Killer Queen

12 november 2009

Ik heb het gevonden ^^

Nieuwsgierigen kunnen de oplossing nalezen in http://www.pc-helpforum.be/f168/google-doet-vreemd-na-terug-knop-18851/

Zo, ben erg opgelucht.

Bedankt voor de hulp iedereen.

KQ

xx

12 november 2009

HAH!

We zijn eruit

Mijn vriend was hier als Ff me na en toektocht ook weer toevallig terugstuurde naar Google Dark.

En hij vroeg wat dat was, dus gingen we eens naar de site.

En ik die al de hele tijd dacht dat Google Dark een site op zich was,

bleek het een scriptje te zijn, natuurlijk ging er onmiddellijk een lampje branden

Effectief, onder Greasemonkey stond er Google Dark geïnstalleerd, dat even met 1 druk op de knop uninstalled en het probleem was verholpen!

Nu kan je wel zeggen, dat weet je dan toch wel zelf, als je zo iets installeert en er begint iets mis te lopen dat het daaraan ligt.

Maar ik heb Firefox zo lang zonder problemen gebruikt tot het begon mis te lopen,

ik herinner me wel nog dat ik ooit eens die Dark uitgeprobeerd heb, maar ondanks formatjes en herinstalls zal dat script altijd mee verhuisd zijn in de Firefox profielen die ik netjes backup, tot als Ff tot een versie is gekomen waar het waarschijnlijk problemen gaf met Google Dark, vandaar

Kan me moeilijk inbeelden dat er nog veel mensen zijn met een gelijkaardig probleem , je weet maar nooit, dan hoop ik dat ze met deze thread eveneens geholpen zijn ^^

Groetjes en bedankt voor de moeite lieve mensen

KQ

xx

11 november 2009

Heb een Combofix log ook. Probleem nog niet opgelost. Plak hier ook nog even een screenie aan, want toen ik het testte stuurde hij me terug naar Google Dark, dat zoals ik eerder vermeldde ook wel eens voorkomt, heel wisselvallig.

ComboFix 09-11-11.01 - Killer Queen 11/11/2009 18:10.1.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.32.1043.18.1023.520 [GMT 1:00]

Gestart vanuit: c:\program files\Programs\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\recycler\S-1-5-21-1004336348-261903793-839522115-1003

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-10-11 to 2009-11-11 ))))))))))))))))))))))))))))))

.

2009-11-10 12:38 . 2009-11-10 12:38 -------- d-----w- c:\documents and settings\Killer Queen\Application Data\Malwarebytes

2009-11-10 12:38 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-10 12:38 . 2009-11-10 12:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-11-10 12:38 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-10 12:38 . 2009-11-10 13:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-07 18:47 . 2009-11-07 18:47 -------- d-----w- c:\program files\Trend Micro

2009-11-06 02:14 . 2009-11-06 02:14 41872 ----a-w- c:\windows\system32\xfcodec.dll

2009-11-05 21:06 . 2009-11-05 21:06 -------- d-----w- c:\program files\Microsoft

2009-10-29 19:40 . 2009-10-29 16:37 15880 ----a-w- c:\windows\system32\lsdelete.exe

2009-10-29 16:36 . 2009-10-29 16:36 5908024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll

2009-10-29 16:36 . 2009-10-29 16:36 327000 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll

2009-10-29 16:36 . 2009-10-29 16:36 87496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll

2009-10-29 16:36 . 2009-10-29 16:36 933120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll

2009-10-29 16:36 . 2009-10-29 16:36 640608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe

2009-10-29 16:35 . 2009-10-29 16:35 815760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe

2009-10-29 16:35 . 2009-10-29 16:35 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe

2009-10-29 16:35 . 2009-10-29 16:35 1638104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe

2009-10-29 16:34 . 2009-10-29 16:35 788368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe

2009-10-29 16:31 . 2009-10-29 16:34 1179232 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe

2009-10-29 16:26 . 2009-10-29 16:26 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}

2009-10-29 16:26 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe

2009-10-29 16:26 . 2009-10-29 16:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-10-29 16:26 . 2009-10-29 16:26 -------- d-----w- c:\program files\Lavasoft

2009-10-27 19:29 . 2009-10-27 19:29 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2009-10-27 19:24 . 2009-11-05 21:29 -------- d-----w- c:\documents and settings\Killer Queen\Local Settings\Application Data\Temp

2009-10-27 19:24 . 2009-10-27 19:24 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

2009-10-27 19:24 . 2009-11-07 21:34 -------- d-----w- c:\documents and settings\Killer Queen\Local Settings\Application Data\Google

2009-10-27 19:24 . 2009-10-27 19:26 -------- d-----w- c:\program files\Google

2009-10-21 07:28 . 2009-10-21 07:27 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll

2009-10-17 10:45 . 2009-10-17 10:44 2025752 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-11 17:05 . 2009-08-28 15:44 -------- d-----r- c:\program files\Programs

2009-11-11 14:47 . 2009-03-28 15:54 -------- d-----w- c:\program files\Mozilla Thunderbird

2009-11-11 02:47 . 2009-04-19 18:43 -------- d-----w- c:\program files\Xfire

2009-11-10 10:14 . 2009-04-19 18:43 -------- d-----w- c:\documents and settings\Killer Queen\Application Data\Xfire

2009-11-10 00:16 . 2009-04-19 18:47 -------- d-----w- c:\documents and settings\Killer Queen\Application Data\Skype

2009-11-09 23:06 . 2009-04-19 18:52 -------- d-----w- c:\documents and settings\Killer Queen\Application Data\skypePM

2009-11-07 21:44 . 2009-04-19 20:10 -------- d-----w- c:\program files\Windows Live Safety Center

2009-11-07 21:15 . 2009-04-24 15:10 -------- d-----w- c:\documents and settings\Killer Queen\Application Data\FrostWire

2009-11-07 18:03 . 2009-03-28 15:59 -------- d-----w- c:\program files\Messenger Plus! Live

2009-11-06 00:33 . 2009-03-28 15:20 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin

2009-11-05 21:05 . 2009-03-28 16:37 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-10-25 10:53 . 2004-08-04 12:00 91836 ----a-w- c:\windows\system32\perfc013.dat

2009-10-25 10:53 . 2004-08-04 12:00 512196 ----a-w- c:\windows\system32\perfh013.dat

2009-10-15 10:50 . 2009-03-28 16:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2009-10-10 14:17 . 2009-10-10 14:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia

2009-10-10 14:16 . 2009-08-02 17:20 -------- d-----w- c:\program files\Common Files\Nokia

2009-10-10 14:16 . 2009-06-12 16:35 -------- d-----w- c:\program files\Nokia

2009-10-10 14:15 . 2009-10-10 14:15 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\Sleep.exe

2009-10-10 14:15 . 2009-10-10 14:15 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\msxml6Exec.exe

2009-10-10 14:15 . 2009-10-10 14:15 3181612 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\vcredistExec.exe

2009-10-10 14:15 . 2009-06-12 16:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations

2009-10-10 13:24 . 2009-10-10 14:16 24501456 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\NokiaSoftwareUpdaterSetup_en.exe

2009-09-27 16:44 . 2009-04-19 19:28 172032 ----a-w- c:\documents and settings\Killer Queen\Application Data\Mozilla\Firefox\Profiles\hp83rv43.default\FlashGot.exe

2009-09-25 05:58 . 2004-08-04 12:00 665088 ----a-w- c:\windows\system32\wininet.dll

2009-09-25 05:58 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll

2009-09-23 12:55 . 2009-10-29 16:37 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2009-09-15 08:26 . 2009-07-12 23:57 -------- d-----w- c:\program files\Steam

2009-09-11 14:37 . 2004-08-04 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll

2009-09-04 20:47 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll

2009-09-01 10:28 . 2009-09-27 16:44 65536 ----a-w- c:\documents and settings\Killer Queen\Application Data\Mozilla\Firefox\Profiles\hp83rv43.default\extensions\fotofox@mozilla.com\platform\WINNT_x86-msvc\components\mozFotofox.dll

2009-08-26 08:16 . 2004-08-04 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll

2009-08-24 08:25 . 2009-08-24 08:24 8 ----a-w- c:\windows\system32\nvModes.dat

2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL

2009-08-16 09:09 . 2009-03-28 16:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-08-16 09:09 . 2009-03-28 16:37 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-08-16 09:09 . 2009-03-28 16:37 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2006-05-06 16:42 . 2009-04-19 18:10 7260160 ----a-w- c:\program files\mozilla firefox\plugins\libvlc.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

"ISPMonitor"="c:\program files\ISP Monitor\isp.exe" [2009-05-03 422496]

"Netlog Music Tool"="c:\program files\Netlog Music Tool\NetlogMusicTool.exe" [2009-05-02 1728456]

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]

"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-03-21 1953792]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-12 8429568]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-12 81920]

"GamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-02-14 380928]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-05 2028312]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-24 148888]

"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2007-03-26 53248]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-04-12 1626112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\Killer Queen\Menu Start\Programma's\Opstarten\

Xfire.lnk - c:\program files\Xfire\xfire.exe [2009-11-6 3152272]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Office-Bibliothek-Direktsuche.lnk - c:\program files\Office-Bibliothek\PCLib.exe [2009-6-5 323584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-08-16 09:09 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\ICQ6.5\\ICQ.exe"=

"c:\\Program Files\\Xfire\\xfire.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\hp_LJ3050-3052-3055-3390-3392_Full_Solution\\setup\\hppniprint01.exe"=

"c:\\hp_LJ3050-3052-3055-3390-3392_Full_Solution\\setup\\hpntwkexe.exe"=

"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=

"c:\\Program Files\\FrostWire\\FrostWire.exe"=

"c:\\Program Files\\mIRC\\mirc.exe"=

"c:\\Program Files\\Steam\\steamapps\\killer_queen_666\\counter-strike\\hl.exe"=

"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=

"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [29/10/2009 17:37 64288]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [28/03/2009 17:37 335240]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [28/03/2009 17:37 108552]

R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [28/03/2009 17:37 908056]

R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [28/03/2009 17:37 297752]

R2 ISPMonitorSrv;ISP Monitor;c:\program files\ISP Monitor\ISPMonitorSrv.exe [22/08/2007 23:55 36864]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 12:17 1179232]

R3 ovt530;Webcam Deluxe;c:\windows\system32\drivers\ov530vid.sys [28/03/2009 16:46 161792]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [27/10/2009 20:24 133104]

S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [28/03/2009 15:56 38656]

S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\progra~1\Belkin\BELKIN~1.11G\DNINDIS5.SYS [28/03/2009 16:27 17149]

S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [18/06/2009 22:31 136704]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

--- Andere Services/Drivers In Geheugen ---

*NewlyCreated* - MBR

*NewlyCreated* - PROCEXP113

*Deregistered* - mbr

*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08

.

Inhoud van de 'Gedeelde Taken' map

2009-11-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 16:35]

2009-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-27 19:24]

2009-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-27 19:24]

2009-11-10 c:\windows\Tasks\OGADaily.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 15:04]

2009-11-11 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 15:04]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

uInternet Connection Wizard,ShellNext = hxxp://www.gameguard.co.kr/gameguard/faq/eng/FAQ_3xx.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MI699F~1\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Killer Queen\Application Data\Mozilla\Firefox\Profiles\hp83rv43.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.be

FF - component: c:\documents and settings\Killer Queen\Application Data\Mozilla\Firefox\Profiles\hp83rv43.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll

FF - component: c:\documents and settings\Killer Queen\Application Data\Mozilla\Firefox\Profiles\hp83rv43.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll

FF - component: c:\documents and settings\Killer Queen\Application Data\Mozilla\Firefox\Profiles\hp83rv43.default\extensions\fotofox@mozilla.com\platform\WINNT_x86-msvc\components\mozFotofox.dll

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npvlc.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

- - - - ORPHANS VERWIJDERD - - - -

AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-11-11 18:14

Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, GMER - Rootkit Detector and Remover

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x867681F8]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\atapi -> 0x867681f8

Warning: possible MBR rootkit infection !

user & kernel MBR OK

Use "Recovery Console" command "fixmbr" to clear infection !

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|þ»Ñw*]

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(2356)

c:\program files\Xfire\xfire_toucan_40120.dll

c:\windows\system32\msi.dll

.

Voltooingstijd: 2009-11-11 18:15

ComboFix-quarantined-files.txt 2009-11-11 17:15

Pre-Run: 694.633.787.392 bytes beschikbaar

Post-Run: 695.806.763.008 bytes beschikbaar

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 565815DA9C0EEC9244E1F72EA234E9F4

11 november 2009

Dankjewel, alsjeblief

Je had er wel even mogen bijzeggen dat het alle lopende programma's sluit, best vervelend :/