diana864

26 juni 2012

Bedankt voor alle hulp, m'n systeem is weer opgeruimd en alles is weg

26 juni 2012

Dit is de text die in de Combofix log stond na het herstarten:

ComboFix 12-06-26.02 - Diana 26-06-2012 20:42:47.1.2 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.3002.1999 [GMT 2:00]

Gestart vanuit: c:\users\Diana\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Diana\Desktop\CFScript.txt

AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"C:\user.js"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Web Assistant

c:\program files\Web Assistant\Extension32.dll

c:\program files\Web Assistant\ExtensionUpdaterService.exe

c:\program files\Web Assistant\Firefox\chrome.manifest

c:\program files\Web Assistant\Firefox\chrome\content\libraries\DataExchangeScript.js

c:\program files\Web Assistant\Firefox\chrome\content\main.js

c:\program files\Web Assistant\Firefox\chrome\content\main.xul

c:\program files\Web Assistant\Firefox\chrome\content\resources\localscript.js

c:\program files\Web Assistant\Firefox\chrome\locale\en-US\overlay.dtd

c:\program files\Web Assistant\Firefox\chrome\skin\overlay.css

c:\program files\Web Assistant\Firefox\defaults\preferences\defaults.js

c:\program files\Web Assistant\Firefox\install.rdf

c:\program files\Web Assistant\InstallerHelper.dll

c:\program files\Web Assistant\libraries\DataExchangeScript.js

c:\program files\Web Assistant\resources\localscript.js

c:\program files\Web Assistant\source.crx

c:\program files\Web Assistant\unins000.dat

c:\program files\Web Assistant\unins000.exe

C:\user.js

.

Besmet exemplaar van c:\windows\system32\Services.exe werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\erdnt\cache\services.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_Web Assistant Updater

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-05-26 to 2012-06-26 ))))))))))))))))))))))))))))))

.

2012-06-26 18:52 . 2012-06-26 18:52 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-26 09:39 . 2012-06-26 09:39 -------- d-----w- c:\users\Diana\AppData\Roaming\Malwarebytes

2012-06-26 09:39 . 2012-06-26 09:39 -------- d-----w- c:\programdata\Malwarebytes

2012-06-26 09:39 . 2012-06-26 09:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-06-26 09:39 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-26 07:10 . 2012-06-26 07:10 388096 ----a-r- c:\users\Diana\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-06-26 07:10 . 2012-06-26 07:10 -------- d-----w- c:\program files\Trend Micro

2012-06-26 06:22 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6FDA9DFA-936A-43F0-AA87-C5700B7D8B41}\mpengine.dll

2012-06-24 19:03 . 2012-06-24 19:03 -------- d-----w- c:\program files\Perion

2012-06-24 19:02 . 2012-06-24 19:03 -------- d-----w- c:\program files\1ClickDownload

2012-06-23 08:37 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-23 08:37 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-23 08:37 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-23 08:37 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-23 08:36 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-23 08:36 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-23 08:36 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-23 08:35 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-23 08:35 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-19 16:30 . 2012-06-19 16:30 -------- d-----w- c:\windows\nl

2012-06-19 16:22 . 2012-06-19 16:22 89944 ----a-w- c:\program files\Common Files\Windows Live\.cache\c387b7851cd4e3701\DSETUP.dll

2012-06-19 16:22 . 2012-06-19 16:22 537432 ----a-w- c:\program files\Common Files\Windows Live\.cache\c387b7851cd4e3701\DXSETUP.exe

2012-06-19 16:22 . 2012-06-19 16:22 1801048 ----a-w- c:\program files\Common Files\Windows Live\.cache\c387b7851cd4e3701\dsetup32.dll

2012-06-16 21:56 . 2012-06-16 21:56 476936 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-06-13 06:33 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll

2012-06-13 06:33 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll

2012-06-13 06:33 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll

2012-06-13 06:33 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-13 06:33 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-16 21:56 . 2010-04-16 05:31 472840 ----a-w- c:\windows\system32\deployJava1.dll

2012-06-14 05:26 . 2012-03-31 07:33 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-14 05:26 . 2011-05-21 07:35 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-05-08 07:49 . 2012-03-09 19:07 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-05-08 07:49 . 2012-03-09 19:07 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys

2012-04-03 08:16 . 2012-05-16 08:42 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-04-03 08:16 . 2012-05-16 08:42 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-03-30 12:39 . 2012-05-16 08:42 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-11 39408]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-23 468264]

"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]

"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-06 210216]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]

"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]

"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]

"ConsumerClickSysTrayIcon"="c:\program files\ConsumerClick\ConsumerClickSysTrayIcon.exe" [2010-12-17 69632]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HPService REG_MULTI_SZ HPSLPSVC

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

ezSharedSvc

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-06-09 09:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhoud van de 'Gedeelde Taken' map

.

2012-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 05:26]

.

2012-06-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-03 18:34]

.

2012-06-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-03 18:34]

.

2012-06-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4081737216-3728604838-3465313506-1000Core.job

- c:\users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-02 16:55]

.

2012-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4081737216-3728604838-3465313506-1000UA.job

- c:\users\Diana\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-02 16:55]

.

2012-06-17 c:\windows\Tasks\HPCeeScheduleForDiana.job

- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-11-08 10:34]

.

------- Bijkomende Scan -------

.

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_nl&c=91&bd=Presario&pf=cnnb

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab

.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-{336D0C35-8A85-403a-B9D2-65C292C39087}_is1 - c:\program files\Web Assistant\unins000.exe

.

**************************************************************************

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden:

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files\Avira\AntiVir Desktop\sched.exe

c:\windows\System32\lpksetup.exe

c:\windows\system32\WLANExt.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\SMINST\BLService.exe

c:\program files\CyberLink\Shared files\RichVideo.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\system32\conime.exe

c:\windows\system32\igfxsrvc.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\program files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE

c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

c:\program files\Hewlett-Packard\Shared\HpqToaster.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\program files\HP\Digital Imaging\bin\hpqbam08.exe

c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe

.

**************************************************************************

.

Voltooingstijd: 2012-06-26 21:05:14 - machine werd herstart

ComboFix-quarantined-files.txt 2012-06-26 19:03

ComboFix2.txt 2012-06-26 15:22

.

Pre-Run: 151.985.471.488 bytes beschikbaar

Post-Run: 151.650.258.944 bytes beschikbaar

.

- - End Of File - - 414E1EA7FC5D6C275D0F99EED4145081

26 juni 2012

Hierbij de log gegevens van ComboFix:

ComboFix 12-06-26.01 - Diana 26-06-2012 16:55:30.1.2 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.3002.1907 [GMT 2:00]

Gestart vanuit: c:\users\Diana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FE5GJ30F\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Incredibar.com

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibar.crx

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarApp.dll

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarEng.dll

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarsrv.exe

c:\program files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll

c:\program files\Incredibar.com\incredibar\1.5.11.14\uninstall.exe

c:\program files\Mozilla Firefox\components\AskHPRFF.js

c:\users\Diana\avira_antivir_personal_en.exe

c:\users\Diana\g2mdlhlpx.exe

c:\windows\system32\zrAAk.vbs

.

Besmet exemplaar van c:\windows\system32\Drivers\atapi.sys werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-05-26 to 2012-06-26 ))))))))))))))))))))))))))))))

.

2012-06-26 15:07 . 2012-06-26 15:07 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-26 09:39 . 2012-06-26 09:39 -------- d-----w- c:\users\Diana\AppData\Roaming\Malwarebytes

2012-06-26 09:39 . 2012-06-26 09:39 -------- d-----w- c:\programdata\Malwarebytes

2012-06-26 09:39 . 2012-06-26 09:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-06-26 09:39 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-26 07:10 . 2012-06-26 07:10 388096 ----a-r- c:\users\Diana\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-06-26 07:10 . 2012-06-26 07:10 -------- d-----w- c:\program files\Trend Micro

2012-06-24 19:03 . 2012-06-24 19:03 -------- d-----w- c:\program files\Perion

2012-06-24 19:03 . 2012-06-24 19:03 447 ----a-w- C:\user.js

2012-06-24 19:03 . 2012-06-24 19:03 -------- d-----w- c:\program files\Web Assistant