.ocx

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-08-27 to 2011-09-27 ))))))))))))))))))))))))))))))

.

.

2011-09-27 10:35 . 2011-09-27 10:36 -------- d-----w- c:\users\suske\AppData\Local\temp

2011-09-27 10:35 . 2011-09-27 10:35 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-09-20 09:08 . 2011-09-20 09:08 -------- d-----w- c:\users\suske\AppData\Roaming\Malwarebytes

2011-09-20 09:08 . 2011-09-20 09:08 -------- d-----w- c:\programdata\Malwarebytes

2011-09-20 09:08 . 2011-09-20 09:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-09-20 09:08 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-09-20 08:03 . 2011-09-20 08:03 388096 ----a-r- c:\users\suske\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-09-20 08:03 . 2011-09-20 08:03 -------- d-----w- c:\program files\Trend Micro

2011-09-18 09:06 . 2011-09-18 09:06 -------- d-----w- c:\program files\Common Files\AVG Secure Search

2011-09-18 09:06 . 2011-09-18 09:07 -------- d-----w- c:\program files\AVG Secure Search

2011-09-18 08:51 . 2011-09-18 08:51 -------- d-----w- c:\users\suske\AppData\Local\Panda Security

2011-09-18 08:50 . 2007-03-15 17:38 54832 ----a-w- c:\windows\system32\pavcpl.cpl

2011-09-18 08:50 . 2003-10-22 16:23 446464 ----a-w- c:\windows\system32\HHActiveX.dll

2011-09-18 08:49 . 2009-03-30 16:23 193792 ----a-w- c:\windows\system32\TpUtil.dll

2011-09-18 08:49 . 2009-03-30 16:22 87296 ----a-w- c:\windows\system32\PavLspHook.dll

2011-09-18 08:49 . 2009-03-30 16:22 55552 ----a-w- c:\windows\system32\pavipc.dll

2011-09-18 08:49 . 2007-02-08 08:53 107568 ----a-w- c:\windows\system32\SYSTOOLS.DLL

2011-09-18 08:49 . 2009-03-30 16:22 518400 ----a-w- c:\windows\system32\PavSHook.dll

2011-09-18 08:49 . 2009-08-06 10:29 49160 ----a-w- c:\windows\system32\drivers\amm8660.sys

2011-09-18 08:49 . 2008-03-18 14:58 58672 ----a-w- c:\windows\system32\avldr.dll

2011-09-18 08:49 . 2011-09-18 08:49 -------- d-----w- c:\windows\system32\PAV

2011-09-18 08:49 . 2011-09-18 08:50 -------- d-----w- c:\program files\Panda Security

2011-09-18 08:49 . 2011-09-18 08:49 -------- d-----w- c:\users\suske\AppData\Roaming\Panda Security

2011-09-18 08:49 . 2011-09-18 08:49 -------- d-----w- c:\programdata\Panda Security

2011-09-18 08:13 . 2009-06-30 08:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys

2011-09-18 08:12 . 2011-09-18 08:12 -------- d-----w- c:\program files\Common Files\Panda Security

2011-09-18 08:12 . 2009-06-30 15:17 163336 ----a-r- c:\windows\system32\drivers\PavProc.sys

2011-09-18 08:12 . 2008-03-04 13:59 41144 ----a-r- c:\windows\system32\drivers\ShlDrv51.sys

2011-09-17 12:54 . 2011-09-17 12:54 -------- d-----w- c:\program files\ESET

2011-09-17 12:31 . 2011-09-17 12:33 -------- d--h--w- c:\windows\msdownld.tmp

2011-09-17 10:28 . 2011-08-10 12:14 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-09-02 07:35 . 2011-09-02 07:35 -------- d-----w- c:\users\suske\Documents steaker

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-08-26 15:04 . 2011-05-22 03:30 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-08-25 11:21 . 2011-08-25 11:21 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-07-24 09:19 . 2011-07-24 09:19 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-07-22 02:54 . 2011-08-20 07:37 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-07-22 02:48 . 2011-08-20 07:37 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-07-22 02:44 . 2011-08-20 07:37 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-07-12 09:20 . 2011-07-12 09:20 83816 ----a-w- c:\windows\system32\dns-sd.exe

2011-07-12 09:20 . 2011-07-12 09:20 73064 ----a-w- c:\windows\system32\dnssd.dll

2011-07-11 13:25 . 2011-08-25 08:58 2048 ----a-w- c:\windows\system32\tzres.dll

2011-07-06 15:31 . 2011-08-19 06:47 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-07-05 16:37 . 2011-07-05 16:37 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2011-07-05 16:37 . 2011-07-05 16:37 69632 ----a-w- c:\windows\system32\QuickTime.qts

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-03-28 16:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95324e44-4b0a-47a9-8f77-9c6415e51c29}]

2011-06-27 10:05 175912 ----a-w- c:\program files\IncrediMail_MediaBar_Nederlands_2\prxtbIncr.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2011-09-18 09:06 1451336 ----a-w- c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{95324e44-4b0a-47a9-8f77-9c6415e51c29}"= "c:\program files\IncrediMail_MediaBar_Nederlands_2\prxtbIncr.dll" [2011-06-27 175912]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll" [2011-09-18 1451336]

.

[HKEY_CLASSES_ROOT\clsid\{95324e44-4b0a-47a9-8f77-9c6415e51c29}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{95324E44-4B0A-47A9-8F77-9C6415E51C29}"= "c:\program files\IncrediMail_MediaBar_Nederlands_2\prxtbIncr.dll" [2011-06-27 175912]

.

[HKEY_CLASSES_ROOT\clsid\{95324e44-4b0a-47a9-8f77-9c6415e51c29}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2011-09-22 366024]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-21 202024]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-04-22 247728]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]

"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 4702208]

"Skytel"="Skytel.exe" [2007-08-03 1826816]

"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2009-08-31 660136]

"lxdnamon"="c:\program files\Lexmark 2600 Series\lxdnamon.exe" [2009-08-31 16040]

"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2009-08-31 320168]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-09-10 2338656]

"IMBooster"="c:\program files\Iminent\IMBooster\imbooster.exe" [2011-03-30 1324008]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-18 421736]

"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2011-05-13 884584]

"APVXDWIN"="c:\program files\Panda Security\Panda Antivirus Pro 2010\APVXDWIN.EXE" [2009-09-25 906496]

"SCANINICIO"="c:\program files\Panda Security\Panda Antivirus Pro 2010\Inicio.exe" [2009-08-12 56064]

"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-09-18 218440]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]

2008-03-18 14:58 58672 ----a-w- c:\windows\System32\avldr.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 10:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

2007-08-21 13:52 1422632 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-08-18 23:07 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2011-07-05 16:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2007-08-17 05:27 4702208 ----a-w- c:\windows\RtHDVCpl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]

2007-08-03 05:22 1826816 ----a-w- c:\windows\SkyTel.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmpcSys]

2008-02-04 09:13 1038136 ----a-w- c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2006-11-10 10:35 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-04-20 20:57 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2007-03-01 13:24 857648 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]

2007-02-20 16:20 28672 ----a-w- c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2008-01-21 02:33 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2008-01-21 02:35 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R0 oxgijw;oxgijw;c:\windows\System32\drivers\xlnk.sys [x]

R0 ylygcak;ylygcak;c:\windows\System32\drivers\acaeh.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-01-31 136176]

R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]

R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-01-31 136176]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]

R3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe [2008-01-21 21504]

R3 StkCMini;Syntek AVStream USB2.0 VGA WebCam;c:\windows\system32\Drivers\StkCMini.sys [2007-09-26 1355520]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992]

S0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot.sys [2009-06-30 28552]

S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-04-04 297168]

S1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys [2008-03-04 41144]

S2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm8660.sys [2009-08-06 49160]

S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520]

S2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost [x]

S2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe [2008-02-19 537256]

S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2009-08-13 594600]

S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2009-08-13 98984]

S2 PavProc;Panda Process Protection Driver;c:\windows\system32\DRIVERS\PavProc.sys [2009-06-30 163336]

S2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Antivirus Pro 2010\PskSvc.exe [2009-08-25 28928]

S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2007-09-17 24576]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592]

S2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2011-09-18 246600]

S3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys [x]

S3 PavSRK.sys;PavSRK.sys;c:\windows\system32\PavSRK.sys [x]

S3 PavTPK.sys;PavTPK.sys;c:\windows\system32\PavTPK.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper

panda REG_MULTI_SZ Gwmsrv

.

Inhoud van de 'Gedeelde Taken' map

.

2011-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-31 17:01]

.

2011-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-31 17:01]

.

2011-09-27 c:\windows\Tasks\Uitgebreide garantie-suske.job

- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2008-10-14 09:13]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

mStart Page = hxxp://home.sweetim.com

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.1.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll

.

- - - - ORPHANS VERWIJDERD - - - -

.

BHO-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - c:\progra~1\IMESHA~1\MediaBar\ToolBar\imeshdtxmltbpi.dll

BHO-{3c490bf5-4244-4310-b4a7-3361f288dac5} - c:\program files\facesmoochtb\facesmoochDx.dll

BHO-{41069220-f72a-40ea-a8f3-bcd5e1fbc8f0} - c:\program files\facesmoochtb\auxi\facesmoochAu.dll

BHO-{474597C5-AB09-49d6-A4D5-2E8D7341384E} - c:\progra~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll

BHO-{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\BEARSH~1\MediaBar\ToolBar\bsdtxmltbpi.dll

BHO-{d48c9ead-f59f-4dea-ac97-7065fea79f42} - c:\progra~1\SHAREA~1\MediaBar\Datamngr\ToolBar\shdtxmltbpi.dll

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

Toolbar-10 - (no file)

Toolbar-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - c:\progra~1\IMESHA~1\MediaBar\ToolBar\imeshdtxmltbpi.dll

Toolbar-{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\BEARSH~1\MediaBar\ToolBar\bsdtxmltbpi.dll

Toolbar-!{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

Toolbar-!{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)

Toolbar-{3c490bf5-4244-4310-b4a7-3361f288dac5} - c:\program files\facesmoochtb\facesmoochDx.dll

Toolbar-{d48c9ead-f59f-4dea-ac97-7065fea79f42} - c:\progra~1\SHAREA~1\MediaBar\Datamngr\ToolBar\shdtxmltbpi.dll

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - (no file)

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

HKCU-Run-ares - c:\program files\Ares\Ares.exe

HKCU-Run-BitComet - c:\program files\BitComet\BitComet.exe

HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe

HKLM-Run-Blubster - c:\program files\Blubster\Blubster.exe

HKLM-Run-Piolet - c:\program files\Piolet\Piolet.exe

HKLM-Run-NapsterShell - c:\program files\Napster\napster.exe

MSConfigStartUp-CarboniteSetupLite - c:\program files\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe

MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe

MSConfigStartUp-CLMLServer - c:\program files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe

MSConfigStartUp-Google Update - c:\users\suske\AppData\Local\Google\Update\GoogleUpdate.exe

MSConfigStartUp-lxbkbmgr - c:\program files\Lexmark X1100 Series\lxbkbmgr.exe

MSConfigStartUp-PCMAgent - c:\program files\CyberLink\PowerCinema\PCMAgent.exe

MSConfigStartUp-PlayMovie - c:\program files\CyberLink\PlayMovie\PMVService.exe

MSConfigStartUp-RestartNeroSetup - d:\installation\Setupx.exe

MSConfigStartUp-SearchSettings - c:\program files\Search Settings\SearchSettings.exe

MSConfigStartUp-SmileyApp - c:\program files\DoubleD\JuicyAccess Toolbar\4.1.0.17730\stbapp.exe

MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-09-27 12:36

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

msnmsgr = "c:\program files\Windows Live\Messenger\msnmsgr.exe" /background??s

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

Voltooingstijd: 2011-09-27 12:59:05

ComboFix-quarantined-files.txt 2011-09-27 10:58

.

Pre-Run: 121.918.480.384 bytes beschikbaar

Post-Run: 122.073.608.192 bytes beschikbaar

.

- - End Of File - - E0D4A30CDFDEAE6C9B42F70BEF5C7456

Link naar reactie
Delen op andere sites
kape Grootmeester

kape

Geplaatst:
Geplaatst: (aangepast)

Je hebt twee antivirusprogramma's : Panda & AVG. Gebruik je die allebei actief of is het enkel de bedoeling dat AVG je actieve scanner is ? Want dan zal je best de andere verwijderen. Twee programma's van die aard werken elkaar eerder tegen, dan een betere beveiliging te verzekeren. In je logje zitten overigens nog sporen van andere scanners (o.a. ESET en Symantec/Norton). Wil je even laten weten welke scanner je verkiest, dan kunnen we al de rest ook mee opruimen.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\System32\drivers\xlnk.sys

c:\windows\System32\drivers\acaeh.sys

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95324e44-4b0a-47a9-8f77-9c6415e51c29}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

[-HKEY_CLASSES_ROOT\clsid\{95324e44-4b0a-47a9-8f77-9c6415e51c29}]

[-HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

[-HKEY_CLASSES_ROOT\clsid\{95324e44-4b0a-47a9-8f77-9c6415e51c29}]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

DDS::

mStart Page = hxxp://home.sweetim.com

Driver::

oxgijw

ylygcak

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

aangepast door kape
Link naar reactie
Delen op andere sites
Gast
Dit topic is nu gesloten voor nieuwe reacties.
 Delen
Ga naar topic overzicht
Logo

OVER ONS

PC Helpforum helpt GRATIS computergebruikers sinds juli 2006. Ons team geeft via het forum professioneel antwoord op uw vragen en probeert uw pc problemen zo snel mogelijk op te lossen. Word lid vandaag, plaats je vraag online en het PC Helpforum-team helpt u graag verder!

SITEMAP

×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.