lucky45

27 september 2012

ik was inderdaad de spatie vergeten voor de slash.

Bedankt voor alle hulp!!

26 september 2012

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht/Programma’s en bestanden zoeken en typ daar: ComboFix /Uninstall

Dit krijg ik niet voor elkaar op de manier zoals beschreven. Kan ik hem ook gewoon van de desktop verwijderen, of gaat dan niet alles mee.

25 september 2012

Ik ben voorzichtig optimistisch, volgens mij is alles weer ok.

ComboFix 12-09-24.03 - Bertram 25-09-2012 18:05:28.2.4 - x86

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.3070.1994 [GMT 2:00]

Gestart vanuit: c:\users\Bertram\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Bertram\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"C:\user.js"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Perion

c:\program files\Perion\NewTab\data.txt

c:\program files\Perion\NewTab\newTab.crx

c:\program files\Web Assistant

c:\program files\Web Assistant\ExtensionUpdaterService.exe

c:\program files\Web Assistant\Firefox\chrome.manifest

c:\program files\Web Assistant\Firefox\chrome\content\libraries\DataExchangeScript.js

c:\program files\Web Assistant\Firefox\chrome\content\main.js

c:\program files\Web Assistant\Firefox\chrome\content\main.xul

c:\program files\Web Assistant\Firefox\chrome\content\resources\localscript.js

c:\program files\Web Assistant\Firefox\chrome\locale\en-US\overlay.dtd

c:\program files\Web Assistant\Firefox\chrome\skin\overlay.css

c:\program files\Web Assistant\Firefox\defaults\preferences\defaults.js

c:\program files\Web Assistant\Firefox\install.rdf

c:\program files\Web Assistant\InstallerHelper.dll

c:\program files\Web Assistant\libraries\DataExchangeScript.js

c:\program files\Web Assistant\resources\localscript.js

c:\program files\Web Assistant\source.crx

c:\program files\Web Assistant\unins000.dat

c:\program files\Web Assistant\unins000.exe

C:\user.js

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_Web Assistant Updater

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-08-25 to 2012-09-25 ))))))))))))))))))))))))))))))

.

2012-09-25 16:12 . 2012-09-25 16:14 -------- d-----w- c:\users\Bertram\AppData\Local\temp

2012-09-25 16:12 . 2012-09-25 16:12 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-09-23 10:21 . 2012-09-23 10:21 -------- d-----w- c:\users\Bertram\AppData\Roaming\Malwarebytes

2012-09-23 10:21 . 2012-09-23 10:21 -------- d-----w- c:\programdata\Malwarebytes

2012-09-23 10:20 . 2012-09-23 10:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-09-23 10:20 . 2012-09-07 15:04 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-16 08:45 . 2012-09-16 08:45 16304 ------w- c:\windows\system32\apl003.sys

2012-09-16 08:45 . 2012-09-16 08:45 13232 ------w- c:\windows\system32\apf003.sys

2012-09-12 13:11 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-09-12 13:11 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys

2012-09-12 13:11 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\rndismpx.sys

2012-09-12 13:11 . 2012-08-22 17:16 1292144 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-09-12 13:11 . 2012-08-22 17:16 240496 ----a-w- c:\windows\system32\drivers\netio.sys

2012-09-12 13:11 . 2012-08-22 17:16 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2012-09-12 13:11 . 2012-08-02 16:57 490496 ----a-w- c:\windows\system32\d3d10level9.dll

2012-09-09 15:50 . 2007-05-03 09:21 29056 ----a-w- c:\windows\system32\drivers\Capt905c.sys

2012-09-09 15:50 . 2007-05-03 09:21 25088 ----a-w- c:\windows\system32\drivers\Camd905c.sys

2012-09-09 15:50 . 2012-09-09 15:54 -------- d-----w- c:\program files\MyDSC2

2012-09-09 10:50 . 2012-09-09 10:49 477168 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-09-09 10:49 . 2012-09-09 10:49 -------- d-----w- c:\program files\Java

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-09 10:49 . 2010-04-19 04:50 473072 ----a-w- c:\windows\system32\deployJava1.dll

2012-08-06 14:53 . 2012-07-16 16:52 139080 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2012-08-06 14:53 . 2012-07-16 17:59 270240 ----a-w- c:\windows\system32\PnkBstrB.xtr

2012-08-06 14:53 . 2012-07-16 16:52 270240 ----a-w- c:\windows\system32\PnkBstrB.exe

2012-07-30 13:41 . 2012-07-16 16:52 270240 ----a-w- c:\windows\system32\PnkBstrB.ex0

2012-07-18 17:47 . 2012-08-15 20:02 2345984 ----a-w- c:\windows\system32\win32k.sys

2012-07-16 16:52 . 2012-07-16 16:52 138056 ----a-w- c:\users\Bertram\AppData\Roaming\PnkBstrK.sys

2012-07-16 16:52 . 2012-07-16 16:52 75136 ----a-w- c:\windows\system32\PnkBstrA.exe

2012-07-04 21:14 . 2012-08-15 20:02 41984 ----a-w- c:\windows\system32\browcli.dll

2012-07-04 21:14 . 2012-08-15 20:02 102912 ----a-w- c:\windows\system32\browser.dll

2012-09-07 15:21 . 2012-09-07 15:21 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Akamai NetSession Interface"="c:\users\Bertram\AppData\Local\Akamai\netsession_win.exe" [2012-08-10 4440896]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-06-24 2202704]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"Garmin Lifetime Updater"="c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe" [2012-06-04 1466760]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

c:\users\Bertram\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2010-1-16 974848]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

R3 apf003;apf003;c:\windows\system32\apf003.sys [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]

R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 netr28;Ralink 802.11n stuurprogramma voor draadloze netwerken voor Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]

S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]

S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [x]

S2 SpyroService;Spyro Portal Service;c:\program files\FS\Spyro Portal\FlashPortal.exe [x]

S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Inhoud van de 'Gedeelde Taken' map

.

2012-09-25 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 16:06]

.

2012-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 19:06]

.

2012-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 19:06]

.

2012-09-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935925857-3582874073-2332455473-1000Core.job

- c:\users\Bertram\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-29 21:39]

.

2012-09-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935925857-3582874073-2332455473-1000UA.job

- c:\users\Bertram\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-29 21:39]

.

------- Bijkomende Scan -------

.

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

Trusted Zone: sproetje.org\www

TCP: Interfaces\{6300CB0B-D6DC-4688-BA95-9E11E48EBB7B}: NameServer = 192.168.1.1

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB

DPF: {63D6DD13-C913-466D-9444-9357561E4D94} - hxxp://www.mijnalbum.nl/v3/skinsrc/core/system/ma5.8.3/uploadtoepassing.cab

DPF: {B4A41BDB-320A-4AF4-8DBC-846866A62657} - hxxp://www.mijnalbum.nl/v3/skinsrc/core/system/ma7.0.43/ImageUploader7.cab

DPF: {B7915D9F-6057-4153-BE1B-8E234BD66980} - hxxp://www.mijnalbum.nl/v3/skinsrc/core/system/ma7.0.23/ImageUploader7.cab

FF - ProfilePath - c:\users\Bertram\AppData\Roaming\Mozilla\Firefox\Profiles\6c5jkrm3.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: network.proxy.type - 0

FF - user.js: extensions.incredibar_i.ppd - 77777176

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_5891ae0.dll"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\windows\system32\atieclxx.exe

c:\program files\NVIDIA Corporation\Display\nvxdsync.exe

c:\windows\system32\nvvsvc.exe

c:\windows\system32\taskhost.exe

c:\programdata\EPSON\EPW!3 SSRP\E_S40ST7.EXE

c:\programdata\EPSON\EPW!3 SSRP\E_S40RP7.EXE

c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\Common Files\Protexis\License Service\PsiService_2.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\conhost.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\DllHost.exe

c:\windows\system32\WUDFHost.exe

c:\windows\system32\sppsvc.exe

.

**************************************************************************

.

Voltooingstijd: 2012-09-25 18:18:19 - machine werd herstart

ComboFix-quarantined-files.txt 2012-09-25 16:18

ComboFix2.txt 2012-09-24 15:17

.

Pre-Run: 114.666.708.992 bytes beschikbaar

Post-Run: 114.456.002.560 bytes beschikbaar

.

- - End Of File - - 7F227DF7E95F95D327235AF0CEAE95F2

24 september 2012

ComboFix 12-09-24.02 - Bertram 24-09-2012 17:03:31.1.4 - x86

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.3070.1902 [GMT 2:00]

Gestart vanuit: c:\users\Bertram\Desktop\ComboFix.exe

AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\uTorrent\uTorrent.exe

c:\windows\IsUn0413.exe

c:\windows\system32\FlashPlayerInstaller.exe

c:\windows\unin0413.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-08-24 to 2012-09-24 ))))))))))))))))))))))))))))))

.

2012-09-24 15:12 . 2012-09-24 15:13 -------- d-----w- c:\users\Bertram\AppData\Local\temp

2012-09-24 15:12 . 2012-09-24 15:12 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-09-24 15:12 . 2012-09-24 15:12 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-09-23 10:21 . 2012-09-23 10:21 -------- d-----w- c:\users\Bertram\AppData\Roaming\Malwarebytes

2012-09-23 10:21 . 2012-09-23 10:21 -------- d-----w- c:\programdata\Malwarebytes

2012-09-23 10:20 . 2012-09-23 10:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-09-23 10:20 . 2012-09-07 15:04 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-22 07:06 . 2012-09-22 07:06 -------- d-----w- c:\program files\Perion

2012-09-22 07:06 . 2012-09-22 07:06 455 ----a-w- C:\user.js

2012-09-22 07:06 . 2012-09-23 10:17 -------- d-----w- c:\program files\Web Assistant