laptop traag virus

kape · 30 juni 2012

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Registry::

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

[-HKEY_CLASSES_ROOT\clsid\{6cf8b227-dcd0-43a1-bd25-07f7a4573198}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6cf8b227-dcd0-43a1-bd25-07f7a4573198}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

[-HKEY_CLASSES_ROOT\clsid\{6cf8b227-dcd0-43a1-bd25-07f7a4573198}] [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

[-HKEY_CLASSES_ROOT\clsid\{6cf8b227-dcd0-43a1-bd25-07f7a4573198}]

Firefox::

FF - ProfilePath - c:\users\Gebruiker\AppData\Roaming\Mozilla\Firefox\Profiles\2sz174i5.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: keyword.URL -

Sla dit bestand op je bureaublad op als CFScript.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Neymar · 30 juni 2012

ComboFix 12-06-28.03 - Gebruiker 30/06/2012 16:07:18.6.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.3070.553 [GMT 2:00]

Gestart vanuit: c:\users\Gebruiker\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Gebruiker\Desktop\CFScript.txt

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Gebruiker\AppData\Local\assembly\tmp

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-05-28 to 2012-06-30 ))))))))))))))))))))))))))))))

.

2012-06-30 14:33 . 2012-06-30 14:33 -------- d-----w- c:\users\Gebruiker\AppData\Local\temp

2012-06-30 14:33 . 2012-06-30 14:33 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-06-30 14:33 . 2012-06-30 14:33 -------- d-----w- c:\users\Public\AppData\Local\temp

2012-06-30 14:33 . 2012-06-30 14:33 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-30 11:40 . 2012-06-30 11:40 -------- d-----w- c:\users\Gebruiker\AppData\Local\Pando_Temp

2012-06-29 19:27 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-29 19:27 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-29 19:27 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-29 19:27 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-29 19:26 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-29 19:26 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-24 16:23 . 2012-06-18 01:14 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{239579C0-C81E-42A6-9868-8087978E50E7}\mpengine.dll

2012-06-24 16:21 . 2011-10-19 20:16 20312 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe

2012-06-24 15:51 . 2012-06-24 16:07 -------- d-----w- c:\programdata\IObit

2012-06-24 15:50 . 2012-06-24 15:55 -------- d-----w- c:\users\Gebruiker\AppData\Roaming\IObit

2012-06-24 15:50 . 2012-06-24 16:07 -------- d-----w- c:\program files\IObit

2012-06-24 12:12 . 2011-09-01 09:38 767952 ----a-w- c:\windows\BDTSupport.dll

2012-06-24 12:12 . 2011-09-01 09:39 1533904 ----a-w- c:\windows\PCTBDRes.dll

2012-06-24 12:12 . 2011-09-01 09:39 149456 ----a-w- c:\windows\SGDetectionTool.dll

2012-06-24 12:12 . 2011-09-01 09:39 2189264 ----a-w- c:\windows\PCTBDCore.dll

2012-06-24 12:09 . 2012-06-24 12:23 -------- d-----w- c:\program files\PC Tools Security

2012-06-19 11:36 . 2012-05-15 10:26 8105280 ----a-w- c:\windows\system32\nvwgf2um.dll

2012-06-19 11:35 . 2012-05-15 10:26 19607872 ----a-w- c:\windows\system32\nvoglv32.dll

2012-06-19 11:35 . 2012-05-15 10:26 11354944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2012-06-19 11:35 . 2012-05-15 10:26 5982528 ----a-w- c:\windows\system32\nvcuda.dll

2012-06-19 11:35 . 2012-05-15 10:26 2524992 ----a-w- c:\windows\system32\nvcuvid.dll

2012-06-19 11:35 . 2012-05-15 10:26 2445120 ----a-w- c:\windows\system32\nvcuvenc.dll

2012-06-19 11:35 . 2012-05-15 10:26 17551680 ----a-w- c:\windows\system32\nvcompiler.dll

2012-06-19 11:09 . 2012-06-19 11:08 772592 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-06-19 11:06 . 2012-06-19 11:06 -------- d-----w- c:\users\Gebruiker\AppData\Local\Macromedia

2012-06-19 11:05 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll

2012-06-19 11:05 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll

2012-06-19 11:05 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll

2012-06-19 11:03 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-19 11:03 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys

2012-06-09 23:46 . 2012-06-09 23:46 -------- d-----w- c:\program files\Microsoft Synchronization Services

2012-06-09 23:45 . 2012-06-09 23:45 -------- d-----w- c:\program files\Microsoft Sync Framework

2012-06-09 23:45 . 2012-06-09 23:45 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition

2012-06-09 23:40 . 2012-06-09 23:40 -------- d-----w- c:\program files\Microsoft Analysis Services

2012-06-08 20:44 . 2011-07-20 13:13 35328 ----a-w- c:\windows\system32\drivers\RimSerial.sys

2012-06-08 20:42 . 2012-06-08 20:42 -------- d-----w- c:\programdata\Research In Motion

2012-06-08 20:41 . 2012-06-08 20:42 -------- d-----w- c:\program files\Common Files\XCPCSync.OEM

2012-06-07 16:41 . 2012-06-07 16:41 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll

2012-06-07 16:41 . 2012-06-07 16:41 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll

2012-06-01 18:45 . 2012-06-24 14:40 -------- d-----r- c:\users\Gebruiker\Dropbox

2012-06-01 18:43 . 2012-06-01 18:43 -------- d-----w- c:\program files\Dropbox

2012-06-01 18:42 . 2012-06-24 14:40 -------- d-----w- c:\users\Gebruiker\AppData\Roaming\Dropbox

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-23 18:36 . 2012-04-04 11:50 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-23 18:36 . 2011-06-12 12:19 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-06-19 11:08 . 2010-10-01 16:10 687600 ----a-w- c:\windows\system32\deployJava1.dll

2012-05-23 18:46 . 2012-05-23 18:46 16304 ----a-w- c:\windows\system32\apl003.sys

2012-05-23 18:46 . 2012-05-23 18:46 13232 ----a-w- c:\windows\system32\apf003.sys

2012-05-15 10:26 . 2011-08-10 11:59 883008 ----a-w- c:\windows\system32\nvgenco32.dll

2012-05-15 10:26 . 2011-08-10 11:59 61248 ----a-w- c:\windows\system32\OpenCL.dll

2012-05-15 10:26 . 2011-08-10 11:59 1000768 ----a-w- c:\windows\system32\nvdispco32.dll

2012-05-15 10:26 . 2007-07-19 00:31 2368832 ----a-w- c:\windows\system32\nvapi.dll

2012-05-15 10:26 . 2007-07-19 00:31 15322432 ----a-w- c:\windows\system32\nvd3dum.dll

2012-05-15 09:28 . 2011-01-07 19:06 2561344 ----a-w- c:\windows\system32\nvsvcr.dll

2012-05-15 09:28 . 2011-01-07 19:06 645440 ----a-w- c:\windows\system32\nvvsvc.exe

2012-05-15 09:28 . 2011-01-07 19:06 108352 ----a-w- c:\windows\system32\nvmctray.dll

2012-05-15 09:28 . 2009-09-01 01:10 62272 ----a-w- c:\windows\system32\nvshext.dll

2012-05-15 09:28 . 2011-01-07 19:06 3931456 ----a-w- c:\windows\system32\nvcpl.dll

2012-05-15 09:27 . 2011-01-07 19:06 2759488 ----a-w- c:\windows\system32\nvsvc.dll

2012-05-15 00:21 . 2012-05-15 00:21 423744 ----a-w- c:\windows\system32\nvStreaming.exe

2012-04-04 13:56 . 2010-08-31 23:00 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-04-03 08:16 . 2012-05-11 18:47 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-04-03 08:16 . 2012-05-11 18:47 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-06-16 16:23 . 2012-05-14 17:13 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-03-06 23:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-15 00:32 94208 ----a-w- c:\users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-15 00:32 94208 ----a-w- c:\users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-15 00:32 94208 ----a-w- c:\users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-15 00:32 94208 ----a-w- c:\users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"Akamai NetSession Interface"="c:\users\Gebruiker\AppData\Local\Akamai\netsession_win.exe" [2012-05-26 4327744]

"Facebook Update"="c:\users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-04-18 137536]

"Spotify Web Helper"="c:\users\Gebruiker\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-06-29 1192664]

"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2011-11-12 1647448]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-25 8129056]

"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2008-10-06 638976]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-02-12 174872]

"OSD"="c:\program files\C&E\OSD\osd.exe" [2007-09-20 561152]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448]

"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-09-01 247760]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe" [2012-05-05 351904]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKLM\~\startupfolder\C:^Users^Gebruiker^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]

path=c:\users\Gebruiker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk

backup=c:\windows\pss\LimeWire On Startup.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]

2010-03-13 12:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-03-21 18:56 1230704 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-04-28 13:06 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2012-03-08 16:50 4280184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MurGee.com Auto Clicker]

2012-02-07 11:03 49480 ----a-w- c:\program files\Auto Clicker\AutoClicker.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-03-17 19:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]

2012-06-29 20:51 7609560 ----a-w- c:\users\Gebruiker\AppData\Roaming\Spotify\spotify.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-954086183-1671949515-1526744126-1002]

"EnableNotificationsRef"=dword:00000001

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

Akamai REG_MULTI_SZ Akamai

.

Inhoud van de 'Gedeelde Taken' map

.

2012-06-30 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 18:36]

.

2012-06-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-954086183-1671949515-1526744126-1002Core.job

- c:\users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-18 16:55]

.

2012-06-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-954086183-1671949515-1526744126-1002UA.job

- c:\users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-18 16:55]

.

2012-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 19:56]

.

2012-06-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 19:56]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.com

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = local;<local>

IE: &Verzenden naar OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000

LSP: pcapwsp.dll

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{2E63F5B9-1F12-40AA-B9E9-0B9FFEEEC37E}: NameServer = 8.8.8.8,8.8.4.4

FF - ProfilePath - c:\users\Gebruiker\AppData\Roaming\Mozilla\Firefox\Profiles\2sz174i5.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxps://www.google.be/

.

- - - - ORPHANS VERWIJDERD - - - -

.

HKCU-Run-PlayNC Launcher - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-06-30 16:33

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

c:\program files\Internet Explorer\iexplore.exe [3016] 0x88F57348

c:\program files\Internet Explorer\iexplore.exe [5424] 0x8544B020

c:\program files\Internet Explorer\iexplore.exe [6080] 0x8A0D0CB0

c:\program files\Internet Explorer\iexplore.exe [2796] 0x88EF2D20

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_80c2ffa.dll"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{6CF8B227-DCD0-43A1-BD25-07F7A4573198}"=hex:51,66,7a,6c,4c,1d,38,12,49,b1,eb,

68,e2,92,cf,06,c2,33,44,b7,a1,09,75,8c

"{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}"=hex:51,66,7a,6c,4c,1d,38,12,3a,25,4d,

8a,1f,e3,d1,0d,d3,3b,92,3f,05,d7,c9,12

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:de,1e,e0,de,7f,e2,cc,01

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,87,d8,1f,e3,a0,15,c6,43,96,25,a6,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,87,d8,1f,e3,a0,15,c6,43,96,25,a6,\

.

[HKEY_USERS\S-1-5-21-954086183-1671949515-1526744126-1002\Software\SecuROM\License information*]

"datasecu"=hex:cf,68,81,e5,ef,66,c3,b4,b5,1f,d9,ca,30,85,e3,06,74,bc,42,80,10,

a6,ef,0c,e3,c3,4c,fa,8c,08,79,77,81,aa,e3,c4,79,b3,12,3c,d0,87,8b,77,1d,1a,\

"rkeysecu"=hex:98,61,79,c9,42,0c,bd,70,31,d2,f3,74,78,48,ee,a9

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'Explorer.exe'(3048)

c:\users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

Voltooingstijd: 2012-06-30 16:41:38

ComboFix-quarantined-files.txt 2012-06-30 14:41

ComboFix2.txt 2012-06-29 20:40

ComboFix3.txt 2010-11-09 16:31

.

Pre-Run: 76.881.440.768 bytes beschikbaar

Post-Run: 76.830.240.768 bytes beschikbaar

.

- - End Of File - - 4D4DC26F15A251882421BE4B8354AA38

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:43:46, on 30/06/2012

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v9.00 (9.00.8112.16446)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Pando Networks\Media Booster\PMB.exe

C:\ComboFix\CF1114.3XE

C:\Windows\Explorer.exe

C:\ComboFix\handle.3XE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;<local>

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s

O4 - HKLM\..\Run: [sMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [OSD] C:\Program Files\C&E\OSD\osd.exe

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

O4 - HKLM\..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Gebruiker\AppData\Local\Akamai\netsession_win.exe"

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKCU\..\Run: [spotify Web Helper] "C:\Users\Gebruiker\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /Manual

O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe -update activex (User 'SYSTEEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe -update activex (User 'Default user')

O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: pcapwsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{2E63F5B9-1F12-40AA-B9E9-0B9FFEEEC37E}: NameServer = 8.8.8.8,8.8.4.4

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

O23 - Service: OsdService - Unknown owner - C:\Program Files\C&E\OSD\OsdService\OsdService.exe

O23 - Service: ProxyCap Service (pcapsvc) - Proxy Labs - C:\Program Files\Proxy Labs\ProxyCap\pcapsvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

--

End of file - 9234 bytes

kape · 30 juni 2012

Hoe staat het nu met de snelheid (of traagheid) van de laptop ?

Neymar · 30 juni 2012

In ieder geval beter, ik had schrik voor virussen maar dat is dus niet het geval?

kape · 1 juli 2012

In ieder geval beter, ik had schrik voor virussen maar dat is dus niet het geval?

Neen, dat zeker niet. Maar we kunnen nog wel even een extraatje uitvoeren :

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Neymar · 8 juli 2012

ComboFix 12-06-28.03 - Gebruiker 08/07/2012 22:06:40.7.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.3070.1660 [GMT 2:00]

Gestart vanuit: c:\users\Gebruiker\Desktop\ComboFix.exe

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-06-08 to 2012-07-08 ))))))))))))))))))))))))))))))

.

2012-07-08 20:31 . 2012-07-08 20:31 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-07-08 20:31 . 2012-07-08 20:31 -------- d-----w- c:\users\Public\AppData\Local\temp

2012-07-08 20:31 . 2012-07-08 20:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-05 10:30 . 2012-07-05 10:30 -------- d-----w- c:\program files\FLVPlayer

2012-07-04 15:28 . 2012-07-04 15:28 -------- d-----w- c:\users\Gebruiker\AppData\Local\TVU Networks

2012-07-04 15:28 . 2012-07-04 15:28 -------- d-----w- c:\programdata\TVU Networks

2012-07-04 15:28 . 2012-07-04 15:28 -------- d-----w- c:\program files\TVUPlayer

2012-07-02 22:06 . 2012-07-02 22:06 670816 ----a-w- c:\windows\system32\xsherlock.xem

2012-07-02 22:03 . 2012-03-27 17:13 230920 ----a-w- c:\windows\system32\EPWZCmnCtrl.dll

2012-07-02 22:03 . 2012-07-02 22:03 -------- d-----w- c:\program files\WEBZEN

2012-07-02 22:03 . 2012-07-02 22:03 -------- d-----w- c:\programdata\WEBZEN

2012-07-02 21:59 . 2012-07-02 21:59 -------- d-----w- c:\users\Gebruiker\AppData\Local\Overwolf

2012-07-02 21:59 . 2012-07-02 21:59 -------- d-----w- c:\windows\DEA314C409294250BC9298E4C105F28D.TMP

2012-07-02 14:18 . 2012-07-02 14:18 -------- d-----w- c:\users\Gebruiker\AppData\Local\WinZip

2012-07-02 14:17 . 2012-07-02 14:18 -------- d-----w- c:\programdata\WinZip

2012-07-02 12:19 . 2012-07-08 16:39 -------- d-----w- c:\users\Gebruiker\AppData\Roaming\BITS

2012-07-02 12:19 . 2012-07-02 12:19 -------- d-----w- c:\users\Gebruiker\AppData\Roaming\FlashgetSetup

2012-07-02 12:19 . 2012-07-02 14:10 -------- d-----w- c:\users\Gebruiker\AppData\Roaming\FlashGet

2012-07-02 12:19 . 2012-07-02 12:19 -------- d-----w- c:\program files\FlashGet Network

2012-06-30 22:16 . 2012-06-30 22:16 -------- d-----w- c:\users\Gebruiker\AppData\Local\Chromium

2012-06-30 14:41 . 2012-07-08 20:31 -------- d-----w- c:\users\Gebruiker\AppData\Local\temp

2012-06-30 11:40 . 2012-06-30 11:40 -------- d-----w- c:\users\Gebruiker\AppData\Local\Pando_Temp

2012-06-29 19:27 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-29 19:27 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-29 19:27 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-29 19:27 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-29 19:26 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-29 19:26 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-29 19:26 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll