Erg traag

[Knip]

ComboFix 13-07-14.01 - Lars 15-07-2013 21:39:44.12.2 - x86

Microsoft® Windows Vista™ Business 6.0.6002.2.1252.31.1033.18.2013.884 [GMT 2:00]

Gestart vanuit: c:\users\Lars\Pictures\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Lars\Desktop\CFScript.txt

AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

FILE ::

"c:\windows\system32\mcgdmgr.dll"

"c:\windows\system32\mcinsctl.dll"

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\McAfee.com

c:\program files\McAfee.com\Agent\agent.chm

c:\program files\McAfee.com\Agent\agent.inf

c:\program files\McAfee.com\Agent\agentcfg.inf

c:\program files\McAfee.com\Agent\agentdui.inf

c:\program files\McAfee.com\Agent\agentsub.inf

c:\program files\McAfee.com\Agent\agentupd.inf

c:\program files\McAfee.com\Agent\app\vso.adf

c:\program files\McAfee.com\Agent\Custom_Uninstall\regwiz.inf

c:\program files\McAfee.com\Agent\Custom_Uninstall\vsoreg.inf

c:\program files\McAfee.com\Agent\Data\News\oemcfg.ini

c:\program files\McAfee.com\Agent\Data\RegWiz\RegApp\vso.ini

c:\program files\McAfee.com\Agent\mcagent.exe

c:\program files\McAfee.com\Agent\mcagntps.dll

c:\program files\McAfee.com\Agent\mcaping.dll

c:\program files\McAfee.com\Agent\mcback.dll

c:\program files\McAfee.com\Agent\mcdash.exe

c:\program files\McAfee.com\Agent\Mcdetect.exe

c:\program files\McAfee.com\Agent\Mcdetect.inf

c:\program files\McAfee.com\Agent\mcltvers.ini

c:\program files\McAfee.com\Agent\McPatch.dll

c:\program files\McAfee.com\Agent\mcregwiz.exe

c:\program files\McAfee.com\Agent\mcscentr.adf

c:\program files\McAfee.com\Agent\McScIndx.dll

c:\program files\McAfee.com\Agent\mcscoem.inf

c:\program files\McAfee.com\Agent\McTskshd.exe

c:\program files\McAfee.com\Agent\McTskshd.inf

c:\program files\McAfee.com\Agent\mcuicfg.inf

c:\program files\McAfee.com\Agent\mcuilib.dll

c:\program files\McAfee.com\Agent\mcupdate.exe

c:\program files\McAfee.com\Agent\mcupdmgr.exe

c:\program files\McAfee.com\Agent\mcupdui.exe

c:\program files\McAfee.com\Agent\mscuicfg.dat

c:\program files\McAfee.com\Agent\oem.ini

c:\program files\McAfee.com\Agent\oemcfg.ini

c:\program files\McAfee.com\Agent\oemlogo.gif

c:\program files\McAfee.com\Agent\readme.txt

c:\program files\McAfee.com\Agent\regwizui.dll

c:\program files\McAfee.com\Agent\rwconfig.ini

c:\program files\McAfee.com\Agent\scres.dll

c:\program files\McAfee.com\Agent\scui.dll

c:\program files\McAfee.com\Agent\submgr\6,0,0,3\mcsubmgr.dll

c:\program files\McAfee.com\Agent\Uninst\screm.ui

c:\program files\McAfee.com\Agent\Uninst\uninst.ico

c:\program files\McAfee.com\Agent\Uninst\vscfgui.dll

c:\program files\McAfee.com\Agent\Uninst\vsoremui.dll

c:\program files\McAfee.com\Shared\cleanup.ini

c:\program files\McAfee.com\Shared\dunzip32.dll

c:\program files\McAfee.com\Shared\mcappins.exe

c:\program files\McAfee.com\Shared\mcappins.inf

c:\program files\McAfee.com\Shared\mccomctl.dll

c:\program files\McAfee.com\Shared\mccomctl.inf

c:\program files\McAfee.com\Shared\mcinfo.exe

c:\program files\McAfee.com\Shared\mcinsres.dll

c:\program files\McAfee.com\Shared\mcuicfg\6,0,0,4\mcuicfg.dll

c:\program files\McAfee.com\Shared\mghtml.exe

c:\program files\McAfee.com\Shared\mghtml.inf

c:\program files\McAfee.com\VSO\appinit.ini

c:\program files\McAfee.com\VSO\ashldres.dll

c:\program files\McAfee.com\VSO\Dat\4540\clean.dat

c:\program files\McAfee.com\VSO\Dat\4540\names.dat

c:\program files\McAfee.com\VSO\Dat\4540\scan.dat

c:\program files\McAfee.com\VSO\edisk.dll

c:\program files\McAfee.com\VSO\emlscbin.inf

c:\program files\McAfee.com\VSO\emlscres.inf

c:\program files\McAfee.com\VSO\emscnres.dll

c:\program files\McAfee.com\VSO\ftscnres.dll

c:\program files\McAfee.com\VSO\imscnbin.inf

c:\program files\McAfee.com\VSO\imscnres.inf

c:\program files\McAfee.com\VSO\license.txt

c:\program files\McAfee.com\VSO\mcavtsub.dll

c:\program files\McAfee.com\VSO\mcinsupd.exe

c:\program files\McAfee.com\VSO\mcinsupd.inf

c:\program files\McAfee.com\VSO\mcmnhdlr.exe

c:\program files\McAfee.com\VSO\mcscan32.dll

c:\program files\McAfee.com\VSO\mcshld9x.exe

c:\program files\McAfee.com\VSO\mcurial.dll

c:\program files\McAfee.com\VSO\mcvsctl.dll

c:\program files\McAfee.com\VSO\mcvsdiag.dll

c:\program files\McAfee.com\VSO\McVSEscn.exe

c:\program files\McAfee.com\VSO\mcvsftsn.exe

c:\program files\McAfee.com\VSO\mcvsmap.exe

c:\program files\McAfee.com\VSO\mcvsps.dll

c:\program files\McAfee.com\VSO\mcvsscrp.dll

c:\program files\McAfee.com\VSO\mcvsshl.dll

c:\program files\McAfee.com\VSO\mcvsshld.exe

c:\program files\McAfee.com\VSO\McVSSkt.Dll

c:\program files\McAfee.com\VSO\mcvsworm.dll

c:\program files\McAfee.com\VSO\mvsuicfg.dat

c:\program files\McAfee.com\VSO\mytilus.dll

c:\program files\McAfee.com\VSO\naiann.dll

c:\program files\McAfee.com\VSO\naiannps.dll

c:\program files\McAfee.com\VSO\oasbin.inf

c:\program files\McAfee.com\VSO\oasclnt.exe

c:\program files\McAfee.com\VSO\oasres.inf

c:\program files\McAfee.com\VSO\oscnbin.inf

c:\program files\McAfee.com\VSO\oscnres.inf

c:\program files\McAfee.com\VSO\outscres.dll

c:\program files\McAfee.com\VSO\PATCHW32.DLL

c:\program files\McAfee.com\VSO\readme.txt

c:\program files\McAfee.com\VSO\redist.txt

c:\program files\McAfee.com\VSO\Res00\McShield.dll

c:\program files\McAfee.com\VSO\RWABS16.DLL

c:\program files\McAfee.com\VSO\RWABS32.DLL

c:\program files\McAfee.com\VSO\scrpres.dll

c:\program files\McAfee.com\VSO\scrpsbin.inf

c:\program files\McAfee.com\VSO\scrstres.inf

c:\program files\McAfee.com\VSO\shextbin.inf

c:\program files\McAfee.com\VSO\shextres.inf

c:\program files\McAfee.com\VSO\shlres.dll

c:\program files\McAfee.com\VSO\signlic.txt

c:\program files\McAfee.com\VSO\unicows.dll

c:\program files\McAfee.com\VSO\vsagntui.dll

c:\program files\McAfee.com\VSO\vsagntui.inf

c:\program files\McAfee.com\VSO\vscfgui.dll

c:\program files\McAfee.com\VSO\vscfgui.inf

c:\program files\McAfee.com\VSO\vscfgw32.dll

c:\program files\McAfee.com\VSO\vsengver.dll

c:\program files\McAfee.com\VSO\vso.chm

c:\program files\McAfee.com\VSO\vso.inf

c:\program files\McAfee.com\VSO\vsocfg.inf

c:\program files\McAfee.com\VSO\vsoeng.inf

c:\program files\McAfee.com\VSO\vsolplg.dll

c:\program files\McAfee.com\VSO\vsolui.dll

c:\program files\McAfee.com\VSO\vsoui.dll

c:\program files\McAfee.com\VSO\vsoupd.dll

c:\program files\McAfee.com\VSO\vsowow.dll

c:\program files\McAfee.com\VSO\wormres.dll

c:\program files\McAfee.com\VSO\wrmstbin.inf

c:\program files\McAfee.com\VSO\wrmstres.inf

c:\programdata\McAfee.com

c:\programdata\McAfee.com\Agent\Cache\McSubDB.Bak

c:\programdata\McAfee.com\Agent\Logs\TaskScheduler\McTskshd000.log

c:\programdata\McAfee.com\Agent\mcini.ini

c:\programdata\McAfee.com\Agent\McSubDB.Dat

c:\windows\system32\mcgdmgr.dll

c:\windows\system32\mcinsctl.dll

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2013-06-15 to 2013-07-15 ))))))))))))))))))))))))))))))

.

.

2013-07-15 19:47 . 2013-07-15 19:47 -------- d-----w- c:\users\Lars\AppData\Local\temp

2013-07-15 19:47 . 2013-07-15 19:47 -------- d-----w- c:\users\Public\AppData\Local\temp

2013-07-15 19:47 . 2013-07-15 19:47 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-07-15 11:00 . 2005-07-14 10:34 63584 ----a-w- c:\windows\system32\vshield.vxd

2013-07-15 11:00 . 2005-07-14 10:34 26720 ----a-w- c:\windows\system32\vshinit.vxd

2013-07-15 11:00 . 2005-07-14 10:33 23639 ----a-w- c:\windows\system32\mcutil.vxd

2013-07-15 11:00 . 2005-07-14 10:33 28243 ----a-w- c:\windows\system32\mckrnl.vxd

2013-07-15 11:00 . 2005-05-04 09:10 1464566 ----a-w- c:\windows\system32\MCSCAN32.VXD

2013-07-15 10:50 . 2013-07-15 10:49 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-07-15 10:38 . 2013-07-15 11:44 230 ----a-w- c:\windows\DeleteOnReboot.bat

2013-07-14 17:56 . 2013-07-14 17:56 388096 ----a-r- c:\users\Lars\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2013-07-14 17:56 . 2013-07-14 17:56 -------- d-----w- c:\program files\Trend Micro

2013-07-13 17:50 . 2013-05-29 01:33 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2013-07-13 17:50 . 2013-05-29 02:24 149656 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2013-07-13 17:50 . 2013-05-29 01:39 768512 ----a-w- c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll

2013-07-13 17:50 . 2013-05-29 01:36 420864 ----a-w- c:\windows\system32\vbscript.dll

2013-07-13 17:50 . 2013-05-29 01:38 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll

2013-07-13 17:50 . 2013-05-29 01:37 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2013-07-12 16:57 . 2013-06-04 01:50 2049024 ----a-w- c:\windows\system32\win32k.sys

2013-07-05 16:47 . 2013-07-05 16:49 -------- d-----w- c:\users\Lars\AppData\Roaming\ftblauncher

2013-07-02 08:48 . 2013-07-02 08:48 -------- d-----w- c:\users\Lars\AppData\Roaming\Samsung Multimedia Viewer

2013-07-02 08:46 . 2013-07-02 08:50 -------- d-----w- c:\users\Lars\AppData\Roaming\iLauncher

2013-07-02 08:46 . 2013-07-02 08:46 -------- d-----w- c:\program files\Samsung

2013-07-02 08:45 . 2013-07-02 08:45 -------- d-----w- c:\users\Lars\AppData\Roaming\iLinker

2013-06-23 17:10 . 2013-06-23 17:10 -------- d-----r- C:\MSOCache

2013-06-23 09:08 . 2013-06-23 09:08 -------- d-----w- c:\program files\Microsoft Analysis Services

2013-06-23 08:09 . 2013-06-23 08:09 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help

2013-06-21 17:13 . 2013-06-21 17:13 -------- d-----w- c:\users\Lars\AppData\Local\Microsoft Help

2013-06-21 17:12 . 2013-07-13 17:59 -------- d-----w- c:\programdata\Microsoft Help

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-15 10:49 . 2012-07-05 11:48 867240 ----a-w- c:\windows\system32\npdeployJava1.dll

2013-07-15 10:49 . 2011-11-23 12:43 789416 ----a-w- c:\windows\system32\deployJava1.dll

2013-05-17 16:52 . 2010-06-24 10:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-05-08 04:37 . 2013-06-13 16:31 905576 ----a-w- c:\windows\system32\drivers\tcpip.sys

2013-05-02 22:03 . 2013-06-13 16:31 3603832 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-05-02 22:03 . 2013-06-13 16:31 3551096 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-05-02 04:04 . 2013-06-13 16:31 443904 ----a-w- c:\windows\system32\win32spl.dll

2013-05-02 04:03 . 2013-06-13 16:31 37376 ----a-w- c:\windows\system32\printcom.dll

2013-04-24 04:00 . 2013-06-13 16:31 985600 ----a-w- c:\windows\system32\crypt32.dll

2013-04-24 04:00 . 2013-06-13 16:31 98304 ----a-w- c:\windows\system32\cryptnet.dll

2013-04-24 04:00 . 2013-06-13 16:31 133120 ----a-w- c:\windows\system32\cryptsvc.dll

2013-04-24 04:00 . 2013-06-13 16:31 41984 ----a-w- c:\windows\system32\certenc.dll

2013-04-24 01:46 . 2013-06-13 16:31 812544 ----a-w- c:\windows\system32\certutil.exe

2013-04-17 12:30 . 2013-06-13 16:31 24576 ----a-w- c:\windows\system32\cryptdlg.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2008-01-19 49664]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-04-19 18678376]

"Steam"="c:\program files\Steam\Steam.exe" [2013-07-10 1672616]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-03-09 636032]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]

"snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]

"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2013-04-28 4408368]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

.

c:\users\Lars\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2010 Schermopname en Snel starten.lnk - e:\office14\ONENOTEM.EXE /tsr [2013-1-8 228448]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" -osboot

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

bthsvcs REG_MULTI_SZ BthServ

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-07-13 18:24 1173456 ----a-w- c:\program files\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe

.

Inhoud van de 'Gedeelde Taken' map

.

2013-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-28 20:42]

.

2013-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-28 20:42]

.

.

------- Bijkomende Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 212.54.40.25 212.54.35.25

.

- - - - ORPHANS VERWIJDERD - - - -

.

HKLM-Run-McRegWiz - c:\program files\McAfee.com\Agent\mcregwiz.exe

AddRemove-Mcafee SecurityCenter - c:\progra~1\mcafee.com\shared\mcappins.exe

AddRemove-VirusScan Online - c:\progra~1\mcafee.com\shared\mcappins.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2013-07-15 21:47

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

Voltooingstijd: 2013-07-15 21:48:46

ComboFix-quarantined-files.txt 2013-07-15 19:48

ComboFix2.txt 2013-07-15 15:16

ComboFix3.txt 2013-07-15 15:00

ComboFix4.txt 2013-07-15 14:31

.

Pre-Run: 2.137.477.120 bytes free

Post-Run: 2.106.441.728 bytes free

.

- - End Of File - - A709806DE92E74D367FC79CCDE851E9E

5C616939100B85E558DA92B899A0FC36

[kape]

Zo ... nu ben je ook van McAfee verlost en ziet de rest er erg netjes uit. Nog wat opruimingswerk voor de boeg:

Sluit alle openstaande vensters

• Start AdwCleaner en klik Deinstallatie.
  
• Klik op "Ja"
  

AdwCleaner is nu verwijderd van je PC.

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht/Programma’s en bestanden zoeken en typ daar: ComboFix /Uninstall (met spatie voor de /).

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Download CCleaner. (Als je het nog niet hebt)

Installeer het (als je niet wilt dat Google Chrome op je PC als standaard-webbrowser wordt geïnstalleerd, moet je de 2 vinkjes wegdoen !!!) en start CCleaner op.

Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en na de analyse op 'Schoonmaken'. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”.

Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft.

Sluit hierna CCleaner terug af.

Wil je dit uitgebreid in beeld bekijken, klik dan hier voor de handleiding.

Indien dit allemaal probleemloos verlopen is en je binnen dit topic verder geen vragen of problemen meer hebt, mag je dit onderwerp afsluiten door een klik op de knop "Markeer als opgelost", die je links onderaan kan terugvinden … zo blijft het voor iedereen overzichtelijk.