PC loopt vast na enkele (1-2) minuten

philbuy · 25 juni 2012

ComboFix 12-06-25.02 - philip 25/06/2012 11:25:27.2.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2936.1788 [GMT 2:00]

Gestart vanuit: c:\users\philip\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\philip\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Outdated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Outdated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\Tasks\0.job"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\Tasks\0.job

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-05-25 to 2012-06-25 ))))))))))))))))))))))))))))))

.

2012-06-25 09:40 . 2012-06-25 09:40 -------- d-----w- c:\users\Marleen\AppData\Local\temp

2012-06-25 09:40 . 2012-06-25 09:40 -------- d-----w- c:\users\Ghislain\AppData\Local\temp

2012-06-25 09:40 . 2012-06-25 09:40 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-25 06:59 . 2012-06-25 06:59 -------- d-----w- c:\program files\AVG Secure Search

2012-06-23 06:00 . 2012-06-23 06:01 -------- d-----w- c:\users\Administrator

2012-06-22 17:03 . 2012-06-25 07:16 -------- d-----w- c:\programdata\AVG Secure Search

2012-06-22 17:03 . 2012-06-22 17:03 -------- d-----w- c:\program files\Common Files\AVG Secure Search

2012-06-22 17:00 . 2012-06-22 17:00 -------- d-----w- C:\$AVG

2012-06-22 17:00 . 2012-06-22 17:04 -------- d-----w- c:\programdata\AVG2012

2012-06-22 15:09 . 2012-06-18 01:14 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5653ADA7-4C1B-471F-BF60-C003DBC5F742}\mpengine.dll

2012-06-22 13:08 . 2012-06-22 16:33 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2012-06-22 08:59 . 2012-06-22 08:59 -------- d-----w- c:\program files\Trend Micro

2012-06-22 07:31 . 2012-06-22 09:04 -------- d-----w- c:\programdata\blekko toolbars

2012-06-22 07:31 . 2012-06-22 07:31 -------- d-----w- c:\programdata\Anti-phishing Domain Advisor

2012-06-22 06:15 . 2012-06-22 06:16 -------- d-----w- c:\users\philip

2012-06-22 03:29 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-22 03:29 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-22 03:29 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-22 03:29 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-21 04:09 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-21 04:09 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys

2012-06-19 15:44 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-19 15:44 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-04 14:13 . 2012-06-04 14:13 -------- d-----w- c:\programdata\WindowsSearch

2012-05-29 19:29 . 2012-05-29 19:29 -------- d-----w- c:\programdata\rocqirsjswuqywe

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-05 17:45 . 2012-04-20 17:30 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-05-05 17:45 . 2011-06-27 16:41 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-19 02:50 . 2012-04-19 02:50 24896 ----a-w- c:\windows\system32\drivers\avgidshx.sys

2012-04-04 13:56 . 2011-01-11 07:26 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-04-03 08:16 . 2012-05-12 06:39 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-04-03 08:16 . 2012-05-12 06:39 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-03-30 12:39 . 2012-05-12 06:40 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys

2007-01-24 10:26 . 2010-06-25 20:09 13312 ----a-w- c:\program files\CreateCDGUI.exe

2006-12-12 14:07 . 2010-06-25 20:09 679152 ----a-w- c:\program files\mkisowin.exe

2006-01-17 10:08 . 2010-06-25 20:09 438272 ----a-w- c:\program files\BurnMe.exe

2002-11-12 14:20 . 2010-06-25 20:09 462336 ----a-w- c:\program files\vdscimg.dll

2000-05-06 04:51 . 2010-06-25 20:09 332800 ----a-w- c:\program files\vdsrun30dll.xxx

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-06-25 06:59 2068536 ----a-w- c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-06-25 2068536]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]

"RtHDVCpl"="RtHDVCpl.exe" [2008-04-28 6111232]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]

"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-23 397312]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]

"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-25 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-25 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-25 145944]

"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]

"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-07 30192]

"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2009-01-24 3625984]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]

"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]

"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]

"Belgacom"="c:\program files\Belgacom\bin\sprtcmd.exe" [2008-05-29 202016]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-06-25 1104440]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]

2009-01-24 14:28 2938880 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]

@="Service"

.

[HKLM\~\startupfolder\C:^Users^Ghislain^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ctfmon.lnk]

backup=c:\windows\pss\ctfmon.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Marleen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]

backup=c:\windows\pss\LimeWire On Startup.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]

2012-04-05 03:12 2587008 ----a-w- c:\program files\AVG\AVG2012\avgtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]

2012-04-04 13:56 462408 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]

2006-10-25 08:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt]

2012-06-25 06:59 1104440 ----a-w- c:\program files\AVG Secure Search\vprot.exe

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Inhoud van de 'Gedeelde Taken' map

.

2012-06-25 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-20 17:45]

.

2012-06-21 c:\windows\Tasks\Auto Backup for Ghislain.job

- c:\program files\Packard Bell\Packard Bell Software Suite\DSMsg.exe [2008-01-09 14:14]

.

2012-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 16:40]

.

2012-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 16:40]

.

2012-06-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-75373782-2752769981-735008259-1003Core.job

- c:\users\Ghislain\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-27 17:30]

.

2012-06-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-75373782-2752769981-735008259-1003UA.job

- c:\users\Ghislain\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-27 17:30]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

mStart Page = hxxp://nl.intl.acer.yahoo.com

TCP: DhcpNameServer = 192.168.1.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll

.

- - - - ORPHANS VERWIJDERD - - - -

.

WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-06-25 11:40

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'Explorer.exe'(2180)

c:\windows\System32\SysHook.dll

c:\windows\system32\btncopy.dll

.

Voltooingstijd: 2012-06-25 11:43:56

ComboFix-quarantined-files.txt 2012-06-25 09:43

ComboFix2.txt 2012-06-25 07:59

.

Pre-Run: 64.488.771.584 bytes beschikbaar

Post-Run: 64.463.716.352 bytes beschikbaar

.

- - End Of File - - 2D011612780E0752F78989B3537B7F54

kape · 25 juni 2012

Dan mag je deze vetgedrukte mappen nog verwijderen :

c:\programdata\blekko toolbars

c:\programdata\rocqirsjswuqywe

En hoe is de toestand dan ?

philbuy · 25 juni 2012