missende bestanden tijdens het opstarten

[Gast Provided]

Ok, het is gelukt! Hoef ik nu nog combofix te instaleren?

[kape]

Ok, het is gelukt! Hoef ik nu nog combofix te instaleren?

Hangt er van af of hiermee je probleem opgelost is. Is dit zo, dan mag je Combofix laten voor wat het is. Heb je het probleem nog, dan mag je Combofix laten runnen.

[Gast Provided]

ComboFix 09-06-13.09 - Matthi 14/06/2009 13:25:29.1 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.32.1043.18.2038.1277 [GMT 2:00]

Gestart vanuit: C:\Users\Matthi\Documents\Downloads\Programs\ComboFix.exe

AV: BullGuard Antivirus *On-access scanning enabled* (Outdated) {7A9BB333-8EDF-4FDC-A2A5-1A30FA021913}

SP: Windows Defender *enabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

* Aanwezig AV is actief

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Users\Matthi\AppData\Roaming\inst.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-05-14 to 2009-06-14 ))))))))))))))))))))))))))))))

.

2009-06-14 07:52:12 . 2009-06-14 07:52:12 0 d-----w- C:\Users\Matthi\AppData\Roaming\Malwarebytes

2009-06-14 07:52:03 . 2009-05-26 11:20:08 40160 ----a-w- C:\Windows\system32\drivers\mbamswissarmy.sys

2009-06-14 07:52:01 . 2009-06-14 08:16:00 0 d-----w- C:\Program Files\Malwarebytes' Anti-Malware

2009-06-14 07:52:01 . 2009-06-14 07:52:01 0 d-----w- C:\ProgramData\Malwarebytes

2009-06-14 07:46:49 . 2009-05-26 11:19:56 19096 ----a-w- C:\Windows\system32\drivers\mbam.sys

2009-06-13 22:28:32 . 2009-06-13 23:23:24 334576 ----a-w- C:\Users\Matthi\AppData\Roaming\IDM\DwnlData\Matthi\mbam-setup_36\mbam-setup.exe

2009-06-13 16:13:50 . 2009-06-13 16:13:51 0 d-----w- C:\Program Files\SpeedFan

2009-06-13 11:57:51 . 2009-06-13 12:02:38 0 d-----w- C:\Users\Matthi\AppData\Roaming\Vso

2009-06-13 11:57:51 . 2009-06-13 11:57:51 47360 ----a-w- C:\Windows\system32\drivers\pcouffin.sys

2009-06-13 11:57:51 . 2009-06-13 11:57:51 47360 ----a-w- C:\Users\Matthi\AppData\Roaming\pcouffin.sys

2009-06-13 11:57:36 . 2007-03-18 18:37:12 65602 ----a-w- C:\Windows\system32\cook3260.dll

2009-06-13 11:57:36 . 2006-09-29 10:26:22 176165 ----a-w- C:\Windows\system32\drv23260.dll

2009-06-13 11:57:36 . 2006-09-29 10:25:38 208935 ----a-w- C:\Windows\system32\drv33260.dll

2009-06-13 11:57:36 . 2006-09-29 10:24:48 217127 ----a-w- C:\Windows\system32\drv43260.dll

2009-06-13 11:57:36 . 2002-12-10 00:20:00 102439 ----a-w- C:\Windows\system32\sipr3260.dll

2009-06-13 11:57:35 . 2006-05-20 14:16:00 1184984 ----a-w- C:\Windows\system32\wvc1dmod.dll

2009-06-13 11:57:35 . 2006-05-11 17:21:00 626688 ----a-w- C:\Windows\system32\vp7vfw.dll

2009-06-13 11:57:32 . 2009-06-13 11:57:36 0 d-----w- C:\Program Files\VSO

2009-06-12 18:20:02 . 2009-06-12 18:20:02 0 d-----w- C:\ProgramData\RoboForm

2009-06-12 18:19:02 . 2009-06-12 18:19:02 0 d-----w- C:\Program Files\Siber Systems

2009-06-11 20:56:58 . 2006-02-09 08:59:42 223 ----a-w- C:\Users\Matthi\AppData\Roaming\uTorrent\IP filter µpdater.bat

2009-06-11 20:56:58 . 2005-10-17 09:12:46 258048 ----a-w- C:\Users\Matthi\AppData\Roaming\uTorrent\wget.exe

2009-06-11 20:56:58 . 2005-04-13 10:57:02 159744 ----a-w- C:\Users\Matthi\AppData\Roaming\uTorrent\ssleay32.dll

2009-06-11 20:56:58 . 2005-04-13 10:56:42 888832 ----a-w- C:\Users\Matthi\AppData\Roaming\uTorrent\libeay32.dll

2009-06-11 19:33:05 . 2009-06-11 19:33:05 0 d-----w- C:\ProgramData\2DBoy

2009-06-11 18:35:11 . 2009-06-11 18:35:28 0 d-----w- C:\Program Files\WorldOfGoo

2009-06-10 06:34:04 . 2009-06-10 06:34:04 0 d-----w- C:\Program Files\Common Files\Digidesign

2009-06-10 06:34:03 . 2009-06-10 06:34:05 0 d-----w- C:\Program Files\Antares Audio Technologies

2009-06-10 06:33:36 . 2003-06-20 11:28:28 1777664 ----a-w- C:\Windows\system32\gdiplus.dll

2009-06-10 06:30:57 . 2009-06-10 06:30:58 0 d-----w- C:\Program Files\ASIO4ALL v2

2009-06-10 06:30:41 . 2009-06-10 06:34:05 0 d-----w- C:\Program Files\VstPlugins

2009-06-10 06:30:41 . 2006-06-20 08:56:42 225280 ----a-w- C:\Windows\system32\rewire.dll

2009-06-10 06:30:15 . 2009-06-10 06:30:15 0 d-----w- C:\Program Files\Outsim

2009-06-10 06:28:45 . 2009-06-10 06:31:01 0 d-----w- C:\Program Files\Image-Line

2009-06-09 20:26:38 . 2009-06-09 20:26:38 181680 ----a-w- C:\Users\Matthi\AppData\Roaming\IDM\idmmzcc2\components\idmmzcc.dll

2009-06-09 20:26:32 . 2009-06-14 11:30:37 0 d-----w- C:\Users\Matthi\AppData\Roaming\DMCache

2009-06-09 20:26:32 . 2009-06-14 11:24:33 0 d-----w- C:\Users\Matthi\AppData\Roaming\IDM

2009-06-09 20:26:26 . 2009-06-09 20:26:29 0 d-----w- C:\Program Files\Internet Download Manager

2009-06-09 08:20:48 . 2009-06-09 08:21:01 0 d-----w- C:\ProgramData\Google Updater

2009-06-09 08:09:56 . 2009-06-09 08:09:56 0 d-----w- C:\Program Files\CCleaner

2009-06-08 21:39:06 . 2009-06-08 21:39:16 0 d-----w- C:\Users\Matthi\AppData\Roaming\Launchy

2009-06-08 21:38:55 . 2009-06-08 21:38:57 0 d-----w- C:\Program Files\Launchy

2009-06-08 20:57:22 . 2009-06-08 20:57:22 0 d-----w- C:\Users\Matthi\AppData\Local\Collectorz.com

2009-06-08 20:57:15 . 2009-06-08 20:57:15 0 d-----w- C:\Program Files\Collectorz.com

2009-06-08 18:26:00 . 2009-06-08 18:26:00 0 d-----w- C:\Users\Matthi\AppData\Local\Stardock

2009-06-08 18:25:31 . 2009-06-08 18:25:31 0 d-----w- C:\Program Files\Stardock

2009-06-08 18:25:31 . 2009-06-08 18:25:31 0 d-----w- C:\Program Files\Common Files\Stardock

2009-06-08 18:01:16 . 2009-06-08 18:23:47 0 d-----w- C:\Users\Matthi\AppData\Local\Microsoft Games

2009-06-08 16:30:48 . 2009-06-08 16:30:48 0 d-----w- C:\Users\Matthi\AppData\Roaming\Screaming Bee

2009-06-08 16:29:15 . 2009-06-08 16:29:15 0 d-----w- C:\Program Files\Screaming Bee

2009-06-08 11:12:35 . 2009-06-08 11:12:35 0 d-----w- C:\Users\Matthi\AppData\Roaming\Foxit

2009-06-08 11:12:35 . 2009-06-08 11:12:35 0 d-----w- C:\Program Files\Foxit Software

2009-06-07 11:35:06 . 2009-06-07 11:35:06 0 d-----w- C:\Users\Matthi\AppData\Roaming\Ahead

2009-06-06 18:44:25 . 2009-06-06 18:44:25 0 d-----w- C:\Program Files\uTorrent

2009-06-06 18:43:57 . 2009-06-14 11:21:32 0 d-----w- C:\Users\Matthi\AppData\Roaming\uTorrent

2009-06-05 18:36:55 . 2009-06-05 18:36:55 0 d-----w- C:\Program Files\Telemeter 3.0

2009-06-04 19:48:25 . 2009-06-04 19:48:26 0 d-----w- C:\Users\Matthi\AppData\Roaming\Media Player Classic

2009-06-04 19:44:58 . 2008-09-16 19:23:26 168448 ----a-w- C:\Windows\system32\unrar.dll

2009-06-04 19:44:53 . 2008-12-07 18:08:06 795648 ----a-w- C:\Windows\system32\xvidcore.dll

2009-06-04 19:44:53 . 2008-12-07 18:08:04 130048 ----a-w- C:\Windows\system32\xvidvfw.dll

2009-06-04 19:44:53 . 2004-01-25 16:18:44 217088 ----a-w- C:\Windows\system32\yv12vfw.dll

2009-06-04 19:44:52 . 2008-12-11 00:33:26 86016 ----a-w- C:\Windows\system32\dpl100.dll

2009-06-04 19:44:52 . 2008-11-06 16:37:32 3596288 ----a-w- C:\Windows\system32\qt-dx331.dll

2009-06-04 19:44:52 . 2008-11-06 16:33:52 684032 ----a-w- C:\Windows\system32\divx.dll

2009-06-04 19:44:50 . 2009-04-02 13:21:50 84480 ----a-w- C:\Windows\system32\ff_vfw.dll

2009-06-04 19:44:49 . 2004-01-11 22:00:00 348160 ----a-w- C:\Windows\system32\msvcr71.dll

2009-06-04 19:44:48 . 2009-06-04 19:47:15 0 d-----w- C:\Program Files\K-Lite Codec Pack

2009-06-04 13:05:02 . 2009-06-07 11:36:21 0 d-----w- C:\Users\Matthi\AppData\Local\Ahead

2009-06-04 12:38:23 . 2009-06-04 12:38:23 0 d-----w- C:\Users\Matthi\AppData\Local\NOS

2009-06-04 09:21:20 . 2009-06-11 19:53:51 0 d-----w- C:\ProgramData\NOS

2009-06-04 09:21:20 . 2009-06-04 09:21:20 0 d-----w- C:\Program Files\NOS

2009-06-04 08:16:37 . 2009-06-04 08:16:37 22016 ----a-w- C:\Windows\system32\neth32.dll

2009-06-04 08:08:10 . 2009-06-04 08:08:10 0 d-----w- C:\Users\Matthi\AppData\Roaming\vlc

2009-06-04 08:05:45 . 2009-06-04 08:05:45 0 d-----w- C:\Users\Matthi\AppData\Local\WinZip

2009-06-04 08:04:20 . 2009-06-04 08:05:44 0 d-----w- C:\ProgramData\WinZip

2009-06-04 07:50:53 . 2009-06-04 07:50:33 410984 ----a-w- C:\Windows\system32\deploytk.dll

2009-06-04 07:50:27 . 2009-06-04 07:50:27 0 d-----w- C:\Program Files\Java

2009-06-03 20:42:31 . 2009-06-04 12:38:23 0 d-----w- C:\Users\Matthi\AppData\Local\Adobe

2009-06-03 19:43:09 . 2009-06-03 19:43:11 0 d-----w- C:\Program Files\Recuva

2009-06-03 05:39:38 . 2009-06-03 05:39:38 14152 ----a-w- C:\Windows\system32\lccl.dll

2009-06-03 05:39:38 . 2009-06-03 05:39:38 14152 ----a-w- C:\Windows\system32\client_cc.dll

2009-06-03 05:39:27 . 2009-06-03 05:39:27 50896 ----a-w- C:\Windows\system32\drivers\BdFileSpy.sys

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\Users\Default\Sjablonen

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\Users\Default\Netwerkprinteromgeving

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\Users\Default\Mijn documenten

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\Users\Default\Menu Start

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\ProgramData\Sjablonen

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\ProgramData\Menu Start

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\ProgramData\Favorieten

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\ProgramData\Documenten

2009-06-03 05:32:02 . 2009-06-03 05:32:02 0 d-sh--we C:\ProgramData\Bureaublad

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-14 09:01:46 . 2006-11-02 16:11:51 689618 ----a-w- C:\Windows\system32\perfh013.dat

2009-06-14 09:01:46 . 2006-11-02 16:11:51 122796 ----a-w- C:\Windows\system32\perfc013.dat

2009-06-13 21:42:15 . 2009-06-03 05:36:35 0 d-----w- C:\Users\Matthi\AppData\Roaming\BullGuard

2009-06-13 21:40:02 . 2007-07-23 10:43:43 0 d-----w- C:\ProgramData\BullGuard

2009-06-09 09:12:52 . 2007-07-23 12:31:15 0 d-----w- C:\Program Files\Google

2009-06-04 12:27:29 . 2007-07-23 07:57:53 0 d-----w- C:\Program Files\Common Files\Adobe

2009-06-03 07:07:31 . 2007-07-23 06:15:52 0 d-----w- C:\ProgramData\Microsoft Help

2009-06-03 05:36:59 . 2009-06-03 05:36:59 0 d-----w- C:\Users\Matthi\AppData\Roaming\Ulead Systems

2009-06-03 05:36:34 . 2009-06-03 05:36:34 85120 ----a-w- C:\Users\Matthi\AppData\Local\GDIPFONTCACHEV1.DAT

2009-04-06 11:19:46 . 2009-04-06 11:19:46 23064 ----a-w- C:\Windows\system32\drivers\ScreamingBAudio.sys

.

------- Sigcheck -------

[-] 2006-11-02 09:51:50 3502184 47CF0295FDE57ACF79D0057AA337D506 C:\Windows\System32\ntkrnlpa.exe

[7] 2006-11-02 09:51:50 3502184 CADAA2FCB7F3D18BE056A34D84EE2CA1 C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16386_none_69f99fa4b7380194\ntkrnlpa.exe

[-] 2006-11-02 09:46:13 427520 46FA599DEA5329D1B24B7570EB421E79 C:\Windows\System32\termsrv.dll

[-] 2006-11-02 09:46:13 427520 46FA599DEA5329D1B24B7570EB421E79 C:\Windows\winsxs\x86_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.0.6000.16386_none_8c687fcc5759068e\termsrv.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2006-11-02 12:35:15 1196032]

"BullGuard"="C:\Program Files\BullGuard Software\BullGuard\BullGuard.exe" [2009-06-03 05:39:16 308552]

"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 10:54:42 5674352]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 16:05:20 143360]

"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2009-01-22 15:16:23 2745776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-06-06 10:52:32 142104]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-06-06 10:52:12 154392]

"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-06-06 10:52:26 138008]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 11:00:00 174872]

"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 16:31:26 630784]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-15 20:50:10 857648]

"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-07-25 11:36:40 32768]

"HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2006-12-14 14:53:28 192512]

"LMgrOSD"="C:\Program Files\Launch Manager\OSD.exe" [2006-12-26 09:23:34 180224]

"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2006-11-09 12:37:52 86016]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 13:40:44 155648]

"UVS10 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-10 01:27:48 36864]

"BullGuard"="C:\Program Files\BullGuard Software\BullGuard\bullguard.exe" [2009-06-03 05:39:16 308552]

"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-23 12:31:21 220160]

"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-06-04 07:50:33 148888]

"Telemeter 3.0"="C:\Program Files\Telemeter 3.0\telemeter3.exe" [2007-04-15 22:38:26 1441792]

"RtHDVCpl"="RtHDVCpl.exe" - C:\Windows\RtHDVCpl.exe [2007-02-15 16:07:16 4390912]

C:\Users\Matthi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Schermopname en Snel starten.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2009-6-8 3450608]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2009-6-8 286720]

WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2009-5-11 525640]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{94303D5E-6BF7-4B07-B8D3-C65CEA94AA72}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{813063B7-0343-4590-BFF4-C7FDF85AA668}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{07FBFD09-A0CC-4687-99BF-22041E49F7CD}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"{2866836A-F4A1-40EC-8786-2DF3200D3945}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (TCP-In)

"{08E13D47-1AD6-4D45-BF82-00012DBB7118}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent (UDP-In)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 BdFileSpy;BullGuard File Monitor Driver;C:\Windows\System32\drivers\BdFileSpy.sys [3/06/2009 7:39:27 50896]

R2 BsFileScan;BullGuard File Scan Service;C:\Windows\System32\svchost.exe -k BullGuard [2/11/2006 10:35:16 22016]

R2 BsMailProxy;BullGuard Email Monitoring Service;C:\Windows\System32\svchost.exe -k BullGuard [2/11/2006 10:35:16 22016]

R3 Reconn;BullGuard Email Monitor;C:\Program Files\BullGuard Software\BullGuard\Reconn.sys [16/05/2007 13:07:58 16984]

R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\Windows\System32\drivers\rtl8187B.sys [20/07/2007 8:47:38 277504]

R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\Windows\System32\drivers\ScreamingBAudio.sys [6/04/2009 13:19:46 23064]

R3 WisLMSvc;WisLMSvc;C:\Program Files\Launch Manager\WisLMSvc.exe [20/07/2007 9:28:05 118784]

S2 gupdate1c9e8e26c51c180;Google Updateservice (gupdate1c9e8e26c51c180);C:\Program Files\Google\Update\GoogleUpdate.exe [9/06/2009 11:12:31 133104]

S3 getPlus® Helper;getPlus® Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [4/06/2009 11:21:20 33176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

BullGuard REG_MULTI_SZ BgMainSvc BsFileScan BsMailProxy

.

Inhoud van de 'Gedeelde Taken' map

2009-06-14 C:\Windows\Tasks\Google Software Updater.job

- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-09 08:20:42 . 2009-06-09 08:20:42]

2009-06-14 C:\Windows\Tasks\GoogleUpdateTaskMachine.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-06-09 09:12:31 . 2009-06-09 09:12:19]

.

- - - - ORPHANS VERWIJDERD - - - -

HKCU-Run-AdobeUpdater - C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

HKLM-Run-CtrlVol - C:\Program Files\Launch Manager\CtrlVol.exe

HKLM-Run-toolbar_eula_launcher - C:\Program Files\GoogleEULA\EULALauncher.exe

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

IE: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

IE: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm

IE: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm

IE: E&xporteren naar Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-06-14 13:30:31

Windows 6.0.6000 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

Heb het toch nog even combofix laten lopen, just to be sure ;-)

Hieronder de quarantined-files.

2009-06-14 11:31:12 . 2009-06-14 11:31:12 155 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-toolbar_eula_launcher.reg.dat

2009-06-14 11:31:11 . 2009-06-14 11:31:11 144 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-CtrlVol.reg.dat

2009-06-14 11:31:07 . 2009-06-14 11:31:07 168 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-AdobeUpdater.reg.dat

2009-06-14 11:29:42 . 2009-06-14 11:29:42 5,153 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg

2009-06-14 11:21:33 . 2009-06-14 11:22:00 62 ----a-w- C:\Qoobox\Quarantine\catchme.log

2009-06-13 11:57:51 . 2009-06-13 11:57:51 87,608 ----a-w- C:\Qoobox\Quarantine\C\Users\Matthi\AppData\Roaming\inst.exe.vir

[kape]

Toch nog één item verwijderd door Combofix

Verwijder Combofix: Start -> Uitvoeren en typ: combofix /u

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Verwijder Qoobox met Windows Verkenner.

Download CCleaner.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Opschonen'. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Het is aangewezen om de bestaande herstelpunten te verwijderen (daar zitten besmette herstelpunten tussen die je eventueel zou kunnen terugzetten) door systeemherstel tijdelijk uit te schakelen. Doe dit via Configuratiescherm -> Systeem en Onderhoud -> Systeem -> tabblad "Systeembeveiliging" -> vinkje weghalen bij de schijf waarvan je de herstelpunten wil verwijderen -> klikken op "toepassen". Dan krijg je de schermmelding “Weet u zeker dat u systeemherstel wil uitschakelen”. Klik hier op “Systeemherstel uitschakelen”. Dan zijn alle herstelpunten verwijderd op de aangeduide schijf.

Zet daarna opnieuw een vinkje bij de harde schijf. Maak meteen ook een nieuw herstelpunt, zodat je niet hoeft te wachten op een automatisch herstelpunt van het systeem.

That's it !

[Gast Provided]

Zo heb alles doorlopen.

Alvast heel erg bedankt! Bedankt voor de zeer goede uitleg! keep it up xD

Hopelijk werkt alles nu zoals het hoort

Ik laat nog iets weten of alles nu in orde is of niet.

[Gast Provided]

Helaas

Toen ik gisteren eidenlijk wat updates kon downloaden voor vista werd me tijdens het heropstarten, nodig voor het instaleren, weer het bericht getoond dat er een kernel ontbrak en dat dit door een recente software of hardware weiziging kon gebeurt zijn.

Hopelijk heb je nog een paar ideeën?

[kape]

Laat via Start -> Uitvoeren -> typ sfc /scannow de Windows-versie eens controleren.

[Gast Provided]

Er gebeurt niet veel.

Er verschijnt een zwart kader, maar het verdwijnt weer even rap als er het gekomen is. net genoeg tijd om te zien dat het een zwart kader is.

[kape]

Er gebeurt niet veel.

Er verschijnt een zwart kader, maar het verdwijnt weer even rap als er het gekomen is. net genoeg tijd om te zien dat het een zwart kader is.

Dat is inderdaad niet echt veel :s En heb je daarna al eens terug opgestart ?

[Gast Provided]

Oke, net alles opnieuw geïnstaleerd. Het probleem is dus nog niet opgelost.

Deze kreeg ik wel een andere reden waarom het opstarten deze keer weer niet lukte:

Windows\systemen32\winload.exe

Info: het bestand is mogelijk beschadigd. De controlesom van de header komt niet overeen met de berekende controlesom.

Hopelijk heb je er wat aan.

ps. Nog steeds hetzelfde probleem met het uitvoeren van sfc /scannow