Internet loopt regelmatig vast door een script dat bezig is.

kweezie wabbit · 25 oktober 2012

Geen probleem, ik heb het 2 de bericht in de prullenbak gekieperd.

De fix is blijkbaar toch niet helemaal gelukt

Start de pc op in veilige modus.

Sluit alle openstaande vensters en toepassingen.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht

InternetMarketer · 25 oktober 2012

Hallo,

Even een paar opmerkingen en vragen voordat ik verder ga:

1) Ik zie dat Combifix geen log bestand heeft opgeslagen.

Combifix opende vanzelf een log na de scan.

Hiervan heb ik de inhoud in dit forum geplakt.

2) Ik heb Combifix als snelkoppeling op mijn bureaublad.

3) Hoe kan ik mijn computer in de veilige modus starten?

4) Waar moet ik nu precies starten om de juiste scans uit te voeren en jou de goede resultaten te laten zien?

Alvast bedankt...

kweezie wabbit · 25 oktober 2012

In bericht nr 6 staat het volgende:

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

Verwijder dus de snelkoppeling naar combofix van het bureaublad en verplaats combofix.exe van de huidige locatie naar het bureaublad.

Het bestand CFScript.txt staat reeds op je bureaublad en dat is dus ok.

Combofix slaat normaal de logjes op rechtstreeks op de C schijf onder de naam combofix.txt

Om op te starten in veilige modus druk je herhaaldelijk op de toets F8 onmiddellijk na het aanzetten van de stroom.

InternetMarketer · 25 oktober 2012

Ik heb nu Combifix.exe op m'n bureaublad.

Starten in de veilige modus wil me niet lukken.

Ik heb twee keer geprobeerd op te starten en gelijk na de start een paar keer op F8 gedrukt, maar ik kreeg beide keren niet de mogelijkheid om voor veilige modus te kiezen.

Ik heb nu Combifix in de normale situatie gescand, hopende dat de vorige versie op mijn bureaublad het probleem was.

Combifix heeft nu wel een log bestand opgeslagen.

Hieronder vind je de inhoud van deze log.

Ik hoop dat het nu wel de juiste informatie geeft:

ComboFix 12-10-25.01 - acer m3641 25-10-2012 14:01:48.3.4 - x64

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.4094.1890 [GMT 2:00]

Gestart vanuit: c:\users\acer m3641\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\acer m3641\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-09-25 to 2012-10-25 ))))))))))))))))))))))))))))))

.

2012-10-25 12:28 . 2012-10-25 12:28 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-10-25 12:28 . 2012-10-25 12:28 -------- d-----w- c:\users\acer m3641\AppData\Local\temp

2012-10-25 12:28 . 2012-10-25 12:28 -------- d-----w- c:\users\Evert\AppData\Local\temp

2012-10-24 14:48 . 2012-10-25 11:55 -------- d-----w- C:\32788R22FWJFW

2012-10-24 07:10 . 2012-10-24 07:10 -------- d-----w- c:\users\acer m3641\AppData\Roaming\Malwarebytes

2012-10-24 07:10 . 2012-10-24 07:10 -------- d-----w- c:\programdata\Malwarebytes

2012-10-24 07:10 . 2012-10-24 07:10 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-10-24 07:10 . 2012-09-29 17:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-10-23 16:33 . 2012-10-23 16:33 388096 ----a-r- c:\users\acer m3641\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-10-23 16:33 . 2012-10-23 16:33 -------- d-----w- c:\program files (x86)\Trend Micro

2012-10-23 14:29 . 2012-10-17 00:31 9291768 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{28EE2000-10E4-4061-B972-0BBCBEB6B0AD}\mpengine.dll

2012-10-19 15:38 . 2012-09-24 21:16 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-10-11 05:35 . 2012-10-20 07:25 12872 ----a-w- c:\windows\system32\bootdelete.exe

2012-10-10 05:10 . 2012-09-13 13:45 2048 ----a-w- c:\windows\system32\tzres.dll

2012-10-10 05:10 . 2012-09-13 13:28 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-10-10 05:10 . 2012-08-24 16:07 218624 ----a-w- c:\windows\system32\wintrust.dll

2012-10-10 05:10 . 2012-08-24 15:53 172544 ----a-w- c:\windows\SysWow64\wintrust.dll

2012-10-10 05:10 . 2012-06-02 00:20 1268736 ----a-w- c:\windows\system32\crypt32.dll

2012-10-10 05:10 . 2012-06-02 00:20 174592 ----a-w- c:\windows\system32\cryptsvc.dll

2012-10-10 05:10 . 2012-06-02 00:20 132096 ----a-w- c:\windows\system32\cryptnet.dll

2012-10-10 05:10 . 2012-06-02 00:02 985088 ----a-w- c:\windows\SysWow64\crypt32.dll

2012-10-10 05:10 . 2012-06-02 00:02 133120 ----a-w- c:\windows\SysWow64\cryptsvc.dll

2012-10-10 05:10 . 2012-06-02 00:02 98304 ----a-w- c:\windows\SysWow64\cryptnet.dll

2012-10-10 05:10 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-10-09 08:16 . 2012-10-09 08:16 -------- d-----w- c:\program files (x86)\Market Samurai

2012-10-04 08:36 . 2012-10-24 06:54 -------- d-----w- c:\programdata\webex

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-11 05:12 . 2006-11-02 12:35 65309168 ----a-w- c:\windows\system32\mrt.exe

2012-10-09 09:23 . 2012-04-11 08:48 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-10-09 09:23 . 2011-10-22 05:46 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-09-10 18:35 . 2012-09-10 18:36 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-09-10 18:35 . 2010-09-13 17:32 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-08-24 11:15 . 2012-09-23 06:59 17810944 ----a-w- c:\windows\system32\mshtml.dll

2012-08-24 10:39 . 2012-09-23 06:59 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-08-24 10:31 . 2012-09-23 07:00 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-08-24 10:22 . 2012-09-23 07:00 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-08-24 10:21 . 2012-09-23 07:00 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-08-24 10:20 . 2012-09-23 07:00 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-24 10:18 . 2012-09-23 07:00 237056 ----a-w- c:\windows\system32\url.dll

2012-08-24 10:17 . 2012-09-23 07:00 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-08-24 10:14 . 2012-09-23 07:00 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-08-24 10:14 . 2012-09-23 07:00 816640 ----a-w- c:\windows\system32\jscript.dll

2012-08-24 10:13 . 2012-09-23 07:00 599040 ----a-w- c:\windows\system32\vbscript.dll

2012-08-24 10:12 . 2012-09-23 07:00 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-08-24 10:11 . 2012-09-23 07:00 729088 ----a-w- c:\windows\system32\msfeeds.dll

2012-08-24 10:10 . 2012-09-23 07:00 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-08-24 10:09 . 2012-09-23 07:00 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-08-24 10:04 . 2012-09-23 07:00 248320 ----a-w- c:\windows\system32\ieui.dll

2012-08-24 06:59 . 2012-09-23 07:00 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-08-24 06:51 . 2012-09-23 07:00 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-08-24 06:51 . 2012-09-23 07:00 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-08-24 06:47 . 2012-09-23 07:00 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-08-24 06:47 . 2012-09-23 07:00 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2012-08-24 06:43 . 2012-09-23 07:00 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-08-21 09:13 . 2011-11-02 08:24 359464 ----a-w- c:\windows\system32\drivers\aswSP.sys

2012-08-21 09:13 . 2011-11-02 08:24 969200 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-08-21 09:13 . 2011-11-02 08:24 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2012-08-21 09:13 . 2011-11-02 08:24 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2012-08-21 09:13 . 2011-11-02 08:24 44272 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2012-08-21 09:13 . 2011-11-02 08:24 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2012-08-21 09:12 . 2011-11-02 08:24 41224 ----a-w- c:\windows\avastSS.scr

2012-08-21 09:12 . 2011-11-02 08:24 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe

2012-08-21 09:12 . 2011-02-10 10:48 285328 ----a-w- c:\windows\system32\aswBoot.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\acer m3641\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\acer m3641\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\acer m3641\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-03-04 21:38 121392 ----a-w- c:\acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]

"SoMud"="c:\program files (x86)\SoMud\somud.exe" [2011-06-28 3888128]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-12 68856]

"Greenshot"="c:\program files (x86)\Greenshot\Greenshot.exe" [2010-07-12 548864]

"Jing"="c:\program files (x86)\TechSmith\Jing\Jing.exe" [2012-02-01 2918224]

"Grammar.net’s Grammar Checker"="c:\program files (x86)\Grammar.net’s Grammar Checker\GrammarChecker.exe" [2012-06-18 73216]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"PCMMediaSharing"="c:\program files (x86)\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2008-01-25 204908]

"SiteAdvisor"="c:\program files (x86)\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 36640]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-06-25 98304]

"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]

"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]

"googletalk"="c:\program files (x86)\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

"eSnips_Downloader"="c:\program files (x86)\Logia\eSnipsDownloader\eSnips_Downloader.exe" [2010-05-24 1234432]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-08-21 4282728]

"Anti-phishing Domain Advisor"="c:\programdata\Anti-phishing Domain Advisor\visicom_antiphishing.exe" [2011-12-21 206504]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"SweetIM"="c:\program files (x86)\SweetIM\Messenger\SweetIM.exe" [2011-08-01 114992]

"azontop100analyzer"="c:\program files (x86)\AzonTop100Analyzer\azontop100analyzer.exe" [2012-06-09 44474097]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

c:\users\Evert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.4.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-4-19 1199104]

.

c:\users\acer m3641\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\acer m3641\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]

Feed Notifier.lnk - c:\program files (x86)\Feed Notifier\notifier.exe [2012-7-24 58368]

OneNote 2007 Schermopname en Snel starten.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

ASETRES.EXE [2008-4-14 20480]

Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2008-9-23 535336]

Sitecom Wireless Utility.lnk - c:\program files (x86)\Sitecom\Common\RaUI.exe [2010-6-3 1773568]

WinZip Quick Pick.lnk - c:\program files (x86)\WinZip\WZQKPICK.EXE [2010-11-30 608584]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro36Crusader]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro36CrusaderBoot]

@=""

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-09 250808]

S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]

S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files (x86)\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2008-01-25 269448]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

Themes

.

Inhoud van de 'Gedeelde Taken' map

.

2012-10-25 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 09:23]

.

2012-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-05 07:29]

.

2012-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-05 07:29]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]

2012-03-15 21:26 287048 ----a-w- c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-08-21 09:11 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\acer m3641\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\acer m3641\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\acer m3641\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-03-04 21:39 51248 ----a-w- c:\acer\Empowering Technology\eDataSecurity\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvSvc"="c:\windows\system32\nvsvc64.dll" [2007-11-27 88064]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-27 10721312]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-27 74752]

"RtHDVCpl"="RAVCpl64.exe" [2008-03-25 6150656]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\x64\eDSloader.exe" [2008-03-04 560688]

"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2008-06-06 333344]

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp64&d=1109&m=aspire_m3641

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Download Web &Images with SoMud - c:\program files (x86)\SoMud\scripts\ie\images-url.html

IE: Download with SoMud - c:\program files (x86)\SoMud\scripts\ie\link-url.html

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

FF - ProfilePath - c:\users\acer m3641\AppData\Roaming\Mozilla\Firefox\Profiles\vb3pdfou.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/

FF - prefs.js: network.proxy.gopher -

FF - prefs.js: network.proxy.gopher_port - 0

FF - prefs.js: network.proxy.type - 0

FF - ExtSQL: 2012-10-24 09:58; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; c:\program files (x86)\McAfee\SiteAdvisor

FF - ExtSQL: !HIDDEN! 2010-06-06 09:50; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - ExtSQL: !HIDDEN! 2012-03-10 10:49; 5affxtbr@MyWebFace_5a.com; c:\program files (x86)\MyWebFace_5a\bar\1.bin

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(extensions.searchya_i.hmpg, true

FF - user.js: extensions.searchya_i.hmpgUrl - hxxp://searchya.com/?chnl=fap&s=0&cr=879914219&cd=2XzutAtN2Y1L1QzutDtDyCtD0BtAyE0AtB0FtAyEtCyD0C0A0FtN0D0TzutBtDtCtBtDtBtDzz

FF - user.js: extensions.searchya_i.dfltSrch - true

FF - user.js: extensions.searchya_i.srchPrvdr - SearchYa!

FF - user.js: extensions.searchya_i.dnsErr - true

FF - user.js: extensions.searchya_i.newTab - true

FF - user.js: extensions.searchya_i.newTabUrl - hxxp://searchya.com/?chnl=fap&s=2&cr=879914219&cd=2XzutAtN2Y1L1QzutDtDyCtD0BtAyE0AtB0FtAyEtCyD0C0A0FtN0D0TzutBtDtCtBtDtBtDzz

FF - user.js: extensions.searchya_i.tlbrSrchUrl - hxxp://searchya.com/?chnl=fap&s=3&cr=879914219&cd=2XzutAtN2Y1L1QzutDtDyCtD0BtAyE0AtB0FtAyEtCyD0C0A0FtN0D0TzutBtDtCtBtDtBtDzz&q=

FF - user.js: extensions.searchya_i.id - 84415caf0000000000000060b34a2f34

FF - user.js: extensions.searchya_i.instlDay - 15378

FF - user.js: extensions.searchya_i.vrsn - 1.5.11.13

FF - user.js: extensions.searchya_i.vrsni - 1.5.11.13

FF - user.js: extensions.searchya_i.vrsnTs - 1.5.11.1316:16

FF - user.js: extensions.searchya_i.prtnrId - ironsrc

FF - user.js: extensions.searchya_i.prdct - searchya

FF - user.js: extensions.searchya_i.aflt - foxtab

FF - user.js: extensions.searchya_i.smplGrp - none

FF - user.js: extensions.searchya_i.tlbrId - base

FF - user.js: extensions.searchya_i.instlRef - fap

FF - user.js: extensions.searchya_i.dfltLng -

FF - user.js: extensions.searchya_i.excTlbr - false

FF - user.js: extensions.BabylonToolbar_i.id - 84415caf0000000000000060b34a2f34

FF - user.js: extensions.BabylonToolbar_i.hardId - 84415caf0000000000000060b34a2f34

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15400

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1715:41

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - base

FF - user.js: extensions.BabylonToolbar_i.newTab - false

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101241

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-10 - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

WebBrowser-{65CA59EE-9920-4D7F-8C41-BFA12403261A} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

AddRemove-Allscoop RSS Submit Pro 1.0 - c:\windows\system32\ss2uinst.exe

AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe

AddRemove-conduitEngine - c:\progra~2\CONDUI~1\ConduitEngineUninstall.exe

AddRemove-InstallBrain Updater Service - c:\programdata\InstallBrainService\ibsvc.exe

AddRemove-PHPNukeDU Toolbar - c:\progra~2\PHPNUK~1\UNINST~1.EXE

AddRemove-Savings Sidekick - c:\program files (x86)\Savings Sidekick\Uninstall.exe

AddRemove-Searchqu 406 MediaBar - c:\program files (x86)\Windows iLivid Toolbar\uninstall.exe

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]

@Denied: (A 2) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]

@="Shockwave Flash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]

@Denied: (A 2) (Everyone)

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]

@="FlashBroker"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]

"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

Voltooingstijd: 2012-10-25 14:36:35

ComboFix-quarantined-files.txt 2012-10-25 12:36

ComboFix2.txt 2012-10-24 15:34

.

Pre-Run: 201.004.732.416 bytes beschikbaar

Post-Run: 200.997.097.472 bytes beschikbaar

.

- - End Of File - - 894A511FEB301F05E0C82C20EB2A4F96

kweezie wabbit · 25 oktober 2012

De fix is weer niet gelukt

Ik heb twee keer geprobeerd op te starten en gelijk na de start een paar keer op F8 gedrukt, maar ik kreeg beide keren niet de mogelijkheid om voor veilige modus te kiezen.

Je moet eigenlijk tokkelen tot je het menu van veilige modus ziet verschijnen.

Wil je het nog eens proberen?

Als het lukt, kies dan veilige modus met netwerkmogelijkheden om verder op te starten.

Sluit alle toepassingen en vensters.

Sleep nu het cfscriptje opnieuw op combofix.

Als combofix klaar is, herstart dan de pc op de normale manier en plaats het combofix logje.

InternetMarketer · 25 oktober 2012

Ik heb nu alles gedaan zoals je beschreven hebt.

Ik hoop dat je nu de juiste resultaten hebt.

Hieronder de inhoud van de log:

ComboFix 12-10-25.01 - acer m3641 25-10-2012 15:50:10.4.4 - x64 NETWORK

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.4094.3275 [GMT 2:00]

Gestart vanuit: c:\users\acer m3641\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\acer m3641\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-09-25 to 2012-10-25 ))))))))))))))))))))))))))))))

.

2012-10-25 14:01 . 2012-10-25 14:01 -------- d-----w- c:\users\Evert\AppData\Local\temp

2012-10-25 14:01 . 2012-10-25 14:01 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-10-25 14:01 . 2012-10-25 14:01 -------- d-----w- c:\users\acer m3641\AppData\Local\temp