PC erg traag

kweezie wabbit · 1 maart 2012

Open een nieuw kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Firefox::

FF - ProfilePath - c:\users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\78g70q58.default\

FF - prefs.js: browser.search.defaulturl - hxxp://go.mail.ru/search?fr=fftb&utf8in&q=

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/414

Sla dit bestand op je bureaublad op als CFScript

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht

Anne-Dieter · 1 maart 2012

ComboFix 12-03-01.01 - Anne 01-03-2012 18:56:28.4.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.3066.1351 [GMT 1:00]

Gestart vanuit: C:\Users\Anne\Downloads\ComboFix.exe

gebruikte Opdracht switches :: C:\Users\Anne\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

(((((((((((((((((((( Bestanden Gemaakt van 2012-02-01 to 2012-03-01 ))))))))))))))))))))))))))))))

2012-03-01 18:09:48 . 2012-03-01 18:09:48 -------- d-----w- C:\Users\Public\AppData\Local\temp

2012-03-01 18:09:48 . 2012-03-01 18:09:48 -------- d-----w- C:\Users\Default\AppData\Local\temp

2012-02-26 09:42:49 . 2012-02-26 09:42:49 388096 ----a-r- C:\Users\Anne\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-02-26 09:30:20 . 2012-02-26 09:30:23 -------- d-----w- C:\Program Files\Speccy

2012-02-25 19:14:46 . 2012-02-25 19:14:46 -------- d-----w- C:\Users\Anne\AppData\Roaming\Dropbox

2012-02-25 08:01:42 . 2012-02-25 08:01:42 -------- d-----w- C:\Users\Anne\AppData\Roaming\Microsoft Corporation

2012-02-22 05:00:55 . 2012-02-22 05:00:55 1798656 ----a-w- C:\Windows\system32\jscript9.dll

2012-02-22 05:00:54 . 2012-02-22 05:00:54 766976 ----a-w- C:\Program Files\Common Files\Microsoft Shared\vgx\VGX.dll

2012-02-22 05:00:54 . 2012-02-22 05:00:54 35840 ----a-w- C:\Windows\system32\imgutil.dll

2012-02-22 05:00:53 . 2012-02-22 05:00:53 149504 ----a-w- C:\Program Files\Internet Explorer\jsprofilerui.dll

2012-02-22 05:00:53 . 2012-02-22 05:00:53 110592 ----a-w- C:\Windows\system32\IEAdvpack.dll

2012-02-22 05:00:52 . 2012-02-22 05:00:52 386560 ----a-w- C:\Program Files\Internet Explorer\jsdbgui.dll

2012-02-22 05:00:52 . 2012-02-22 05:00:52 22016 ----a-w- C:\Program Files\Internet Explorer\ExtExport.exe

2012-02-20 17:01:58 . 2012-03-01 08:01:39 -------- d-----w- C:\Users\Anne\AppData\Roaming\Skype

2012-02-20 17:01:35 . 2012-02-20 17:01:35 -------- d-----w- C:\Program Files\Common Files\Skype

2012-02-20 17:01:34 . 2012-02-20 17:02:16 -------- d-----r- C:\Program Files\Skype

2012-02-20 17:01:28 . 2012-02-20 17:01:34 -------- d-----w- C:\ProgramData\Skype

2012-02-15 08:02:05 . 2011-12-14 16:17:47 680448 ----a-w- C:\Windows\system32\msvcrt.dll

2012-02-15 08:02:04 . 2012-01-12 19:52:56 2044416 ----a-w- C:\Windows\system32\win32k.sys

2012-02-15 08:02:03 . 2011-12-20 10:56:10 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat

2012-02-05 14:55:06 . 2012-02-05 14:55:09 -------- d-----w- C:\Program Files\DAEMON Tools Lite

2012-02-05 14:02:49 . 2012-02-05 14:02:49 -------- d-----w- C:\Program Files\Haali

2012-02-05 12:03:16 . 2012-02-05 12:03:16 -------- d-----w- C:\Users\Anne\AppData\Roaming\RealNetworks

2012-02-05 11:31:36 . 2012-02-05 11:31:36 -------- d-----w- C:\ProgramData\MySQL

2012-02-05 11:31:36 . 2012-02-05 11:31:36 -------- d-----w- C:\Program Files\MySQL

2012-02-05 11:28:40 . 2012-02-05 11:32:17 -------- d-----w- C:\ProgramData\Team MediaPortal

2012-02-05 11:28:37 . 2012-02-05 11:32:29 -------- d-----w- C:\Program Files\Team MediaPortal

2012-02-05 11:26:56 . 2008-05-30 13:18:52 238088 ----a-w- C:\Windows\system32\xactengine3_1.dll

2012-02-05 10:08:40 . 2012-02-05 10:08:46 -------- d-----w- C:\Users\Anne\AppData\Roaming\SkyMonk

2012-02-05 10:08:22 . 2012-02-07 06:57:50 -------- d-----w- C:\Program Files\Mail.Ru

2012-02-05 09:58:33 . 2012-02-05 09:58:33 -------- d-----w- C:\Users\Anne\AppData\Roaming\TeamViewer

2012-02-05 09:29:09 . 2012-02-05 09:31:38 -------- d-----w- C:\Users\Anne\AppData\Roaming\Corel

2012-02-05 09:29:05 . 2012-02-05 09:31:27 -------- d-----w- C:\ProgramData\Protexis

2012-02-05 09:28:26 . 2012-02-05 09:28:26 -------- d-----w- C:\Users\Anne\Corel

2012-02-05 09:26:24 . 2012-02-05 09:26:24 -------- d-----w- C:\Program Files\Common Files\Protexis

2012-02-05 09:26:22 . 2012-02-05 09:26:56 -------- d-----w- C:\ProgramData\Corel

2012-02-05 09:25:33 . 2010-11-16 15:24:48 13880 ----a-w- C:\Windows\system32\drivers\regi.sys

2012-02-05 09:24:52 . 2012-02-05 09:24:52 -------- d-----w- C:\Program Files\Corel

2012-02-05 09:01:17 . 2012-02-05 09:02:07 -------- d-----w- C:\Program Files\The KMPlayer

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

2012-02-05 14:55:49 . 2009-09-10 19:38:54 473656 ----a-w- C:\Windows\system32\drivers\sptd.sys

2012-02-05 14:47:07 . 2009-08-26 21:23:30 2397184 ----a-w- C:\Windows\system32\MPCVideoDec.ax

2011-12-12 06:50:10 . 2011-08-07 15:27:17 414368 ----a-w- C:\Windows\system32\FlashPlayerCPLApp.cpl

2011-12-10 14:24:06 . 2011-12-18 12:42:20 20464 ----a-w- C:\Windows\system32\drivers\mbam.sys

2012-02-26 15:47:29 . 2011-05-08 07:28:58 134104 ----a-w- C:\Program Files\mozilla firefox\components\browsercomps.dll

2010-06-29 11:23:12 . 2009-12-13 00:25:44 119808 ----a-w- C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-01-16 15:23:49 1811296 ----a-w- C:\Program Files\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "C:\Program Files\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll" [2012-01-16 15:23:49 1811296]

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-03-04 21:38:12 121392 ----a-w- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 02:25:11 125952]

"Xvid"="C:\Program Files\XviD\CheckUpdate.exe" [2011-01-17 19:41:43 8192]

"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 02:25:33 202240]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-21 17:33:42 68856]

"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\DTLite.exe" [2012-01-24 13:19:14 3478336]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2012-01-31 14:14:00 17147528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2008-04-28 07:35:36 6111232]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 03:31:22 1033512]

"eDataSecurity Loader"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 21:38:28 526896]

"eAudio"="C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 01:36:12 544768]

"ePower_DMC"="C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-23 13:58:54 397312]

"BkupTray"="C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 20:42:36 34040]

"ProductReg"="C:\Program Files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 04:53:32 6144]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 16:45:06 182808]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-08-07 07:05:10 13543968]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-08-07 07:05:46 92704]

"LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-02 02:51:00 821768]

"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-29 11:23:11 30192]

"ArcadeDeluxeAgent"="C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-05-12 21:10:54 147456]

"CLMLServer"="C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-05-12 21:11:04 167936]

"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-05-12 16:28:04 167936]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 09:44:34 31072]

"TrayServer"="C:\Program Files\MAGIX\Video_deluxe_15_Plus_Download-versie\TrayServer.exe" [2008-09-10 08:38:00 90112]

"DivXUpdate"="C:\Program Files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 15:32:28 1135912]

"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 00:52:06 59240]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 00:04:34 39792]

"AVG_TRAY"="C:\Program Files\AVG\AVG10\avgtray.exe" [2012-01-17 19:03:24 2339168]

"Windows Mobile-based device management"="C:\Windows\WindowsMobile\wmdSync.exe" [2008-01-21 02:23:24 215552]

"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2011-12-11 09:55:16 296056]

"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 10:59:52 254696]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 13:57:24 153136]

"APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 06:22:28 59240]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2011-10-09 17:06:40 421736]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2011-10-24 13:28:52 421888]

"vProt"="C:\Program Files\AVG Secure Search\vprot.exe" [2012-01-16 15:23:50 939872]

"Malwarebytes' Anti-Malware"="C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 13:53:18 460872]

"Malwarebytes' Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2012-01-13 13:53:16 981680]

"ROC_roc_dec12"="C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-16 15:23:59 928096]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

WinZip Quick Pick.lnk - C:\Program Files\Winzip\WZQKPICK.EXE [2009-11-18 495432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync\0C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart

[HKLM\~\startupfolder\C:^Users^Anne^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Orion.lnk]

backup=C:\Windows\pss\Orion.lnk.Startup

backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSetI]

2007-10-23 09:56:18 200704 ----a-w- C:\Windows\PLFSetI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

R3 A310;AVerMedia A310 DVB-T;C:\Windows\system32\DRIVERS\AVerA310USB.sys [2008-04-15 02:20:48 25856]

--- Andere Services/Drivers In Geheugen ---

*NewlyCreated* - WS2IFSL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

Inhoud van de 'Gedeelde Taken' map

2012-03-01 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-27 13:20:34 . 2009-11-27 13:20:25]

2012-03-01 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-27 13:20:34 . 2009-11-27 13:20:25]

------- Bijkomende Scan -------

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=2&o=vp32&d=0309&m=aspire_7730g

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\10.0.6\ViProtocol.dll

FF - ProfilePath - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\78g70q58.default\

kweezie wabbit · 2 maart 2012

Ben je zeker dat dit het volledige logje is?

Ik mis een een stuk op het einde en net dat moet ik hebben om te controleren of de fix correct is uitgevoerd.

Voer de fix eventueel opnieuw uit om een volledig logje te bekomen.

Anne-Dieter · 2 maart 2012

Dag Kweezie,

Heb het opnieuw gedaan, maar er kwam ook een melding dat combofix "verlopen" was.

Kreeg hem niet opnieuw geïnstalleerd. Er kwam tevens een melding dat niet de volledige mogelijkheden benut zouden worden.

Hierbij het nieuw txt bestandje.

ComboFix 12-02-25.02 - Anne 02-03-2012 18:15:03.5.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.3066.1436 [GMT 1:00]

Gestart vanuit: C:\Users\Anne\Downloads\ComboFix.exe

gebruikte Opdracht switches :: C:\Users\Anne\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

- VERMINDERDE FUNCTIONALITEIT MODUS -

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Users\Anne\AppData\Roaming\Help\coredb\storage

(((((((((((((((((((( Bestanden Gemaakt van 2012-02-02 to 2012-03-02 ))))))))))))))))))))))))))))))

2012-03-02 17:17:17 . 2012-03-02 17:17:17 -------- d-----w- C:\Users\Public\AppData\Local\temp

2012-03-02 17:17:17 . 2012-03-02 17:17:17 -------- d-----w- C:\Users\Default\AppData\Local\temp