HELP! Ik heb ook het CRITICAL HARDDISK ERROR: crash of virus/trojan horse..??

kape · 19 juni 2011

Verwijder de huidige versie van Combofix met de opdracht Combofix /Uninstall via uitvoeren/opdrachtvak. Download daarna opnieuw een nieuwe versie van CF naar je bureaublad. En sleep dan het bestandje cfscript.txt (dat je eerder hebt aangemaakt) in de rode snelkoppeling van Combofix. Dan zou CF opnieuw moeten opstarten en de vermelde items moeten verwijderen.

nancyvang · 19 juni 2011

ok dank je hij loopt weer.

nancyvang · 19 juni 2011

hier een nieuwe log

ComboFix 11-06-17.04 - Nancy 19-06-2011 14:57:04.2.1 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.2037.961 [GMT 2:00]

Gestart vanuit: c:\users\Nancy\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Nancy\Desktop\CFScript.txt. - Snelkoppeling.lnk

AV: Norton AntiVirus *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: Norton AntiVirus *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-05-19 to 2011-06-19 ))))))))))))))))))))))))))))))

.

2011-06-19 13:14 . 2011-06-19 13:15 -------- d-----w- c:\users\Nancy\AppData\Local\temp

2011-06-19 13:14 . 2011-06-19 13:14 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-06-19 12:50 . 2011-06-19 12:52 -------- d-----w- C:\32788R22FWJFW

2011-06-18 18:06 . 2011-06-18 18:06 -------- d-----w- c:\users\Nancy\AppData\Roaming\Malwarebytes

2011-06-18 18:05 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\programdata\Malwarebytes

2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-18 18:05 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-18 16:48 . 2011-06-18 16:48 -------- d-----w- c:\users\Nancy\AppData\Roaming\Reviversoft

2011-06-18 16:29 . 2011-05-17 12:51 16704 ----a-w- c:\windows\system32\roboot.exe

2011-06-18 16:02 . 2011-06-18 16:02 388096 ----a-r- c:\users\Nancy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-06-18 16:02 . 2011-06-18 16:02 -------- d-----w- c:\program files\Trend Micro

2011-06-18 15:06 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83DCB7F6-5579-4AE1-A3E3-C30D5DBE326C}\mpengine.dll

2011-06-18 14:54 . 2011-06-19 09:20 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2011-06-18 14:47 . 2011-06-18 20:22 -------- d-----w- c:\windows\system32\drivers\NAV

2011-06-18 14:46 . 2011-06-18 14:47 -------- d-----w- c:\program files\Norton AntiVirus

2011-06-18 14:44 . 2011-06-18 14:44 -------- d-----w- c:\program files\NortonInstaller

2011-06-18 14:20 . 2011-06-18 14:20 -------- d-----w- c:\program files\AVG

2011-06-18 13:51 . 2011-06-18 13:51 -------- d-----w- c:\users\Nancy\AppData\Local\{E561CC4B-00EE-475A-A7F6-8374E7288BBD}

2011-06-18 11:26 . 2011-06-18 11:26 -------- d-----w- c:\users\Nancy\AppData\Local\{585AAEA6-CDA6-48D1-AA7A-939BFE92542B}

2011-06-18 11:01 . 2011-06-18 11:01 -------- d-----w- c:\users\Nancy\AppData\Local\{4BABDD26-206E-4298-998C-F077AAE04A58}

2011-06-17 07:32 . 2011-06-17 07:32 -------- d-----w- c:\users\Nancy\AppData\Local\{2BF7FE24-A06A-420B-9649-EB418974AAD0}

2011-06-16 19:19 . 2011-06-16 19:19 -------- d-----w- c:\users\Nancy\AppData\Local\{F15279E2-7B52-4839-869A-68902F5918B9}

2011-06-16 07:59 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-16 07:59 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-16 07:59 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-06-16 07:18 . 2011-06-16 07:19 -------- d-----w- c:\users\Nancy\AppData\Local\{4DE5EE15-2C05-4B22-9628-8C99B70B4C0C}

2011-06-15 21:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-06-15 21:33 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys

2011-06-15 21:33 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-06-15 21:33 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-06-15 21:33 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-06-15 21:32 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-06-15 21:32 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-06-15 21:32 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-06-15 21:32 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-06-15 21:32 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-06-15 15:27 . 2011-06-15 15:27 -------- d-----w- c:\users\Nancy\AppData\Local\{2F8574D1-E0CA-4E9E-A57E-3736C21462EB}

2011-06-14 22:15 . 2011-06-14 22:15 -------- d-----w- c:\users\Nancy\AppData\Local\{2E3D7290-AD94-4171-A7A8-D2BCEC78021A}

2011-06-14 10:15 . 2011-06-14 10:15 -------- d-----w- c:\users\Nancy\AppData\Local\{95E50AE5-193D-45AB-882C-EF03D6472765}

2011-06-13 22:14 . 2011-06-13 22:14 -------- d-----w- c:\users\Nancy\AppData\Local\{AED600EE-A22F-4B20-B275-15BDAB4F6C8E}

2011-06-13 10:13 . 2011-06-13 10:14 -------- d-----w- c:\users\Nancy\AppData\Local\{10321860-2BDF-4E78-BDB3-5BCD07AD629D}

2011-06-12 22:13 . 2011-06-12 22:13 -------- d-----w- c:\users\Nancy\AppData\Local\{96F2A133-5B19-4979-AF8B-DFABCE0B7F78}

2011-06-12 09:17 . 2011-06-12 09:17 -------- d-----w- c:\users\Nancy\AppData\Local\{0B37F928-84AD-4098-9C93-ABB7779AA081}

2011-06-11 11:44 . 2011-06-11 11:45 -------- d-----w- c:\users\Nancy\AppData\Local\{75BA0DB9-3BB4-4655-9649-A659B8E1EC96}

2011-06-10 23:44 . 2011-06-10 23:44 -------- d-----w- c:\users\Nancy\AppData\Local\{D95AA3A4-F1D5-4578-8A9F-23CAEAA3B0D4}

2011-06-10 07:03 . 2011-06-10 07:03 -------- d-----w- c:\users\Nancy\AppData\Local\{746AFE7F-06CA-4AAE-8892-3E630E900FD0}

2011-06-09 18:39 . 2011-06-09 18:39 -------- d-----w- c:\users\Nancy\AppData\Local\{92572B97-72EF-4417-A512-13BB18D53462}

2011-06-09 06:38 . 2011-06-09 06:38 -------- d-----w- c:\users\Nancy\AppData\Local\{CE243EB9-B936-4FA7-8E4A-BC5EE678CBF3}

2011-06-08 18:37 . 2011-06-08 18:38 -------- d-----w- c:\users\Nancy\AppData\Local\{FA9AA1D7-87BB-4A81-B016-80FE0CDCC336}

2011-06-08 06:37 . 2011-06-08 06:37 -------- d-----w- c:\users\Nancy\AppData\Local\{4E0A34E5-C147-4B9F-ACF5-4C604628D904}

2011-06-07 19:36 . 2011-06-07 19:36 -------- d-----w- c:\program files\Conduit

2011-06-07 19:35 . 2011-06-07 19:35 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\users\Nancy\AppData\Local\Conduit

2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\program files\InnoGames_International

2011-06-07 10:52 . 2011-06-07 10:53 -------- d-----w- c:\users\Nancy\AppData\Local\{C8A7EC52-DF0E-44E7-8DFE-8AF70F70C21D}

2011-06-06 18:29 . 2011-06-06 18:29 -------- d-----w- c:\users\Nancy\AppData\Local\{2BBF3D80-17C0-4CA6-ADB0-D974AE317FDB}

2011-06-06 06:28 . 2011-06-06 06:28 -------- d-----w- c:\users\Nancy\AppData\Local\{7BCB44D8-D4FB-402A-A6BA-9774902EAAB3}

2011-06-05 11:26 . 2011-06-05 11:26 -------- d-----w- c:\users\Nancy\AppData\Local\{992D8976-D0B3-41A2-AC72-94C5005089C0}

2011-06-04 23:25 . 2011-06-04 23:25 -------- d-----w- c:\users\Nancy\AppData\Local\{89040DCA-974D-4F14-A85D-3C90DC375D20}

2011-06-04 10:56 . 2011-06-04 10:56 -------- d-----w- c:\users\Nancy\AppData\Local\{89AD610B-15F9-4286-8484-F9A94803146D}

2011-06-03 22:55 . 2011-06-03 22:55 -------- d-----w- c:\users\Nancy\AppData\Local\{2E311ACA-3649-450A-92AC-8D0D230D7F51}

2011-06-03 10:11 . 2011-06-03 10:12 -------- d-----w- c:\users\Nancy\AppData\Local\{6A60A271-6D8E-4C47-B521-712850B3EA75}

2011-06-02 21:38 . 2011-06-02 21:38 -------- d-----w- c:\program files\Navigram

2011-06-02 21:01 . 2011-06-02 21:02 -------- d-----w- c:\users\Nancy\AppData\Local\{2366CA52-A42F-4C02-8B66-6E7413266579}

2011-06-02 09:01 . 2011-06-02 09:01 -------- d-----w- c:\users\Nancy\AppData\Local\{11D7D134-D62D-4565-86C5-3C3FA205F9B7}

2011-06-01 21:00 . 2011-06-01 21:00 -------- d-----w- c:\users\Nancy\AppData\Local\{C99141CF-1998-4D5D-98EE-3D321D8FBFAB}

2011-06-01 15:51 . 2011-06-01 15:52 -------- d-----w- c:\users\Nancy\AppData\Local\{A332EBF1-FFFE-4E33-B5FF-615DAF4C4F6C}

2011-05-31 22:03 . 2011-05-31 22:03 -------- d-----w- c:\users\Nancy\AppData\Local\{FC8F4A5A-3751-494D-8C04-66A3EAFFEB36}

2011-05-31 06:17 . 2011-05-31 06:17 -------- d-----w- c:\users\Nancy\AppData\Local\{ABE64375-0416-45A0-B69F-7938DB5B6D16}

2011-05-30 16:48 . 2011-05-30 16:48 -------- d-----w- c:\users\Nancy\AppData\Local\{24AA0B77-3005-4350-A855-BFEAFEF6F74A}

2011-05-29 21:54 . 2011-05-29 21:54 -------- d-----w- c:\users\Nancy\AppData\Local\{97D375D6-35F7-4EE0-B6D2-3359F15F30CB}

2011-05-29 09:53 . 2011-05-29 09:53 -------- d-----w- c:\users\Nancy\AppData\Local\{69CFC663-C1D2-4177-8AEF-03E14B316570}

2011-05-28 11:26 . 2011-05-28 11:27 -------- d-----w- c:\users\Nancy\AppData\Local\{E610BA14-1123-47F0-9D9B-DE5D315792B6}

2011-05-27 23:26 . 2011-05-27 23:26 -------- d-----w- c:\users\Nancy\AppData\Local\{D52379C4-6D54-49C3-99DD-BB01A472835C}

2011-05-27 06:53 . 2011-05-27 06:53 -------- d-----w- c:\users\Nancy\AppData\Local\{0F752173-ED2D-4B7F-A37B-B8AEC2DCBCCD}

2011-05-26 20:57 . 2011-05-26 21:01 -------- d-----w- c:\users\Nancy\AppData\Roaming\TeamViewer

2011-05-26 20:56 . 2011-05-26 20:56 -------- d-----w- c:\program files\TeamViewer

2011-05-26 18:52 . 2011-05-26 18:52 -------- d-----w- c:\users\Nancy\AppData\Local\{B491E160-7296-45AD-BF4E-B52BEE091015}

2011-05-26 06:52 . 2011-05-26 06:52 -------- d-----w- c:\users\Nancy\AppData\Local\{4D6A9A06-0957-4D52-92CB-8E69DDBD4CB4}

2011-05-25 15:13 . 2011-05-25 15:13 -------- d-----w- c:\users\Nancy\AppData\Local\{66E4BAF8-6C76-442C-90D8-7248F48B4CDD}

2011-05-24 18:26 . 2011-05-24 18:26 -------- d-----w- c:\users\Nancy\AppData\Local\{EBA9D5F0-FE17-4B12-86AE-1939BED5812A}

2011-05-24 12:57 . 2011-06-15 20:19 -------- d-----w- c:\programdata\Skype Extras

2011-05-24 12:56 . 2011-05-24 12:56 -------- d-----w- c:\program files\Common Files\Skype

2011-05-24 06:25 . 2011-05-24 06:25 -------- d-----w- c:\users\Nancy\AppData\Local\{AF964F8F-2B7C-4A25-BB67-DAF3C9F62AF5}

2011-05-23 16:43 . 2011-05-23 16:43 -------- d-----w- c:\users\Nancy\AppData\Local\{B8993139-1FF1-4AD2-A902-35D445465D45}

2011-05-22 22:51 . 2011-05-22 22:51 -------- d-----w- c:\users\Nancy\AppData\Local\{527569DB-3B2F-4FE7-8EE5-9CA8502B136B}

2011-05-22 09:54 . 2011-05-22 09:54 -------- d-----w- c:\users\Nancy\AppData\Local\{F101C60C-0A91-4FDE-9771-38838673E9BA}

2011-05-21 12:08 . 2011-05-21 12:08 -------- d-----w- c:\users\Nancy\AppData\Local\{8AF9163F-B6CC-4B75-8002-65E658370B13}

2011-05-20 21:35 . 2011-05-20 21:35 -------- d-----w- c:\users\Nancy\AppData\Local\{45692F7C-B55D-4749-B797-45233B117F34}

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-03-09 247728]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-28 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-28 154136]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-28 137752]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-30 159744]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]

"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]

.

c:\users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate1ca05a05a2d3ab0;Google Updateservice (gupdate1ca05a05a2d3ab0);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104]

R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]

R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]

R3 DCamUSBNW800;CIF USB Camera (2110);c:\windows\system32\DRIVERS\pcam800.sys [2002-07-27 210792]

R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1206000.01D\SYMDS.SYS [2011-01-27 340088]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1206000.01D\SYMEFA.SYS [2011-03-15 744568]

S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20110616.003\BHDrvx86.sys [2011-06-15 810616]

S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20110615.001\IDSvix86.sys [2011-06-10 367736]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1206000.01D\Ironx86.SYS [2011-01-27 136312]

S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]

S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-06-18 105592]

S3 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\NAV\1201000.025\SYMTDIV.SYS [2010-07-13 331312]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-19 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-15 23:01]

.

2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02]

.

2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

Trusted Zone: navigram.com\www

TCP: DhcpNameServer = 194.134.5.5 194.134.0.97

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-19 15:15

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NAV]

"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-1799926568-97698467-2023138869-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2594D239-90E4-6F0A-46B8-4DB5907FD91E}*]

"oaigdonmkdndpahonfnedjgjaabbbm"=hex:6a,61,64,68,62,69,66,61,63,63,68,6f,69,66,

6a,66,6b,6e,65,6b,00,f7

"pacifjomjapaepmhaimimddiahmfacmn"=hex:6a,61,67,66,68,68,62,70,67,63,66,70,6c,

61,64,6a,6a,6f,68,6c,00,f7

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Voltooingstijd: 2011-06-19 15:21:23

ComboFix-quarantined-files.txt 2011-06-19 13:21

ComboFix2.txt 2011-06-18 20:38

.

Pre-Run: 11.141.681.152 bytes beschikbaar

Post-Run: 13.020.696.576 bytes beschikbaar

.

- - End Of File - - 2D34884ECB0EBA98E1B01B64FF5E5D39

19 juni 2011 aangepast door nancyvang

kape · 19 juni 2011

Dit is - jammer genoeg - niet correct verlopen. Je hebt de link van Combofix in de snelkoppeling gesleept ... maar het moet enkel het bestandje cfscript.txt zijn dat je inbrengt om de fouten te verbeteren. Wil je nog eens trachten dit te herhalen en correct uit te voeren ?

nancyvang · 19 juni 2011

nee ik heb echt het bestandje in de rode cobofix snelkoppeling gesleept

Maar ik zal het nog eens proberen.

nancyvang · 20 juni 2011

hier een nieuwe log ik hoop dat deze wel goed is.

ComboFix 11-06-19.0r1 - Nancy 20-06-2011 22:40:49.3.1 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.2037.1010 [GMT 2:00]

Gestart vanuit: c:\users\Nancy\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Nancy\Desktop\CFScript.txt..txt

AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\system32\ConduitEngine.tmp"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Conduit

c:\program files\Conduit\Community Alerts\Alert.dll

c:\program files\InnoGames_International

c:\program files\InnoGames_International\GottenAppsContextMenu.xml

c:\program files\InnoGames_International\InnoGames_InternationalToolbarHelper.exe

c:\program files\InnoGames_International\ldrtbInno.dll

c:\program files\InnoGames_International\OtherAppsContextMenu.xml

c:\program files\InnoGames_International\prxtbInno.dll

c:\program files\InnoGames_International\SharedAppsContextMenu.xml

c:\program files\InnoGames_International\tbInno.dll

c:\program files\InnoGames_International\toolbar.cfg

c:\program files\InnoGames_International\ToolbarContextMenu.xml

c:\program files\InnoGames_International\uninstall.exe

c:\users\Nancy\AppData\Local\{0B37F928-84AD-4098-9C93-ABB7779AA081}

c:\users\Nancy\AppData\Local\{0F03B390-2011-47B2-9336-2FDA2B4A4360}

c:\users\Nancy\AppData\Local\{0F752173-ED2D-4B7F-A37B-B8AEC2DCBCCD}

c:\users\Nancy\AppData\Local\{10321860-2BDF-4E78-BDB3-5BCD07AD629D}

c:\users\Nancy\AppData\Local\{11D7D134-D62D-4565-86C5-3C3FA205F9B7}

c:\users\Nancy\AppData\Local\{2366CA52-A42F-4C02-8B66-6E7413266579}

c:\users\Nancy\AppData\Local\{24AA0B77-3005-4350-A855-BFEAFEF6F74A}

c:\users\Nancy\AppData\Local\{2BBF3D80-17C0-4CA6-ADB0-D974AE317FDB}

c:\users\Nancy\AppData\Local\{2BF7FE24-A06A-420B-9649-EB418974AAD0}

c:\users\Nancy\AppData\Local\{2E311ACA-3649-450A-92AC-8D0D230D7F51}

c:\users\Nancy\AppData\Local\{2E3D7290-AD94-4171-A7A8-D2BCEC78021A}

c:\users\Nancy\AppData\Local\{2F8574D1-E0CA-4E9E-A57E-3736C21462EB}

c:\users\Nancy\AppData\Local\{45692F7C-B55D-4749-B797-45233B117F34}

c:\users\Nancy\AppData\Local\{4BABDD26-206E-4298-998C-F077AAE04A58}

c:\users\Nancy\AppData\Local\{4D6A9A06-0957-4D52-92CB-8E69DDBD4CB4}

c:\users\Nancy\AppData\Local\{4DE5EE15-2C05-4B22-9628-8C99B70B4C0C}

c:\users\Nancy\AppData\Local\{4E0A34E5-C147-4B9F-ACF5-4C604628D904}

c:\users\Nancy\AppData\Local\{527569DB-3B2F-4FE7-8EE5-9CA8502B136B}

c:\users\Nancy\AppData\Local\{585AAEA6-CDA6-48D1-AA7A-939BFE92542B}

c:\users\Nancy\AppData\Local\{66E4BAF8-6C76-442C-90D8-7248F48B4CDD}

c:\users\Nancy\AppData\Local\{69CFC663-C1D2-4177-8AEF-03E14B316570}

c:\users\Nancy\AppData\Local\{6A60A271-6D8E-4C47-B521-712850B3EA75}

c:\users\Nancy\AppData\Local\{746AFE7F-06CA-4AAE-8892-3E630E900FD0}

c:\users\Nancy\AppData\Local\{75BA0DB9-3BB4-4655-9649-A659B8E1EC96}

c:\users\Nancy\AppData\Local\{7BCB44D8-D4FB-402A-A6BA-9774902EAAB3}

c:\users\Nancy\AppData\Local\{89040DCA-974D-4F14-A85D-3C90DC375D20}

c:\users\Nancy\AppData\Local\{89AD610B-15F9-4286-8484-F9A94803146D}

c:\users\Nancy\AppData\Local\{8AF9163F-B6CC-4B75-8002-65E658370B13}

c:\users\Nancy\AppData\Local\{92572B97-72EF-4417-A512-13BB18D53462}

c:\users\Nancy\AppData\Local\{95E50AE5-193D-45AB-882C-EF03D6472765}

c:\users\Nancy\AppData\Local\{96F2A133-5B19-4979-AF8B-DFABCE0B7F78}

c:\users\Nancy\AppData\Local\{97D375D6-35F7-4EE0-B6D2-3359F15F30CB}

c:\users\Nancy\AppData\Local\{992D8976-D0B3-41A2-AC72-94C5005089C0}

c:\users\Nancy\AppData\Local\{A332EBF1-FFFE-4E33-B5FF-615DAF4C4F6C}

c:\users\Nancy\AppData\Local\{ABE64375-0416-45A0-B69F-7938DB5B6D16}

c:\users\Nancy\AppData\Local\{AED600EE-A22F-4B20-B275-15BDAB4F6C8E}

c:\users\Nancy\AppData\Local\{AF964F8F-2B7C-4A25-BB67-DAF3C9F62AF5}

c:\users\Nancy\AppData\Local\{B491E160-7296-45AD-BF4E-B52BEE091015}

c:\users\Nancy\AppData\Local\{B8993139-1FF1-4AD2-A902-35D445465D45}

c:\users\Nancy\AppData\Local\{C8A7EC52-DF0E-44E7-8DFE-8AF70F70C21D}

c:\users\Nancy\AppData\Local\{C99141CF-1998-4D5D-98EE-3D321D8FBFAB}

c:\users\Nancy\AppData\Local\{CE243EB9-B936-4FA7-8E4A-BC5EE678CBF3}

c:\users\Nancy\AppData\Local\{D52379C4-6D54-49C3-99DD-BB01A472835C}

c:\users\Nancy\AppData\Local\{D95AA3A4-F1D5-4578-8A9F-23CAEAA3B0D4}

c:\users\Nancy\AppData\Local\{E561CC4B-00EE-475A-A7F6-8374E7288BBD}

c:\users\Nancy\AppData\Local\{E610BA14-1123-47F0-9D9B-DE5D315792B6}

c:\users\Nancy\AppData\Local\{EBA9D5F0-FE17-4B12-86AE-1939BED5812A}

c:\users\Nancy\AppData\Local\{F101C60C-0A91-4FDE-9771-38838673E9BA}

c:\users\Nancy\AppData\Local\{F15279E2-7B52-4839-869A-68902F5918B9}

c:\users\Nancy\AppData\Local\{FA9AA1D7-87BB-4A81-B016-80FE0CDCC336}

c:\users\Nancy\AppData\Local\{FC8F4A5A-3751-494D-8C04-66A3EAFFEB36}

c:\users\Nancy\AppData\Local\Conduit

c:\users\Nancy\AppData\Local\Conduit\CT2832595\InnoGames_InternationalAutoUpdateHelper.exe

c:\windows\system32\ConduitEngine.tmp

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-05-20 to 2011-06-20 ))))))))))))))))))))))))))))))

.

2011-06-20 21:00 . 2011-06-20 21:01 -------- d-----w- c:\users\Nancy\AppData\Local\temp

2011-06-20 21:00 . 2011-06-20 21:00 -------- d-----w- c:\users\Default\AppData\Local\temp